{ "head": { "vars": [ "query_def_tech_label", "top_def_tech_label", "def_tactic_label", "def_tactic_rel_label", "def_tech_label", "def_artifact_rel_label", "def_artifact_label", "off_artifact_label", "off_artifact_rel_label", "off_tech_label", "off_tech_parent_label", "off_tech_parent_is_toplevel", "off_tactic_rel_label", "off_tactic_label", "def_tactic", "def_tactic_rel", "def_tech", "def_artifact_rel", "def_artifact", "off_artifact", "off_artifact_rel", "off_tech", "off_tech_parent", "off_tactic_rel", "off_tactic" ] }, "results": { "bindings": [ { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "SID-History Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_label": { "type": "literal", "value": "Group Policy" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Group Policy Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1484" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Cloud Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "SID-History Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_label": { "type": "literal", "value": "Group Policy" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Group Policy Preferences" }, "off_tech_parent_label": { "type": "literal", "value": "Unsecured Credentials" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Domain Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Local Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Account Access Removal" }, "off_tech_parent_label": { "type": "literal", "value": "Impact Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Setuid and Setgid" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "File and Directory Permissions Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1222" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_label": { "type": "literal", "value": "Group Policy" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Group Policy Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1484" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Domain Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Cloud Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Global User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Add Office 365 Global Administrator Role" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_label": { "type": "literal", "value": "Group Policy" }, "off_artifact_rel_label": { "type": "literal", "value": "reads" }, "off_tech_label": { "type": "literal", "value": "Group Policy Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1615" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Exchange Email Delegate Permissions" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Setuid and Setgid" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Access Modeling" }, "top_def_tech_label": { "type": "literal", "value": "Operational Activity Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Access Modeling" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Local Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessModeling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Local Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Global User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Add Office 365 Global Administrator Role" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Exchange Email Delegate Permissions" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Domain Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Cloud Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Cloud Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Domain Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Local Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Account Access Removal" }, "off_tech_parent_label": { "type": "literal", "value": "Impact Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Account Locking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Active Certificate Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Certificate Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-transfer" }, "off_tech_label": { "type": "literal", "value": "Asymmetric Cryptography" }, "off_tech_parent_label": { "type": "literal", "value": "Encrypted Channel" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Active Certificate Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Certificate Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-transfer" }, "off_tech_label": { "type": "literal", "value": "Exfiltration Over C2 Channel" }, "off_tech_parent_label": { "type": "literal", "value": "Exfiltration Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Exfiltration" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010" } }, { "query_def_tech_label": { "type": "literal", "value": "Active Certificate Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Certificate Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-transfer" }, "off_tech_label": { "type": "literal", "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol" }, "off_tech_parent_label": { "type": "literal", "value": "Exfiltration Over Alternative Protocol" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Exfiltration" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010" } }, { "query_def_tech_label": { "type": "literal", "value": "Active Certificate Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Certificate Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-transfer" }, "off_tech_label": { "type": "literal", "value": "Application Layer Protocol" }, "off_tech_parent_label": { "type": "literal", "value": "Command and Control Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Active Certificate Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Certificate Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-transfer" }, "off_tech_label": { "type": "literal", "value": "Web Protocols" }, "off_tech_parent_label": { "type": "literal", "value": "Application Layer Protocol" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Active Logical Link Mapping" }, "top_def_tech_label": { "type": "literal", "value": "Network Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Logical Link Mapping" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "Network Node" }, "off_artifact_label": { "type": "literal", "value": "Mail Server" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Transport Agent" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Active Logical Link Mapping" }, "top_def_tech_label": { "type": "literal", "value": "Network Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Logical Link Mapping" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "Network Node" }, "off_artifact_label": { "type": "literal", "value": "Mail Server" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Remote Email Collection" }, "off_tech_parent_label": { "type": "literal", "value": "Email Collection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Active Logical Link Mapping" }, "top_def_tech_label": { "type": "literal", "value": "Network Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Logical Link Mapping" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "Network Node" }, "off_artifact_label": { "type": "literal", "value": "Web Server" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Web Shell" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LogicalLinkMapping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServer" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Active Physical Link Mapping" }, "top_def_tech_label": { "type": "literal", "value": "Network Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Physical Link Mapping" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "Network Node" }, "off_artifact_label": { "type": "literal", "value": "Mail Server" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Remote Email Collection" }, "off_tech_parent_label": { "type": "literal", "value": "Email Collection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Active Physical Link Mapping" }, "top_def_tech_label": { "type": "literal", "value": "Network Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Physical Link Mapping" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "Network Node" }, "off_artifact_label": { "type": "literal", "value": "Web Server" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Web Shell" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServer" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Active Physical Link Mapping" }, "top_def_tech_label": { "type": "literal", "value": "Network Mapping" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Physical Link Mapping" }, "def_artifact_rel_label": { "type": "literal", "value": "maps" }, "def_artifact_label": { "type": "literal", "value": "Network Node" }, "off_artifact_label": { "type": "literal", "value": "Mail Server" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Transport Agent" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PhysicalLinkMapping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#maps" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Administrative Network Activity Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Administrative Network Activity Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Windows Management Instrumentation Event Subscription" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Administrative Network Activity Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Administrative Network Activity Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Rogue Domain Controller" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Administrative Network Activity Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Administrative Network Activity Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Password Spraying" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Administrative Network Activity Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Administrative Network Activity Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Windows Management Instrumentation Event Subscription" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Administrative Network Activity Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Administrative Network Activity Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Credential Stuffing" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Administrative Network Activity Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Administrative Network Activity Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Administrative Network Activity Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Administrative Network Activity Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Additional Azure Service Principal Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Administrative Network Activity Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Administrative Network Activity Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "DCSync" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Administrative Network Activity Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Administrative Network Activity Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Windows Management Instrumentation Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Administrative Network Activity Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Administrative Network Activity Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkActivityAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Configuration Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Application Configuration Hardening" }, "def_artifact_rel_label": { "type": "literal", "value": "hardens" }, "def_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_label": { "type": "literal", "value": "Process Environment Variable" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Impair Command History Logging" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessEnvironmentVariable" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Configuration Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Application Configuration Hardening" }, "def_artifact_rel_label": { "type": "literal", "value": "hardens" }, "def_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Disable Windows Event Logging" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Configuration Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Application Configuration Hardening" }, "def_artifact_rel_label": { "type": "literal", "value": "hardens" }, "def_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_label": { "type": "literal", "value": "Email Rule" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Email Hiding Rules" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Configuration Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Application Configuration Hardening" }, "def_artifact_rel_label": { "type": "literal", "value": "hardens" }, "def_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Email Hiding Rules" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Configuration Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Application Configuration Hardening" }, "def_artifact_rel_label": { "type": "literal", "value": "hardens" }, "def_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_label": { "type": "literal", "value": "Email Rule" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Email Hiding Rules" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Configuration Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Application Configuration Hardening" }, "def_artifact_rel_label": { "type": "literal", "value": "hardens" }, "def_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Email Forwarding Rule" }, "off_tech_parent_label": { "type": "literal", "value": "Email Collection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Process Segment Execution Prevention" }, "def_artifact_rel_label": { "type": "literal", "value": "neutralizes" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Exploit Public-Facing Application" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Segment Address Offset Randomization" }, "def_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Mavinject" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Process Segment Execution Prevention" }, "def_artifact_rel_label": { "type": "literal", "value": "neutralizes" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Reflective Code Loading" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1620" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Process Segment Execution Prevention" }, "def_artifact_rel_label": { "type": "literal", "value": "neutralizes" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Mavinject" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Application Configuration Hardening" }, "def_artifact_rel_label": { "type": "literal", "value": "hardens" }, "def_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Email Forwarding Rule" }, "off_tech_parent_label": { "type": "literal", "value": "Email Collection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Segment Address Offset Randomization" }, "def_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Code Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Process Hollowing" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Segment Address Offset Randomization" }, "def_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Code Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Exploitation of Remote Services" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Segment Address Offset Randomization" }, "def_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "System Owner/User Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Segment Address Offset Randomization" }, "def_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Reflective Code Loading" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1620" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Process Segment Execution Prevention" }, "def_artifact_rel_label": { "type": "literal", "value": "neutralizes" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Code Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Credential API Hooking" }, "off_tech_parent_label": { "type": "literal", "value": "Input Capture" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Stack Frame Canary Validation" }, "def_artifact_rel_label": { "type": "literal", "value": "validates" }, "def_artifact_label": { "type": "literal", "value": "Stack Frame" }, "off_artifact_label": { "type": "literal", "value": "Stack Frame" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Exploitation of Remote Services" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrameCanaryValidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#validates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Application Configuration Hardening" }, "def_artifact_rel_label": { "type": "literal", "value": "hardens" }, "def_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_label": { "type": "literal", "value": "Email Rule" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Email Hiding Rules" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Application Configuration Hardening" }, "def_artifact_rel_label": { "type": "literal", "value": "hardens" }, "def_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_label": { "type": "literal", "value": "Email Rule" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Email Hiding Rules" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Process Segment Execution Prevention" }, "def_artifact_rel_label": { "type": "literal", "value": "neutralizes" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "System Owner/User Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Process Segment Execution Prevention" }, "def_artifact_rel_label": { "type": "literal", "value": "neutralizes" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Code Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Exploitation for Privilege Escalation" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1068" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Segment Address Offset Randomization" }, "def_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Code Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Exploitation for Privilege Escalation" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1068" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Segment Address Offset Randomization" }, "def_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Drive-by Compromise" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Process Segment Execution Prevention" }, "def_artifact_rel_label": { "type": "literal", "value": "neutralizes" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Exploitation of Remote Services" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Application Configuration Hardening" }, "def_artifact_rel_label": { "type": "literal", "value": "hardens" }, "def_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Email Hiding Rules" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Segment Address Offset Randomization" }, "def_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Exploitation of Remote Services" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Process Segment Execution Prevention" }, "def_artifact_rel_label": { "type": "literal", "value": "neutralizes" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Code Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Process Hollowing" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Process Segment Execution Prevention" }, "def_artifact_rel_label": { "type": "literal", "value": "neutralizes" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Drive-by Compromise" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Stack Frame Canary Validation" }, "def_artifact_rel_label": { "type": "literal", "value": "validates" }, "def_artifact_label": { "type": "literal", "value": "Stack Frame" }, "off_artifact_label": { "type": "literal", "value": "Stack Frame" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Exploitation for Privilege Escalation" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrameCanaryValidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#validates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1068" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Segment Address Offset Randomization" }, "def_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Mavinject" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Segment Address Offset Randomization" }, "def_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Code Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Credential API Hooking" }, "off_tech_parent_label": { "type": "literal", "value": "Input Capture" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Application Configuration Hardening" }, "def_artifact_rel_label": { "type": "literal", "value": "hardens" }, "def_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_label": { "type": "literal", "value": "Process Environment Variable" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Impair Command History Logging" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessEnvironmentVariable" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Process Segment Execution Prevention" }, "def_artifact_rel_label": { "type": "literal", "value": "neutralizes" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Code Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Exploitation for Credential Access" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Process Segment Execution Prevention" }, "def_artifact_rel_label": { "type": "literal", "value": "neutralizes" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Mavinject" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Segment Address Offset Randomization" }, "def_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Code Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Exploitation for Client Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1203" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Process Segment Execution Prevention" }, "def_artifact_rel_label": { "type": "literal", "value": "neutralizes" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Code Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Exploitation of Remote Services" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Process Segment Execution Prevention" }, "def_artifact_rel_label": { "type": "literal", "value": "neutralizes" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Code Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Exploitation for Defense Evasion" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1211" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Application Configuration Hardening" }, "def_artifact_rel_label": { "type": "literal", "value": "hardens" }, "def_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Disable Windows Event Logging" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationHardening" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#hardens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Segment Address Offset Randomization" }, "def_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Code Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Exploitation for Defense Evasion" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1211" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Process Segment Execution Prevention" }, "def_artifact_rel_label": { "type": "literal", "value": "neutralizes" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Code Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Credential API Hooking" }, "off_tech_parent_label": { "type": "literal", "value": "Input Capture" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Segment Address Offset Randomization" }, "def_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Code Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Credential API Hooking" }, "off_tech_parent_label": { "type": "literal", "value": "Input Capture" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Stack Frame Canary Validation" }, "def_artifact_rel_label": { "type": "literal", "value": "validates" }, "def_artifact_label": { "type": "literal", "value": "Stack Frame" }, "off_artifact_label": { "type": "literal", "value": "Stack Frame" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Exploitation for Client Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrameCanaryValidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#validates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1203" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Process Segment Execution Prevention" }, "def_artifact_rel_label": { "type": "literal", "value": "neutralizes" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Code Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Process Hollowing" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Segment Address Offset Randomization" }, "def_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Code Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Process Hollowing" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.012" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Stack Frame Canary Validation" }, "def_artifact_rel_label": { "type": "literal", "value": "validates" }, "def_artifact_label": { "type": "literal", "value": "Stack Frame" }, "off_artifact_label": { "type": "literal", "value": "Stack Frame" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Exploitation for Defense Evasion" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrameCanaryValidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#validates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1211" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Segment Address Offset Randomization" }, "def_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Exploit Public-Facing Application" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Segment Address Offset Randomization" }, "def_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Code Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Exploitation for Credential Access" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SegmentAddressOffsetRandomization" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Process Segment Execution Prevention" }, "def_artifact_rel_label": { "type": "literal", "value": "neutralizes" }, "def_artifact_label": { "type": "literal", "value": "Process Segment" }, "off_artifact_label": { "type": "literal", "value": "Process Code Segment" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Exploitation for Client Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegmentExecutionPrevention" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#neutralizes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSegment" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessCodeSegment" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1203" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Application Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Stack Frame Canary Validation" }, "def_artifact_rel_label": { "type": "literal", "value": "validates" }, "def_artifact_label": { "type": "literal", "value": "Stack Frame" }, "off_artifact_label": { "type": "literal", "value": "Stack Frame" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Exploitation for Credential Access" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrameCanaryValidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#validates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StackFrame" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Compiler" }, "off_artifact_rel_label": { "type": "literal", "value": "runs" }, "off_tech_label": { "type": "literal", "value": "MSBuild" }, "off_tech_parent_label": { "type": "literal", "value": "Trusted Developer Utilities Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Compiler" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#runs" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Emond" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Component Firmware" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Component Firmware" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Compromise Software Dependencies and Development Tools" }, "off_tech_parent_label": { "type": "literal", "value": "Supply Chain Compromise" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Compromise Software Dependencies and Development Tools" }, "off_tech_parent_label": { "type": "literal", "value": "Supply Chain Compromise" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Browser Extension" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Browser Extensions" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BrowserExtension" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1176" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Container Image" }, "off_artifact_label": { "type": "literal", "value": "Container Image" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Implant Container Image" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImageAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1525" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Browser Extension" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Browser Extensions" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BrowserExtension" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1176" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Client Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Compromise Client Software Binary" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ClientApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1554" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Client Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Compromise Client Software Binary" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ClientApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1554" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Windows Service" }, "off_tech_parent_label": { "type": "literal", "value": "Create or Modify System Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Spearphishing Link" }, "off_tech_parent_label": { "type": "literal", "value": "Phishing" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Netsh Helper DLL" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Init Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "disables" }, "off_tech_label": { "type": "literal", "value": "Safe Mode Boot" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Firewall Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Disable or Modify System Firewall" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirewallConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware Component Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Hardware Device" }, "off_artifact_label": { "type": "literal", "value": "Hardware Device" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Compromise Hardware Supply Chain" }, "off_tech_parent_label": { "type": "literal", "value": "Supply Chain Compromise" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Windows Registry Key" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Impair Command History Logging" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistryKey" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Rootkit" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "AppCert DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Process Environment Variable" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Impair Command History Logging" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessEnvironmentVariable" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Compromise Software Supply Chain" }, "off_tech_parent_label": { "type": "literal", "value": "Supply Chain Compromise" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Startup Directory" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Startup Items" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration Component" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Disable Windows Event Logging" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationComponent" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Disable Windows Event Logging" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "AppInit DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Compromise Software Supply Chain" }, "off_tech_parent_label": { "type": "literal", "value": "Supply Chain Compromise" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "MMC" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "MMC" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "MMC" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Rc.common" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Shim Database" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Application Shimming" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ShimDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Spearphishing Attachment" }, "off_tech_parent_label": { "type": "literal", "value": "Phishing" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Shim" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Application Shimming" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Shim" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Application Shimming" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Control Panel Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Rootkit" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Rc.common" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Image File Execution Options Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.012" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware Component Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Hardware Device" }, "off_artifact_label": { "type": "literal", "value": "Removable Media Device" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Replication Through Removable Media" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1091" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Microsoft HTML Application" }, "off_artifact_rel_label": { "type": "literal", "value": "interprets" }, "off_tech_label": { "type": "literal", "value": "Mshta Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Setuid and Setgid" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Elevated Execution with Prompt" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Emond" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Executable Installer File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Startup Directory" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Startup Items" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Windows Service" }, "off_tech_parent_label": { "type": "literal", "value": "Create or Modify System Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Component Object Model Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Group Policy" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Group Policy Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1484" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Control Panel Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Services File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Change Default File Association" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Services File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Screensaver" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware Component Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Hardware Device" }, "off_artifact_label": { "type": "literal", "value": "Removable Media Device" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Exfiltration over USB" }, "off_tech_parent_label": { "type": "literal", "value": "Exfiltration Over Physical Medium" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Exfiltration" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1052.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1052" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "Password File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "/etc/passwd and /etc/shadow" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "COR_PROFILER" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Init Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Services Registry Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Services File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Services File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Rogue Domain Controller" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Microsoft HTML Application" }, "off_artifact_rel_label": { "type": "literal", "value": "interprets" }, "off_tech_label": { "type": "literal", "value": "Mshta Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware Component Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Hardware Device" }, "off_artifact_label": { "type": "literal", "value": "Hardware Device" }, "off_artifact_rel_label": { "type": "literal", "value": "connects" }, "off_tech_label": { "type": "literal", "value": "Hardware Additions" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#connects" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1200" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Init Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Registry Run Keys / Startup Folder" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware Component Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Hardware Device" }, "off_artifact_label": { "type": "literal", "value": "Keyboard Input Device" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Keylogging" }, "off_tech_parent_label": { "type": "literal", "value": "Input Capture" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Web Server Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Web Portal Capture" }, "off_tech_parent_label": { "type": "literal", "value": "Input Capture" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServerApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Web Server Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Web Portal Capture" }, "off_tech_parent_label": { "type": "literal", "value": "Input Capture" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServerApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Group Policy" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Group Policy Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1484" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Port Monitors" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "File and Directory Permissions Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1222" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Executable Installer File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Executable Installer File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Authentication Package" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Time Providers" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Network Node Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Network Node" }, "off_artifact_label": { "type": "literal", "value": "Mail Server" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Transport Agent" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNodeInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Kernel" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Rootkit" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Winlogon Helper DLL" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Security Support Provider" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Password Database" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "LSA Secrets" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemPasswordDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Password Database" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Security Account Manager" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemPasswordDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Kernel" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Rootkit" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Credentials in Registry" }, "off_tech_parent_label": { "type": "literal", "value": "Unsecured Credentials" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Group Policy" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Group Policy Preferences" }, "off_tech_parent_label": { "type": "literal", "value": "Unsecured Credentials" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "Code Repository" }, "off_artifact_rel_label": { "type": "literal", "value": "reads" }, "off_tech_label": { "type": "literal", "value": "Code Repositories" }, "off_tech_parent_label": { "type": "literal", "value": "Data from Information Repositories" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CodeRepository" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Network Node Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Network Node" }, "off_artifact_label": { "type": "literal", "value": "Web Server" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Web Shell" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNodeInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServer" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Cloud Instance Metadata" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Cloud Instance Metadata API" }, "off_tech_parent_label": { "type": "literal", "value": "Unsecured Credentials" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudInstanceMetadata" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "MMC" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Service Software" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LSASS Driver" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "MMC" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "reads" }, "off_tech_label": { "type": "literal", "value": "Local Email Collection" }, "off_tech_parent_label": { "type": "literal", "value": "Email Collection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Service Software" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LSASS Driver" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "IIS Components" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "IIS Components" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Email Forwarding Rule" }, "off_tech_parent_label": { "type": "literal", "value": "Email Collection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Password Filter DLL" }, "off_tech_parent_label": { "type": "literal", "value": "Modify Authentication Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Network Node Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Network Node" }, "off_artifact_label": { "type": "literal", "value": "Mail Server" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Remote Email Collection" }, "off_tech_parent_label": { "type": "literal", "value": "Email Collection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNodeInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "MMC" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Service Software" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LSASS Driver" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Service Software" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LSASS Driver" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Stored Procedure" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "SQL Stored Procedures" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Stored Procedure" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "SQL Stored Procedures" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "MacOS Keychain" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Keychain" }, "off_tech_parent_label": { "type": "literal", "value": "Credentials from Password Stores" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MacOSKeychain" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Compiler" }, "off_artifact_rel_label": { "type": "literal", "value": "runs" }, "off_tech_label": { "type": "literal", "value": "MSBuild" }, "off_tech_parent_label": { "type": "literal", "value": "Trusted Developer Utilities Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Compiler" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#runs" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Component Firmware" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Component Firmware" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "In-memory Password Store" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Credentials from Web Browsers" }, "off_tech_parent_label": { "type": "literal", "value": "Credentials from Password Stores" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#In-memoryPasswordStore" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "In-memory Password Store" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Securityd Memory" }, "off_tech_parent_label": { "type": "literal", "value": "Credentials from Password Stores" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#In-memoryPasswordStore" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Boot Loader" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Bootkit" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Security Support Provider" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Winlogon Helper DLL" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Boot Loader" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Bootkit" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Query Registry" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1012" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Time Providers" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Authentication Package" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Port Monitors" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware Component Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Hardware Device" }, "off_artifact_label": { "type": "literal", "value": "Video Input Device" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Video Capture" }, "off_tech_parent_label": { "type": "literal", "value": "Collection Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VideoInputDevice" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1125" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Time Application" }, "off_artifact_rel_label": { "type": "literal", "value": "may-run" }, "off_tech_label": { "type": "literal", "value": "Time Based Evasion" }, "off_tech_parent_label": { "type": "literal", "value": "Virtualization/Sandbox Evasion" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-run" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Time Application" }, "off_artifact_rel_label": { "type": "literal", "value": "may-run" }, "off_tech_label": { "type": "literal", "value": "Time Based Evasion" }, "off_tech_parent_label": { "type": "literal", "value": "Virtualization/Sandbox Evasion" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-run" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware Component Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Hardware Device" }, "off_artifact_label": { "type": "literal", "value": "Audio Input Device" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Audio Capture" }, "off_tech_parent_label": { "type": "literal", "value": "Collection Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AudioInputDevice" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1123" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Init Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Services Registry Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "ROMMONkit" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "ROMMONkit" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Init Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Registry Run Keys / Startup Folder" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware Component Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Hardware Device" }, "off_artifact_label": { "type": "literal", "value": "Removable Media Device" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Data from Removable Media" }, "off_tech_parent_label": { "type": "literal", "value": "Collection Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1025" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "System Firmware" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "System Firmware" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Email Rule" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Email Hiding Rules" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Email Rule" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Email Hiding Rules" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Email Hiding Rules" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "COR_PROFILER" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware Component Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Hardware Device" }, "off_artifact_label": { "type": "literal", "value": "Keyboard Input Device" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Keylogging" }, "off_tech_parent_label": { "type": "literal", "value": "Input Capture" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Office Application File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "VBA Stomping" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Web Server Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Web Portal Capture" }, "off_tech_parent_label": { "type": "literal", "value": "Input Capture" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServerApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Web Server Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Web Portal Capture" }, "off_tech_parent_label": { "type": "literal", "value": "Input Capture" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServerApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "installs" }, "off_tech_label": { "type": "literal", "value": "Software Deployment Tools Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "installs" }, "off_tech_label": { "type": "literal", "value": "Software Deployment Tools Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Virtualization Software" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Run Virtual Instance" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Virtualization Software" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Run Virtual Instance" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Virtualization Software" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Run Virtual Instance" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Virtualization Software" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Run Virtual Instance" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Office Application File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Outlook Forms" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Hidden File System" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Hidden Window" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Outlook Home Page" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "Password File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "System Owner/User Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Outlook Rules" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Office Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Add-ins" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Office Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Add-ins" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "Password Store" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Credentials from Password Stores" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordStore" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Add-ins" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Add-ins" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Add-ins" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Executable Installer File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "Windows Registry" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Modify Registry" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistry" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1112" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Office Template Macros" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Office Test" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Screensaver" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Change Default File Association" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Executable Installer File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Executable Installer File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "SIP and Trust Provider Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Subvert Trust Controls" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1553.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1553" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Elevated Execution with Prompt" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Setuid and Setgid" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software Deployment Tool" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Software Deployment Tools Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Credential Management System" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Exploitation for Credential Access" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Credential Management System" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Exploitation for Credential Access" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Internal Spearphishing" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Netsh Helper DLL" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software Deployment Tool" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Software Deployment Tools Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware Component Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Hardware Device" }, "off_artifact_label": { "type": "literal", "value": "Security Token" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Two-Factor Authentication Interception" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SecurityToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1111" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "Code Repository" }, "off_artifact_rel_label": { "type": "literal", "value": "reads" }, "off_tech_label": { "type": "literal", "value": "Code Repositories" }, "off_tech_parent_label": { "type": "literal", "value": "Data from Information Repositories" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CodeRepository" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "queries" }, "off_tech_label": { "type": "literal", "value": "System Language Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "System Location Discovery" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#queries" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1614.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1614" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Security Software Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Software Discovery" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Firewall Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Security Software Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Software Discovery" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirewallConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "AppCert DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware Component Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Hardware Device" }, "off_artifact_label": { "type": "literal", "value": "Removable Media Device" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Replication Through Removable Media" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1091" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Services File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "System Location Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1614" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Services File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "AppInit DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Component Object Model Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Init Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Services Registry Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "COR_PROFILER" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Shim Database" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Application Shimming" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ShimDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware Component Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Hardware Device" }, "off_artifact_label": { "type": "literal", "value": "Cloud Storage" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Cloud Storage Object Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1619" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software Deployment Tool" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Software Deployment Tools Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software Deployment Tool" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Software Deployment Tools Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Group Policy" }, "off_artifact_rel_label": { "type": "literal", "value": "reads" }, "off_tech_label": { "type": "literal", "value": "Group Policy Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1615" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Shim" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Application Shimming" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Shim" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Application Shimming" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Password Filter DLL" }, "off_tech_parent_label": { "type": "literal", "value": "Modify Authentication Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Cloud Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Cloud Service Dashboard" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1538" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "installs" }, "off_tech_label": { "type": "literal", "value": "Software Deployment Tools Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "installs" }, "off_tech_label": { "type": "literal", "value": "Software Deployment Tools Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "System Firmware" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "System Firmware" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Cloud Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "reads" }, "off_tech_label": { "type": "literal", "value": "Cloud Service Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1526" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware Component Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Hardware Device" }, "off_artifact_label": { "type": "literal", "value": "Removable Media Device" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Communication Through Removable Media" }, "off_tech_parent_label": { "type": "literal", "value": "Command and Control Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1092" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "SID-History Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "ROMMONkit" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Image File Execution Options Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.012" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "ROMMONkit" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "SID-History Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Software Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Boot Loader" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Bootkit" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Boot Loader" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Bootkit" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Office Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Add-ins" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "ROMMONkit" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software Deployment Tool" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Software Deployment Tools Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "installs" }, "off_tech_label": { "type": "literal", "value": "Software Deployment Tools Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Credential Management System" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Exploitation for Credential Access" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Compiler" }, "off_artifact_rel_label": { "type": "literal", "value": "runs" }, "off_tech_label": { "type": "literal", "value": "MSBuild" }, "off_tech_parent_label": { "type": "literal", "value": "Trusted Developer Utilities Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Compiler" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#runs" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Add-ins" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "MMC" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Service Software" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LSASS Driver" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Container Image" }, "off_artifact_label": { "type": "literal", "value": "Container Image" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Implant Container Image" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImageAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1525" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Compromise Software Supply Chain" }, "off_tech_parent_label": { "type": "literal", "value": "Supply Chain Compromise" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Executable Installer File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "ROMMONkit" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Service Software" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LSASS Driver" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Services File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "installs" }, "off_tech_label": { "type": "literal", "value": "Software Deployment Tools Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Shim" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Application Shimming" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Browser Extension" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Browser Extensions" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BrowserExtension" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1176" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "IIS Components" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Shim" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Application Shimming" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Boot Loader" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Bootkit" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Time Application" }, "off_artifact_rel_label": { "type": "literal", "value": "may-run" }, "off_tech_label": { "type": "literal", "value": "Time Based Evasion" }, "off_tech_parent_label": { "type": "literal", "value": "Virtualization/Sandbox Evasion" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-run" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Component Firmware" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Kernel" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Rootkit" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Virtualization Software" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Run Virtual Instance" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Services File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Web Server Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Web Portal Capture" }, "off_tech_parent_label": { "type": "literal", "value": "Input Capture" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServerApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software Deployment Tool" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Software Deployment Tools Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Rootkit" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "MMC" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Client Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Compromise Client Software Binary" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ClientApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1554" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Stored Procedure" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "SQL Stored Procedures" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Executable Installer File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Web Server Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Web Portal Capture" }, "off_tech_parent_label": { "type": "literal", "value": "Input Capture" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServerApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "System Firmware" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Virtualization Software" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Run Virtual Instance" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "System Firmware" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Boot Loader" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Bootkit" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Services File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Compromise Software Dependencies and Development Tools" }, "off_tech_parent_label": { "type": "literal", "value": "Supply Chain Compromise" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Executable Installer File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Component Firmware" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Spraying" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Cracking" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Additional Azure Service Principal Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Unsecured Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Keychain" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "NTDS" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Guessing" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket Granting Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "forges" }, "off_tech_label": { "type": "literal", "value": "Golden Ticket" }, "off_tech_parent_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "/etc/passwd and /etc/shadow" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Cached Domain Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Pass The Hash" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Pass The Ticket" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Password Guessing" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "External Remote Services" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1133" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Pass The Ticket" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Credential Stuffing" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Forced Authentication" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Password Spraying" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "External Remote Services" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1133" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Event Thresholding" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_label": { "type": "literal", "value": "Authentication" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Pass The Hash" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationEventThresholding" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authentication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Authorization Event Thresholding" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authorization Event Thresholding" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Authorization" }, "off_artifact_label": { "type": "literal", "value": "Authorization" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthorizationEventThresholding" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Authorization Event Thresholding" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authorization Event Thresholding" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Authorization" }, "off_artifact_label": { "type": "literal", "value": "Authorization" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthorizationEventThresholding" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Authorization Event Thresholding" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authorization Event Thresholding" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Authorization" }, "off_artifact_label": { "type": "literal", "value": "Authorization" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthorizationEventThresholding" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Authorization Event Thresholding" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authorization Event Thresholding" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Authorization" }, "off_artifact_label": { "type": "literal", "value": "Authorization" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "External Remote Services" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthorizationEventThresholding" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1133" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Authorization Event Thresholding" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authorization Event Thresholding" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Authorization" }, "off_artifact_label": { "type": "literal", "value": "Authorization" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "External Remote Services" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthorizationEventThresholding" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1133" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Authorization Event Thresholding" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authorization Event Thresholding" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Authorization" }, "off_artifact_label": { "type": "literal", "value": "Authorization" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthorizationEventThresholding" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Authorization" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Local Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Account Access Removal" }, "off_tech_parent_label": { "type": "literal", "value": "Impact Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Domain Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Local Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Global User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Add Office 365 Global Administrator Role" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Cloud Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Cloud Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Exchange Email Delegate Permissions" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Domain Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Bootloader Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Platform Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Bootloader Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "Boot Loader" }, "off_artifact_label": { "type": "literal", "value": "Boot Loader" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Bootkit" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootloaderAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Bootloader Authentication" }, "top_def_tech_label": { "type": "literal", "value": "Platform Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Bootloader Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "Boot Loader" }, "off_artifact_label": { "type": "literal", "value": "Boot Loader" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Bootkit" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootloaderAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Certificate Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Certificate Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-transfer" }, "off_tech_label": { "type": "literal", "value": "Exfiltration Over C2 Channel" }, "off_tech_parent_label": { "type": "literal", "value": "Exfiltration Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Exfiltration" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010" } }, { "query_def_tech_label": { "type": "literal", "value": "Certificate Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Certificate Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-transfer" }, "off_tech_label": { "type": "literal", "value": "Asymmetric Cryptography" }, "off_tech_parent_label": { "type": "literal", "value": "Encrypted Channel" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Certificate Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Certificate Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-transfer" }, "off_tech_label": { "type": "literal", "value": "Application Layer Protocol" }, "off_tech_parent_label": { "type": "literal", "value": "Command and Control Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Certificate Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Certificate Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-transfer" }, "off_tech_label": { "type": "literal", "value": "Web Protocols" }, "off_tech_parent_label": { "type": "literal", "value": "Application Layer Protocol" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Certificate Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Certificate Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-transfer" }, "off_tech_label": { "type": "literal", "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol" }, "off_tech_parent_label": { "type": "literal", "value": "Exfiltration Over Alternative Protocol" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Exfiltration" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Traffic Signaling" }, "off_tech_parent_label": { "type": "literal", "value": "Command and Control Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Exploitation of Remote Services" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Encrypted Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Encrypted Channel" }, "off_tech_parent_label": { "type": "literal", "value": "Command and Control Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Data Encoding" }, "off_tech_parent_label": { "type": "literal", "value": "Command and Control Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1132" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Data Obfuscation" }, "off_tech_parent_label": { "type": "literal", "value": "Command and Control Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Web Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Web Service" }, "off_tech_parent_label": { "type": "literal", "value": "Command and Control Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1102" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Encrypted Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol" }, "off_tech_parent_label": { "type": "literal", "value": "Exfiltration Over Alternative Protocol" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Exfiltration" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Remote System Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Port Knocking" }, "off_tech_parent_label": { "type": "literal", "value": "Traffic Signaling" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Rogue Domain Controller" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-produce" }, "off_tech_label": { "type": "literal", "value": "CMSTP" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet DNS Lookup Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Dynamic Resolution" }, "off_tech_parent_label": { "type": "literal", "value": "Command and Control Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Web Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-produce" }, "off_tech_label": { "type": "literal", "value": "BITS Jobs" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Man-in-the-Middle" }, "off_tech_parent_label": { "type": "literal", "value": "Collection Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Web Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Man in the Browser" }, "off_tech_parent_label": { "type": "literal", "value": "Collection Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1185" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Application Layer Protocol" }, "off_tech_parent_label": { "type": "literal", "value": "Command and Control Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Web Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-produce" }, "off_tech_label": { "type": "literal", "value": "BITS Jobs" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "RPC Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-produce" }, "off_tech_label": { "type": "literal", "value": "Kerberoasting" }, "off_tech_parent_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Inbound Internet Mail Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Spearphishing Link" }, "off_tech_parent_label": { "type": "literal", "value": "Phishing" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-produce" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "TFTP Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "TFTP Boot" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Scheduled Transfer" }, "off_tech_parent_label": { "type": "literal", "value": "Exfiltration Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Exfiltration" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1029" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Credential Stuffing" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "TFTP Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "TFTP Boot" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Encrypted Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Symmetric Cryptography" }, "off_tech_parent_label": { "type": "literal", "value": "Encrypted Channel" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Password Spraying" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Windows Management Instrumentation Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Automated Exfiltration" }, "off_tech_parent_label": { "type": "literal", "value": "Exfiltration Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Exfiltration" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1020" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol" }, "off_tech_parent_label": { "type": "literal", "value": "Exfiltration Over Alternative Protocol" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Exfiltration" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Traffic Signaling" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Web Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-produce" }, "off_tech_label": { "type": "literal", "value": "BITS Jobs" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Transmitted Data Manipulation" }, "off_tech_parent_label": { "type": "literal", "value": "Data Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Inbound Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Direct Network Flood" }, "off_tech_parent_label": { "type": "literal", "value": "Network Denial of Service" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Inbound Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Service Exhaustion Flood" }, "off_tech_parent_label": { "type": "literal", "value": "Network Denial of Service" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Inbound Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Reflection Amplification" }, "off_tech_parent_label": { "type": "literal", "value": "Network Denial of Service" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1498" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Network Session" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "External Remote Services" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkSession" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1133" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Data Transfer Size Limits" }, "off_tech_parent_label": { "type": "literal", "value": "Exfiltration Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Exfiltration" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1030" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet File Transfer Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "File Transfer Protocols" }, "off_tech_parent_label": { "type": "literal", "value": "Application Layer Protocol" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Exfiltration Over Other Network Medium" }, "off_tech_parent_label": { "type": "literal", "value": "Exfiltration Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Exfiltration" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Multicast Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "LLMNR/NBT-NS Poisoning and SMB Relay" }, "off_tech_parent_label": { "type": "literal", "value": "Man-in-the-Middle" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Remote Desktop Protocol" }, "off_tech_parent_label": { "type": "literal", "value": "Remote Services" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "SSH" }, "off_tech_parent_label": { "type": "literal", "value": "Remote Services" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-produce" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "DHCP Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "DHCP Spoofing" }, "off_tech_parent_label": { "type": "literal", "value": "Man-in-the-Middle" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Fallback Channels" }, "off_tech_parent_label": { "type": "literal", "value": "Command and Control Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Windows Management Instrumentation Event Subscription" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Port Knocking" }, "off_tech_parent_label": { "type": "literal", "value": "Traffic Signaling" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Web Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-produce" }, "off_tech_label": { "type": "literal", "value": "BITS Jobs" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Mail Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Mail Protocols" }, "off_tech_parent_label": { "type": "literal", "value": "Application Layer Protocol" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Web Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Web Protocols" }, "off_tech_parent_label": { "type": "literal", "value": "Application Layer Protocol" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Internal Proxy" }, "off_tech_parent_label": { "type": "literal", "value": "Proxy" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Web Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Malicious Link Execution" }, "off_tech_parent_label": { "type": "literal", "value": "User Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Encrypted Web Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Domain Fronting" }, "off_tech_parent_label": { "type": "literal", "value": "Proxy" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Man-in-the-Middle" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Multi-Stage Channels" }, "off_tech_parent_label": { "type": "literal", "value": "Command and Control Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1104" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Multi-hop Proxy" }, "off_tech_parent_label": { "type": "literal", "value": "Proxy" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "External Proxy" }, "off_tech_parent_label": { "type": "literal", "value": "Proxy" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Web Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Additional Azure Service Principal Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Windows Management Instrumentation Event Subscription" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Remote Services" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Encrypted Web Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Exfiltration to Cloud Storage" }, "off_tech_parent_label": { "type": "literal", "value": "Exfiltration Over Web Service" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Exfiltration" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Ingress Tool Transfer" }, "off_tech_parent_label": { "type": "literal", "value": "Command and Control Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1105" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Trusted Relationship" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Port Knocking" }, "off_tech_parent_label": { "type": "literal", "value": "Traffic Signaling" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Encrypted Remote Terminal Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-produce" }, "off_tech_label": { "type": "literal", "value": "Exfiltration to Code Repository" }, "off_tech_parent_label": { "type": "literal", "value": "Exfiltration Over Web Service" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Exfiltration" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-produce" }, "off_tech_label": { "type": "literal", "value": "CMSTP" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Inbound Internet Mail Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Spearphishing Attachment" }, "off_tech_parent_label": { "type": "literal", "value": "Phishing" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "DCSync" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Inbound Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Exploit Public-Facing Application" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Traffic Signaling" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1205" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Drive-by Compromise" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1189" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Network Session" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "External Remote Services" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkSession" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1133" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Remote Service Session Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1563" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet File Transfer Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Lateral Tool Transfer" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet IPC Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-produce" }, "off_tech_label": { "type": "literal", "value": "BITS Jobs" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Exfiltration Over C2 Channel" }, "off_tech_parent_label": { "type": "literal", "value": "Exfiltration Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Exfiltration" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Encrypted Web Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-produce" }, "off_tech_label": { "type": "literal", "value": "Exfiltration to Code Repository" }, "off_tech_parent_label": { "type": "literal", "value": "Exfiltration Over Web Service" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Exfiltration" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet DNS Lookup Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "DNS" }, "off_tech_parent_label": { "type": "literal", "value": "Application Layer Protocol" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Non-Application Layer Protocol" }, "off_tech_parent_label": { "type": "literal", "value": "Command and Control Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1095" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Encrypted Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Asymmetric Cryptography" }, "off_tech_parent_label": { "type": "literal", "value": "Encrypted Channel" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Web Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Exfiltration Over Alternative Protocol" }, "off_tech_parent_label": { "type": "literal", "value": "Exfiltration Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Exfiltration" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Encrypted Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol" }, "off_tech_parent_label": { "type": "literal", "value": "Exfiltration Over Alternative Protocol" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Exfiltration" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Web Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Exfiltration Over Web Service" }, "off_tech_parent_label": { "type": "literal", "value": "Exfiltration Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Exfiltration" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1567" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Multicast Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "LLMNR/NBT-NS Poisoning and SMB Relay" }, "off_tech_parent_label": { "type": "literal", "value": "Man-in-the-Middle" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "DHCP Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "DHCP Spoofing" }, "off_tech_parent_label": { "type": "literal", "value": "Man-in-the-Middle" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Remote Access Software" }, "off_tech_parent_label": { "type": "literal", "value": "Command and Control Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1219" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Non-Standard Port" }, "off_tech_parent_label": { "type": "literal", "value": "Command and Control Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1571" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet IPC Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-produce" }, "off_tech_label": { "type": "literal", "value": "BITS Jobs" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Client-server Payload Profiling" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Protocol Tunneling" }, "off_tech_parent_label": { "type": "literal", "value": "Command and Control Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Client-serverPayloadProfiling" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1572" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Winlogon Helper DLL" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Firewall Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Security Software Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Software Discovery" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirewallConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Shim Database" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Application Shimming" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ShimDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Netsh Helper DLL" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "AppInit DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Init Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Registry Run Keys / Startup Folder" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Email Rule" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Email Hiding Rules" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Startup Directory" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Startup Items" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "AppCert DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Init Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "disables" }, "off_tech_label": { "type": "literal", "value": "Safe Mode Boot" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Firewall Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Disable or Modify System Firewall" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirewallConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "SID-History Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Windows Registry Key" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Impair Command History Logging" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistryKey" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Email Rule" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Email Hiding Rules" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRule" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Email Forwarding Rule" }, "off_tech_parent_label": { "type": "literal", "value": "Email Collection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Setuid and Setgid" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Control Panel Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Emond" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Change Default File Association" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Shim Database" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Application Shimming" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ShimDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "COR_PROFILER" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Rc.common" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Group Policy" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Group Policy Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1484" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "AppCert DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "File and Directory Permissions Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1222" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Process Environment Variable" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Impair Command History Logging" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessEnvironmentVariable" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Security Software Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Software Discovery" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Port Monitors" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "COR_PROFILER" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Authentication Package" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Init Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Services Registry Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Time Providers" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Password Filter DLL" }, "off_tech_parent_label": { "type": "literal", "value": "Modify Authentication Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Winlogon Helper DLL" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Startup Directory" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Startup Items" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemStartupDirectory" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration Component" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Disable Windows Event Logging" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationComponent" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Disable Windows Event Logging" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Security Support Provider" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Init Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Registry Run Keys / Startup Folder" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "AppInit DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Rc.common" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Netsh Helper DLL" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Emond" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "System Location Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1614" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Group Policy" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Group Policy Preferences" }, "off_tech_parent_label": { "type": "literal", "value": "Unsecured Credentials" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Cloud Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Cloud Service Dashboard" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1538" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Outlook Rules" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Office Template Macros" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Office Test" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Outlook Home Page" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Init Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Services Registry Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Screensaver" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Password Filter DLL" }, "off_tech_parent_label": { "type": "literal", "value": "Modify Authentication Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "SID-History Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Port Monitors" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Cloud Instance Metadata" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Cloud Instance Metadata API" }, "off_tech_parent_label": { "type": "literal", "value": "Unsecured Credentials" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudInstanceMetadata" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Authentication Package" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Time Providers" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Cloud Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "reads" }, "off_tech_label": { "type": "literal", "value": "Cloud Service Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1526" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "COR_PROFILER" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Group Policy" }, "off_artifact_rel_label": { "type": "literal", "value": "reads" }, "off_tech_label": { "type": "literal", "value": "Group Policy Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1615" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Init Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Services Registry Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationInitDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Screensaver" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Group Policy" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Group Policy Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GroupPolicy" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1484" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Access Control Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Setuid and Setgid" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessControlConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Security Support Provider" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Control Panel Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "SIP and Trust Provider Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Subvert Trust Controls" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1553.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1553" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database Record" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Change Default File Association" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabaseRecord" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Configuration Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Configuration Resource" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Email Hiding Rules" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConfigurationResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfiguration" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Connected Honeynet" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Environment" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Environment" }, "def_artifact_rel_label": { "type": "literal", "value": "manages" }, "def_artifact_label": { "type": "literal", "value": "Decoy Artifact" }, "off_artifact_label": { "type": "literal", "value": "Decoy Artifact" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "System Information Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyEnvironment" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#manages" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyArtifact" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyArtifact" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1082" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Internal Proxy" }, "off_tech_parent_label": { "type": "literal", "value": "Proxy" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1090" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Multicast Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "LLMNR/NBT-NS Poisoning and SMB Relay" }, "off_tech_parent_label": { "type": "literal", "value": "Man-in-the-Middle" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Exploitation of Remote Services" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1210" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet IPC Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-produce" }, "off_tech_label": { "type": "literal", "value": "BITS Jobs" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Windows Management Instrumentation Event Subscription" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet File Transfer Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Lateral Tool Transfer" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1570" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Web Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-produce" }, "off_tech_label": { "type": "literal", "value": "BITS Jobs" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Windows Management Instrumentation Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Password Spraying" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Credential Stuffing" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "DCSync" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Additional Azure Service Principal Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Windows Management Instrumentation Event Subscription" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Multicast Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "LLMNR/NBT-NS Poisoning and SMB Relay" }, "off_tech_parent_label": { "type": "literal", "value": "Man-in-the-Middle" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1557" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Administrative Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Rogue Domain Controller" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet IPC Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-produce" }, "off_tech_label": { "type": "literal", "value": "BITS Jobs" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Web Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "may-produce" }, "off_tech_label": { "type": "literal", "value": "BITS Jobs" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1197" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Trusted Relationship" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1199" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Connection Attempt Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Intranet Network Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Remote Services" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ConnectionAttemptAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1021" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Rootkit" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "MMC" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Component Firmware" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Time Application" }, "off_artifact_rel_label": { "type": "literal", "value": "may-run" }, "off_tech_label": { "type": "literal", "value": "Time Based Evasion" }, "off_tech_parent_label": { "type": "literal", "value": "Virtualization/Sandbox Evasion" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemTimeApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-run" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Services File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Shim" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Application Shimming" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Web Server Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Web Portal Capture" }, "off_tech_parent_label": { "type": "literal", "value": "Input Capture" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServerApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "IIS Components" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "installs" }, "off_tech_label": { "type": "literal", "value": "Software Deployment Tools Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Stored Procedure" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "SQL Stored Procedures" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StoredProcedure" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Office Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Add-ins" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "installs" }, "off_tech_label": { "type": "literal", "value": "Software Deployment Tools Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#installs" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Executable Installer File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Boot Loader" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Bootkit" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Add-ins" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Services File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "System Firmware" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Credential Management System" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Exploitation for Credential Access" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialManagementSystem" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Compromise Software Supply Chain" }, "off_tech_parent_label": { "type": "literal", "value": "Supply Chain Compromise" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Shim" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Application Shimming" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Shim" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Virtualization Software" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Run Virtual Instance" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Web Server Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Web Portal Capture" }, "off_tech_parent_label": { "type": "literal", "value": "Input Capture" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServerApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software Deployment Tool" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Software Deployment Tools Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Client Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Compromise Client Software Binary" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ClientApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1554" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Service Software" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LSASS Driver" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Services File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Executable Installer File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Kernel" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Rootkit" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Boot Loader" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Bootkit" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BootLoader" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "System Firmware" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Container Image" }, "off_artifact_label": { "type": "literal", "value": "Container Image" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Implant Container Image" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImageAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1525" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Browser Extension" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Browser Extensions" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BrowserExtension" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1176" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Virtualization Software" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Run Virtual Instance" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VirtualizationSoftware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Compromise Software Dependencies and Development Tools" }, "off_tech_parent_label": { "type": "literal", "value": "Supply Chain Compromise" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1195" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software Deployment Tool" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Software Deployment Tools Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareDeploymentTool" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Service Application" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Executable Installer File Permissions Weakness" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "MMC" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Service Software" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LSASS Driver" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemServiceSoftware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Compiler" }, "off_artifact_rel_label": { "type": "literal", "value": "runs" }, "off_tech_label": { "type": "literal", "value": "MSBuild" }, "off_tech_parent_label": { "type": "literal", "value": "Trusted Developer Utilities Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Compiler" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#runs" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "ROMMONkit" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Component Firmware" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Firmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Container Image Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Asset Vulnerability Enumeration" }, "def_artifact_rel_label": { "type": "literal", "value": "evaluates" }, "def_artifact_label": { "type": "literal", "value": "Software" }, "off_artifact_label": { "type": "literal", "value": "System Firmware" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "ROMMONkit" }, "off_tech_parent_label": { "type": "literal", "value": "Pre-OS Boot" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Software" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemFirmware" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1542" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Keychain" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Unsecured Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Cracking" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Spraying" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Guessing" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket Granting Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "forges" }, "off_tech_label": { "type": "literal", "value": "Golden Ticket" }, "off_tech_parent_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "NTDS" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Cached Domain Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "/etc/passwd and /etc/shadow" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Additional Azure Service Principal Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Compromise Scope Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialCompromiseScopeAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Local Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Spraying" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Exchange Email Delegate Permissions" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Spraying" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Keychain" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Keychain" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Global User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Add Office 365 Global Administrator Role" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Cached Domain Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket Granting Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "forges" }, "off_tech_label": { "type": "literal", "value": "Golden Ticket" }, "off_tech_parent_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "NTDS" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Cached Domain Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "NTDS" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Cloud Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Cracking" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Cracking" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Domain Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Local Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Additional Azure Service Principal Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Additional Azure Service Principal Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "/etc/passwd and /etc/shadow" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Account Access Removal" }, "off_tech_parent_label": { "type": "literal", "value": "Impact Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "/etc/passwd and /etc/shadow" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Unsecured Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Guessing" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Unsecured Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Domain Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Guessing" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket Granting Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "forges" }, "off_tech_label": { "type": "literal", "value": "Golden Ticket" }, "off_tech_parent_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Cloud Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Account Locking" }, "def_artifact_rel_label": { "type": "literal", "value": "disables" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccountLocking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Authentication Cache Invalidation" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationCacheInvalidation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Additional Azure Service Principal Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Local Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Additional Azure Service Principal Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "/etc/passwd and /etc/shadow" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Exchange Email Delegate Permissions" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Keychain" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "NTDS" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "NTDS" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Exchange Email Delegate Permissions" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "/etc/passwd and /etc/shadow" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Cached Domain Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Cached Domain Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Global User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Add Office 365 Global Administrator Role" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Global User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Add Office 365 Global Administrator Role" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Exchange Email Delegate Permissions" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Keychain" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Exchange Email Delegate Permissions" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Global User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Add Office 365 Global Administrator Role" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Exchange Email Delegate Permissions" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Global User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Add Office 365 Global Administrator Role" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Global User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Add Office 365 Global Administrator Role" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Cloud Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Cloud Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Cloud Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Cloud Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Cloud Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Domain Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Unsecured Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Domain Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Unsecured Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Domain Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Local Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Local Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Local Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Account Access Removal" }, "off_tech_parent_label": { "type": "literal", "value": "Impact Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Account Access Removal" }, "off_tech_parent_label": { "type": "literal", "value": "Impact Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Account Access Removal" }, "off_tech_parent_label": { "type": "literal", "value": "Impact Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Account Access Removal" }, "off_tech_parent_label": { "type": "literal", "value": "Impact Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Account Access Removal" }, "off_tech_parent_label": { "type": "literal", "value": "Impact Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1531" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ImpactTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Local Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Local Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Cracking" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Domain Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "use-limits" }, "def_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Cracking" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#use-limits" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Domain Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Domain Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Domain Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Domain Trust Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Directory Service" }, "off_artifact_label": { "type": "literal", "value": "Directory Service" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "System Owner/User Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainTrustPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Cracking" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Cracking" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Domain Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Domain Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Local Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Domain Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Cloud Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Cloud Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Cloud Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Spraying" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "use-limits" }, "def_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Spraying" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#use-limits" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Cloud Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Cloud Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Spraying" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Default User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Default Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefaultUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Spraying" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Local Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Guessing" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "use-limits" }, "def_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Guessing" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#use-limits" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Guessing" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Guessing" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "User Account Permissions" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Local Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccountPermissions" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Local Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Local User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Local Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LocalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "One-time Password" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#One-timePassword" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Biometric Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#BiometricAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket Granting Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "forges" }, "off_tech_label": { "type": "literal", "value": "Golden Ticket" }, "off_tech_parent_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket Granting Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "forges" }, "off_tech_label": { "type": "literal", "value": "Golden Ticket" }, "off_tech_parent_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Multi-factor Authentication" }, "def_artifact_rel_label": { "type": "literal", "value": "authenticates" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Multi-factorAuthentication" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#authenticates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Strong Password Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "strengthens" }, "def_artifact_label": { "type": "literal", "value": "User Account" }, "off_artifact_label": { "type": "literal", "value": "Cloud User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Cloud Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#StrongPasswordPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#strengthens" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Additional Azure Service Principal Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "NTDS" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Guessing" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "/etc/passwd and /etc/shadow" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Cracking" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket Granting Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "forges" }, "off_tech_label": { "type": "literal", "value": "Golden Ticket" }, "off_tech_parent_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Spraying" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Keychain" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Unsecured Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Cached Domain Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "top_def_tech_label": { "type": "literal", "value": "Credential Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Revoking" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRevoking" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "/etc/passwd and /etc/shadow" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Spraying" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Cached Domain Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Additional Azure Service Principal Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Guessing" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Unsecured Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Keychain" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket Granting Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "forges" }, "off_tech_label": { "type": "literal", "value": "Golden Ticket" }, "off_tech_parent_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Cracking" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "NTDS" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Rotation" }, "def_artifact_rel_label": { "type": "literal", "value": "regenerates" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialRotation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#regenerates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket Granting Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "forges" }, "off_tech_label": { "type": "literal", "value": "Golden Ticket" }, "off_tech_parent_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Cracking" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Spraying" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Guessing" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "NTDS" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Unsecured Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "/etc/passwd and /etc/shadow" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Keychain" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Additional Azure Service Principal Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Cached Domain Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Credential Transmission Scoping" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialTransmissionScoping" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "DNS Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Network Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "DNS Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Outbound Internet DNS Lookup Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet DNS Lookup Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Dynamic Resolution" }, "off_tech_parent_label": { "type": "literal", "value": "Command and Control Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "DNS Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Network Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "DNS Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Outbound Internet DNS Lookup Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet DNS Lookup Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "DNS" }, "off_tech_parent_label": { "type": "literal", "value": "Application Layer Protocol" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "DNS Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Network Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "DNS Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "DNS Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet DNS Lookup Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "DNS" }, "off_tech_parent_label": { "type": "literal", "value": "Application Layer Protocol" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "DNS Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Network Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "DNS Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "DNS Network Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet DNS Lookup Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Dynamic Resolution" }, "off_tech_parent_label": { "type": "literal", "value": "Command and Control Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSNetworkTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "DNS Traffic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "DNS Traffic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "may-contain" }, "def_artifact_label": { "type": "literal", "value": "DNS Lookup" }, "off_artifact_label": { "type": "literal", "value": "DNS Lookup" }, "off_artifact_rel_label": { "type": "literal", "value": "may-produce" }, "off_tech_label": { "type": "literal", "value": "Network Sniffing" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSTrafficAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-contain" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSLookup" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSLookup" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1040" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "DNS Traffic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "DNS Traffic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "may-contain" }, "def_artifact_label": { "type": "literal", "value": "DNS Lookup" }, "off_artifact_label": { "type": "literal", "value": "DNS Lookup" }, "off_artifact_rel_label": { "type": "literal", "value": "may-produce" }, "off_tech_label": { "type": "literal", "value": "Network Sniffing" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSTrafficAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-contain" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSLookup" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSLookup" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1040" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "DNS Traffic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "DNS Traffic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Outbound Internet DNS Lookup Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet DNS Lookup Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Dynamic Resolution" }, "off_tech_parent_label": { "type": "literal", "value": "Command and Control Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSTrafficAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1568" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "DNS Traffic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Network Traffic Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "DNS Traffic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Outbound Internet DNS Lookup Traffic" }, "off_artifact_label": { "type": "literal", "value": "Outbound Internet DNS Lookup Traffic" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "DNS" }, "off_tech_parent_label": { "type": "literal", "value": "Application Layer Protocol" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DNSTrafficAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Microsoft HTML Application" }, "off_artifact_rel_label": { "type": "literal", "value": "interprets" }, "off_tech_label": { "type": "literal", "value": "Mshta Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "reads" }, "off_tech_label": { "type": "literal", "value": "Local Email Collection" }, "off_tech_parent_label": { "type": "literal", "value": "Email Collection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "MMC" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Spearphishing Attachment" }, "off_tech_parent_label": { "type": "literal", "value": "Phishing" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Image File Execution Options Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.012" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Add-ins" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "Password Store" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Credentials from Password Stores" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordStore" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Component Object Model Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Component Object Model Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "Windows Registry" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Modify Registry" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsRegistry" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1112" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Hidden Window" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "In-memory Password Store" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Securityd Memory" }, "off_tech_parent_label": { "type": "literal", "value": "Credentials from Password Stores" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#In-memoryPasswordStore" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Hidden File System" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Office Application File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Outlook Forms" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Image File Execution Options Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.012" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "MacOS Keychain" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Keychain" }, "off_tech_parent_label": { "type": "literal", "value": "Credentials from Password Stores" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MacOSKeychain" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Microsoft HTML Application" }, "off_artifact_rel_label": { "type": "literal", "value": "interprets" }, "off_tech_label": { "type": "literal", "value": "Mshta Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Office Application File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "VBA Stomping" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Spearphishing Link" }, "off_tech_parent_label": { "type": "literal", "value": "Phishing" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Password Database" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "LSA Secrets" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemPasswordDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Elevated Execution with Prompt" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Windows Service" }, "off_tech_parent_label": { "type": "literal", "value": "Create or Modify System Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Password Database" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Security Account Manager" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemPasswordDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "Code Repository" }, "off_artifact_rel_label": { "type": "literal", "value": "reads" }, "off_tech_label": { "type": "literal", "value": "Code Repositories" }, "off_tech_parent_label": { "type": "literal", "value": "Data from Information Repositories" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CodeRepository" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "Password File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "System Owner/User Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Internal Spearphishing" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Credentials in Registry" }, "off_tech_parent_label": { "type": "literal", "value": "Unsecured Credentials" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Query Registry" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1012" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "queries" }, "off_tech_label": { "type": "literal", "value": "System Language Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "System Location Discovery" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#queries" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1614.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1614" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Elevated Execution with Prompt" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Windows Service" }, "off_tech_parent_label": { "type": "literal", "value": "Create or Modify System Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "Code Repository" }, "off_artifact_rel_label": { "type": "literal", "value": "reads" }, "off_tech_label": { "type": "literal", "value": "Code Repositories" }, "off_tech_parent_label": { "type": "literal", "value": "Data from Information Repositories" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CodeRepository" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Rogue Domain Controller" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1207" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "Password File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "/etc/passwd and /etc/shadow" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "In-memory Password Store" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Credentials from Web Browsers" }, "off_tech_parent_label": { "type": "literal", "value": "Credentials from Password Stores" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#In-memoryPasswordStore" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Data Inventory" }, "top_def_tech_label": { "type": "literal", "value": "Asset Inventory" }, "def_tactic_label": { "type": "literal", "value": "Model" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Data Inventory" }, "def_artifact_rel_label": { "type": "literal", "value": "inventories" }, "def_artifact_label": { "type": "literal", "value": "Database" }, "off_artifact_label": { "type": "literal", "value": "System Configuration Database" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "MMC" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Model" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#inventories" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Database" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemConfigurationDatabase" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Database Query String Analysis" }, "top_def_tech_label": { "type": "literal", "value": "Process Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Database Query String Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Database Query" }, "off_artifact_label": { "type": "literal", "value": "Database Query" }, "off_artifact_rel_label": { "type": "literal", "value": "injects" }, "off_tech_label": { "type": "literal", "value": "Exploit Public-Facing Application" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseQueryStringAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseQuery" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseQuery" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#injects" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1190" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Environment" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Environment" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Environment" }, "def_artifact_rel_label": { "type": "literal", "value": "manages" }, "def_artifact_label": { "type": "literal", "value": "Decoy Artifact" }, "off_artifact_label": { "type": "literal", "value": "Decoy Artifact" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "System Information Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyEnvironment" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#manages" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyArtifact" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyArtifact" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1082" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "PowerShell Profile Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "PowerShell Profile" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "COR_PROFILER" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Dylib Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "Rundll32 Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Emond" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Database File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Credentials from Web Browsers" }, "off_tech_parent_label": { "type": "literal", "value": "Credentials from Password Stores" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "Component Object Model Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Shortcut Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Custom Archive File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Archive via Custom Method" }, "off_tech_parent_label": { "type": "literal", "value": "Archive Collected Data" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "DLL Side-Loading" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Password File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "/etc/passwd and /etc/shadow" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Dynamic-link Library Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Spearphishing Attachment" }, "off_tech_parent_label": { "type": "literal", "value": "Phishing" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "XSL Script Processing" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Shortcut Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Office Application File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "VBA Stomping" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Pluggable Authentication Modules" }, "off_tech_parent_label": { "type": "literal", "value": "Modify Authentication Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Launch Daemon" }, "off_tech_parent_label": { "type": "literal", "value": "Create or Modify System Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Software Deployment Tools Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Mac)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "interprets" }, "off_tech_label": { "type": "literal", "value": "XSL Script Processing" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Archive File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Archive via Utility" }, "off_tech_parent_label": { "type": "literal", "value": "Archive Collected Data" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "Dynamic-link Library Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Emond" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LC_LOAD_DYLIB Addition" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "DLL Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Symbolic Link" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Shortcut Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Network Init Script File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Network Logon Script" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "COR_PROFILER" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-transfer" }, "off_tech_label": { "type": "literal", "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol" }, "off_tech_parent_label": { "type": "literal", "value": "Exfiltration Over Alternative Protocol" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Exfiltration" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Screensaver" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LD_PRELOAD" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "Dynamic-link Library Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Unquoted Path" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-transfer" }, "off_tech_label": { "type": "literal", "value": "Web Protocols" }, "off_tech_parent_label": { "type": "literal", "value": "Application Layer Protocol" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "Rundll32 Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Office Template Macros" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Plist Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Software Deployment Tools Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Deobfuscate/Decode Files or Information" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Init Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": ".bash_profile and .bashrc" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Microsoft HTML Application" }, "off_artifact_rel_label": { "type": "literal", "value": "interprets" }, "off_tech_label": { "type": "literal", "value": "Mshta Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "AppCert DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Binary Padding" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by PATH Environment Variable" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Launchd" }, "off_tech_parent_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Dylib Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Kernel Module" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Kernel Modules and Extensions" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "DLL Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Thread Execution Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Remote System Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Compiler Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "MSBuild" }, "off_tech_parent_label": { "type": "literal", "value": "Trusted Developer Utilities Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Password Filter DLL" }, "off_tech_parent_label": { "type": "literal", "value": "Modify Authentication Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Data from Local System" }, "off_tech_parent_label": { "type": "literal", "value": "Collection Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Unquoted Path" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "VDSO Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Object File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Portable Executable Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Launch Agent" }, "off_tech_parent_label": { "type": "literal", "value": "Create or Modify System Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Proc Filesystem" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Office Application File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Outlook Forms" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Dylib Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "LSASS Driver" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Match Legitimate Name or Location" }, "off_tech_parent_label": { "type": "literal", "value": "Masquerading" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Dynamic-link Library Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Systemd Service" }, "off_tech_parent_label": { "type": "literal", "value": "Create or Modify System Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-transfer" }, "off_tech_label": { "type": "literal", "value": "Asymmetric Cryptography" }, "off_tech_parent_label": { "type": "literal", "value": "Encrypted Channel" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Spearphishing Link" }, "off_tech_parent_label": { "type": "literal", "value": "Phishing" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Registry Run Keys / Startup Folder" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Mac)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LD_PRELOAD" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Command History Log File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Bash History" }, "off_tech_parent_label": { "type": "literal", "value": "Unsecured Credentials" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Space after Filename" }, "off_tech_parent_label": { "type": "literal", "value": "Masquerading" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Runtime Data Manipulation" }, "off_tech_parent_label": { "type": "literal", "value": "Data Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Re-opened Applications" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "DLL Side-Loading" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Log File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Clear Linux or Mac System Logs" }, "off_tech_parent_label": { "type": "literal", "value": "Indicator Removal on Host" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Thread Execution Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Windows Shortcut File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Forced Authentication" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "off_tech_label": { "type": "literal", "value": "Software Packing" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Internal Spearphishing" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Launch Daemon" }, "off_tech_parent_label": { "type": "literal", "value": "Create or Modify System Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Proc Memory" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "Component Object Model Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Archive File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Archive via Library" }, "off_tech_parent_label": { "type": "literal", "value": "Archive Collected Data" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Windows)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Object File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Portable Executable Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "File Deletion" }, "off_tech_parent_label": { "type": "literal", "value": "Indicator Removal on Host" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "DLL Side-Loading" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-execute" }, "off_tech_label": { "type": "literal", "value": "System Network Configuration Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by PATH Environment Variable" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Hidden Window" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Automated Collection" }, "off_tech_parent_label": { "type": "literal", "value": "Collection Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "System Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Rc.common" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LC_LOAD_DYLIB Addition" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Unquoted Path" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Container Image" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Implant Container Image" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1525" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Systemd Service" }, "off_tech_parent_label": { "type": "literal", "value": "Create or Modify System Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Password File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "System Owner/User Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Malicious File Execution" }, "off_tech_parent_label": { "type": "literal", "value": "User Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Kernel Module" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Rootkit" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Re-opened Applications" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Symbolic Link" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Shortcut Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "deletes" }, "off_tech_label": { "type": "literal", "value": "File Deletion" }, "off_tech_parent_label": { "type": "literal", "value": "Indicator Removal on Host" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "VDSO Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Impair Command History Logging" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-transfer" }, "off_tech_label": { "type": "literal", "value": "Exfiltration Over C2 Channel" }, "off_tech_parent_label": { "type": "literal", "value": "Exfiltration Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Exfiltration" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Plist Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "DLL Side-Loading" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Init Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Hidden Users" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Pluggable Authentication Modules" }, "off_tech_parent_label": { "type": "literal", "value": "Modify Authentication Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "File and Directory Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Screensaver" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Credentials in Files" }, "off_tech_parent_label": { "type": "literal", "value": "Unsecured Credentials" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "DLL Side-Loading" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Emond" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by PATH Environment Variable" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Spearphishing Via Service" }, "off_tech_parent_label": { "type": "literal", "value": "Phishing" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "AppInit DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Invalid Code Signature" }, "off_tech_parent_label": { "type": "literal", "value": "Masquerading" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Proc Memory" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "COR_PROFILER" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Database File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Credentials from Password Stores" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Kernel Module" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Kernel Modules and Extensions" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LD_PRELOAD" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Archive File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Archive Collected Data" }, "off_tech_parent_label": { "type": "literal", "value": "Collection Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "DLL Side-Loading" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Local Data Staging" }, "off_tech_parent_label": { "type": "literal", "value": "Data Staged" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Rename System Utilities" }, "off_tech_parent_label": { "type": "literal", "value": "Masquerading" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "DLL Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Emond" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Proc Memory" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Sudo and Sudo Caching" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Web Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Shell" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Network Init Script File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Network Logon Script" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Windows)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Password Filter DLL" }, "off_tech_parent_label": { "type": "literal", "value": "Modify Authentication Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Launch Agent" }, "off_tech_parent_label": { "type": "literal", "value": "Create or Modify System Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "AppCert DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Systemd Service" }, "off_tech_parent_label": { "type": "literal", "value": "Create or Modify System Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Pluggable Authentication Modules" }, "off_tech_parent_label": { "type": "literal", "value": "Modify Authentication Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Dylib Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "AppInit DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Init Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": ".bash_profile and .bashrc" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-transfer" }, "off_tech_label": { "type": "literal", "value": "Application Layer Protocol" }, "off_tech_parent_label": { "type": "literal", "value": "Command and Control Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Registry Run Keys / Startup Folder" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Compile After Delivery" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Rename System Utilities" }, "off_tech_parent_label": { "type": "literal", "value": "Masquerading" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Sudo and Sudo Caching" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Launchd" }, "off_tech_parent_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Stored Data Manipulation" }, "off_tech_parent_label": { "type": "literal", "value": "Data Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Office Template Macros" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Systemd Service" }, "off_tech_parent_label": { "type": "literal", "value": "Create or Modify System Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Dylib Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "LSASS Driver" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "reads" }, "off_tech_label": { "type": "literal", "value": "Local Email Collection" }, "off_tech_parent_label": { "type": "literal", "value": "Email Collection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Launchd" }, "off_tech_parent_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Dylib Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "PowerShell Profile Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "PowerShell Profile" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "System Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Rc.common" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Pluggable Authentication Modules" }, "off_tech_parent_label": { "type": "literal", "value": "Modify Authentication Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Microsoft HTML Application" }, "off_artifact_rel_label": { "type": "literal", "value": "interprets" }, "off_tech_label": { "type": "literal", "value": "Mshta Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Proc Memory" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Command and Scripting Interpreter Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Run Virtual Instance" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy File" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Rootkit" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "External Defacement" }, "off_tech_parent_label": { "type": "literal", "value": "Defacement" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1491.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1491" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_label": { "type": "literal", "value": "Web File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Sharepoint" }, "off_tech_parent_label": { "type": "literal", "value": "Data from Information Repositories" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_label": { "type": "literal", "value": "Web File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Sharepoint" }, "off_tech_parent_label": { "type": "literal", "value": "Data from Information Repositories" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Taint Shared Content" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1080" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_label": { "type": "literal", "value": "Web File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Confluence" }, "off_tech_parent_label": { "type": "literal", "value": "Data from Information Repositories" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_label": { "type": "literal", "value": "Network Init Script File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Network Logon Script" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Remote Data Staging" }, "off_tech_parent_label": { "type": "literal", "value": "Data Staged" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_label": { "type": "literal", "value": "Network File Share Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "unmounts" }, "off_tech_label": { "type": "literal", "value": "Network Share Connection Removal" }, "off_tech_parent_label": { "type": "literal", "value": "Indicator Removal on Host" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkFileShareResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#unmounts" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_label": { "type": "literal", "value": "Web File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Confluence" }, "off_tech_parent_label": { "type": "literal", "value": "Data from Information Repositories" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_label": { "type": "literal", "value": "Network Init Script File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Network Logon Script" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_label": { "type": "literal", "value": "Network File Share Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Data from Network Shared Drive" }, "off_tech_parent_label": { "type": "literal", "value": "Collection Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkFileShareResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1039" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Emond" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-transfer" }, "off_tech_label": { "type": "literal", "value": "Application Layer Protocol" }, "off_tech_parent_label": { "type": "literal", "value": "Command and Control Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-transfer" }, "off_tech_label": { "type": "literal", "value": "Web Protocols" }, "off_tech_parent_label": { "type": "literal", "value": "Application Layer Protocol" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1071" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "File and Directory Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1083" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Emond" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "DLL Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Password Filter DLL" }, "off_tech_parent_label": { "type": "literal", "value": "Modify Authentication Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Software Deployment Tools Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "COR_PROFILER" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "AppInit DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-transfer" }, "off_tech_label": { "type": "literal", "value": "Exfiltration Over C2 Channel" }, "off_tech_parent_label": { "type": "literal", "value": "Exfiltration Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Exfiltration" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1041" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Pluggable Authentication Modules" }, "off_tech_parent_label": { "type": "literal", "value": "Modify Authentication Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-execute" }, "off_tech_label": { "type": "literal", "value": "System Network Configuration Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Taint Shared Content" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1080" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Pluggable Authentication Modules" }, "off_tech_parent_label": { "type": "literal", "value": "Modify Authentication Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "AppCert DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Software Deployment Tools Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1072" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Unquoted Path" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "off_tech_label": { "type": "literal", "value": "Software Packing" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_label": { "type": "literal", "value": "Web File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Sharepoint" }, "off_tech_parent_label": { "type": "literal", "value": "Data from Information Repositories" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_label": { "type": "literal", "value": "Web File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Confluence" }, "off_tech_parent_label": { "type": "literal", "value": "Data from Information Repositories" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Malicious File Execution" }, "off_tech_parent_label": { "type": "literal", "value": "User Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "DLL Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Compile After Delivery" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Keychain" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LD_PRELOAD" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Binary Padding" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Log File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Clear Linux or Mac System Logs" }, "off_tech_parent_label": { "type": "literal", "value": "Indicator Removal on Host" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemLogFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Windows Shortcut File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Forced Authentication" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WindowsShortcutFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1187" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Internal Spearphishing" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "Component Object Model Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by PATH Environment Variable" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "File Deletion" }, "off_tech_parent_label": { "type": "literal", "value": "Indicator Removal on Host" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LC_LOAD_DYLIB Addition" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "deletes" }, "off_tech_label": { "type": "literal", "value": "File Deletion" }, "off_tech_parent_label": { "type": "literal", "value": "Indicator Removal on Host" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_label": { "type": "literal", "value": "Network File Share Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "unmounts" }, "off_tech_label": { "type": "literal", "value": "Network Share Connection Removal" }, "off_tech_parent_label": { "type": "literal", "value": "Indicator Removal on Host" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkFileShareResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#unmounts" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1070" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LD_PRELOAD" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Rename System Utilities" }, "off_tech_parent_label": { "type": "literal", "value": "Masquerading" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by PATH Environment Variable" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Rename System Utilities" }, "off_tech_parent_label": { "type": "literal", "value": "Masquerading" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Launchd" }, "off_tech_parent_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Dylib Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Office Template Macros" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Match Legitimate Name or Location" }, "off_tech_parent_label": { "type": "literal", "value": "Masquerading" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Dylib Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Sudo and Sudo Caching" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Space after Filename" }, "off_tech_parent_label": { "type": "literal", "value": "Masquerading" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Office Template Macros" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "DLL Side-Loading" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Kernel Module" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Rootkit" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Database File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Credentials from Password Stores" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Invalid Code Signature" }, "off_tech_parent_label": { "type": "literal", "value": "Masquerading" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Screensaver" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Password File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "System Owner/User Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Unsecured Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "DLL Side-Loading" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Hidden Window" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-transfer" }, "off_tech_label": { "type": "literal", "value": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol" }, "off_tech_parent_label": { "type": "literal", "value": "Exfiltration Over Alternative Protocol" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Exfiltration" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1048" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Office Application File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Outlook Forms" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Dynamic-link Library Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "COR_PROFILER" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "Dynamic-link Library Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "VDSO Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Run Virtual Instance" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "External Defacement" }, "off_tech_parent_label": { "type": "literal", "value": "Defacement" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1491.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1491" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Office Application File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "VBA Stomping" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Cracking" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Runtime Data Manipulation" }, "off_tech_parent_label": { "type": "literal", "value": "Data Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Proc Memory" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Proc Memory" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Init Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Hidden Users" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Object File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Portable Executable Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Stored Data Manipulation" }, "off_tech_parent_label": { "type": "literal", "value": "Data Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Init Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": ".bash_profile and .bashrc" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Thread Execution Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Spraying" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Thread Execution Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Command and Scripting Interpreter Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_label": { "type": "literal", "value": "Network File Share Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Data from Network Shared Drive" }, "off_tech_parent_label": { "type": "literal", "value": "Collection Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkFileShareResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1039" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Object File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Portable Executable Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ObjectFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Automated Collection" }, "off_tech_parent_label": { "type": "literal", "value": "Collection Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1119" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Guessing" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Registry Run Keys / Startup Folder" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Proc Memory" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Remote System Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Proc Memory" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket Granting Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "forges" }, "off_tech_label": { "type": "literal", "value": "Golden Ticket" }, "off_tech_parent_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket Granting Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "forges" }, "off_tech_label": { "type": "literal", "value": "Golden Ticket" }, "off_tech_parent_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Plist Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Archive File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Archive Collected Data" }, "off_tech_parent_label": { "type": "literal", "value": "Collection Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Data from Local System" }, "off_tech_parent_label": { "type": "literal", "value": "Collection Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Shortcut Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Compiler Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "MSBuild" }, "off_tech_parent_label": { "type": "literal", "value": "Trusted Developer Utilities Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CompilerConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1127" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "VDSO Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Kernel Module" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Kernel Modules and Extensions" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Deobfuscate/Decode Files or Information" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Remote Data Staging" }, "off_tech_parent_label": { "type": "literal", "value": "Data Staged" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Database File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Credentials from Web Browsers" }, "off_tech_parent_label": { "type": "literal", "value": "Credentials from Password Stores" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DatabaseFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "Dynamic-link Library Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Symbolic Link" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Shortcut Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Local Data Staging" }, "off_tech_parent_label": { "type": "literal", "value": "Data Staged" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Re-opened Applications" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Password Filter DLL" }, "off_tech_parent_label": { "type": "literal", "value": "Modify Authentication Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Pluggable Authentication Modules" }, "off_tech_parent_label": { "type": "literal", "value": "Modify Authentication Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "LSASS Driver" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Dynamic-link Library Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Web Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Shell" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Pluggable Authentication Modules" }, "off_tech_parent_label": { "type": "literal", "value": "Modify Authentication Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemSharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "reads" }, "off_tech_label": { "type": "literal", "value": "Local Email Collection" }, "off_tech_parent_label": { "type": "literal", "value": "Email Collection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "DLL Side-Loading" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "LSASS Driver" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_label": { "type": "literal", "value": "Web File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Sharepoint" }, "off_tech_parent_label": { "type": "literal", "value": "Data from Information Repositories" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Unquoted Path" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_label": { "type": "literal", "value": "Web File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Confluence" }, "off_tech_parent_label": { "type": "literal", "value": "Data from Information Repositories" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1213" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Credentials in Files" }, "off_tech_parent_label": { "type": "literal", "value": "Unsecured Credentials" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "DLL Side-Loading" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Re-opened Applications" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Archive File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Archive via Library" }, "off_tech_parent_label": { "type": "literal", "value": "Archive Collected Data" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Command History Log File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Bash History" }, "off_tech_parent_label": { "type": "literal", "value": "Unsecured Credentials" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandHistoryLogFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "NTDS" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Dylib Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Symbolic Link" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Shortcut Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SymbolicLink" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Kernel Module" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Kernel Modules and Extensions" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KernelModule" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Dylib Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Cached Domain Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Custom Archive File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Archive via Custom Method" }, "off_tech_parent_label": { "type": "literal", "value": "Archive Collected Data" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CustomArchiveFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Shortcut Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Archive File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Archive via Utility" }, "off_tech_parent_label": { "type": "literal", "value": "Archive Collected Data" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ArchiveFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1560" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "Rundll32 Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LD_PRELOAD" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Application Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Plist Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ApplicationConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Microsoft HTML Application" }, "off_artifact_rel_label": { "type": "literal", "value": "interprets" }, "off_tech_label": { "type": "literal", "value": "Mshta Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Rootkit" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by PATH Environment Variable" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Proc Filesystem" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "XSL Script Processing" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "/etc/passwd and /etc/shadow" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Unquoted Path" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Init Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": ".bash_profile and .bashrc" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Registry Run Keys / Startup Folder" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "interprets" }, "off_tech_label": { "type": "literal", "value": "XSL Script Processing" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Additional Azure Service Principal Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Launch Agent" }, "off_tech_parent_label": { "type": "literal", "value": "Create or Modify System Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Screensaver" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "COR_PROFILER" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.012" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Password File" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "/etc/passwd and /etc/shadow" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PasswordFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "DLL Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Mac)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "Component Object Model Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Windows)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Launch Daemon" }, "off_tech_parent_label": { "type": "literal", "value": "Create or Modify System Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Emond" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Sudo and Sudo Caching" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Launchd" }, "off_tech_parent_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Emond" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_label": { "type": "literal", "value": "Network Init Script File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Network Logon Script" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Dylib Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "System Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Rc.common" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "PowerShell Profile Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "PowerShell Profile" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Microsoft HTML Application" }, "off_artifact_rel_label": { "type": "literal", "value": "interprets" }, "off_tech_label": { "type": "literal", "value": "Mshta Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Spearphishing Attachment" }, "off_tech_parent_label": { "type": "literal", "value": "Phishing" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "Rundll32 Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Network Init Script File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Network Logon Script" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Systemd Service" }, "off_tech_parent_label": { "type": "literal", "value": "Create or Modify System Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Dylib Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Network Init Script File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Network Logon Script" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "AppInit DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Network Resource" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Network Resource" }, "off_artifact_label": { "type": "literal", "value": "Network Init Script File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Network Logon Script" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyNetworkResource" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkResource" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Spearphishing Via Service" }, "off_tech_parent_label": { "type": "literal", "value": "Phishing" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "DLL Side-Loading" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "System Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Rc.common" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Launch Agent" }, "off_tech_parent_label": { "type": "literal", "value": "Create or Modify System Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "AppCert DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Systemd Service" }, "off_tech_parent_label": { "type": "literal", "value": "Create or Modify System Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Shared Library File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "DLL Side-Loading" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SharedLibraryFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Windows)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Impair Command History Logging" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Launch Daemon" }, "off_tech_parent_label": { "type": "literal", "value": "Create or Modify System Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Spearphishing Link" }, "off_tech_parent_label": { "type": "literal", "value": "Phishing" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Mac)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Systemd Service" }, "off_tech_parent_label": { "type": "literal", "value": "Create or Modify System Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LC_LOAD_DYLIB Addition" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Operating System Configuration File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Systemd Service" }, "off_tech_parent_label": { "type": "literal", "value": "Create or Modify System Process" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemConfigurationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1543" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Property List File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Launchd" }, "off_tech_parent_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Container Image" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Implant Container Image" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ContainerImage" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1525" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "PowerShell Profile Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "PowerShell Profile" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy File" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "File" }, "off_artifact_label": { "type": "literal", "value": "Certificate File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-transfer" }, "off_tech_label": { "type": "literal", "value": "Asymmetric Cryptography" }, "off_tech_parent_label": { "type": "literal", "value": "Encrypted Channel" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#File" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CertificateFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-transfer" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1573" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket Granting Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "forges" }, "off_tech_label": { "type": "literal", "value": "Golden Ticket" }, "off_tech_parent_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy Session Token" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoySessionToken" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Unsecured Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1552" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1539" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Make and Impersonate Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket Granting Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "forges" }, "off_tech_label": { "type": "literal", "value": "Golden Ticket" }, "off_tech_parent_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicketGrantingTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#forges" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "NTDS" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "/etc/passwd and /etc/shadow" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Steal Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1528" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Spraying" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Cached Domain Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Token Impersonation/Theft" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Guessing" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Additional Azure Service Principal Credentials" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Session Cookie" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Session Cookie" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SessionCookie" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Application Access Token" }, "off_tech_parent_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Access Token" }, "off_artifact_rel_label": { "type": "literal", "value": "copies" }, "off_tech_label": { "type": "literal", "value": "Create Process with Token" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AccessToken" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#copies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Kerberos Ticket" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Steal or Forge Kerberos Tickets" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KerberosTicket" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1558" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Encrypted Credential" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Keychain" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EncryptedCredential" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1142" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "top_def_tech_label": { "type": "literal", "value": "Decoy Object" }, "def_tactic_label": { "type": "literal", "value": "Deceive" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Decoy User Credential" }, "def_artifact_rel_label": { "type": "literal", "value": "spoofs" }, "def_artifact_label": { "type": "literal", "value": "Credential" }, "off_artifact_label": { "type": "literal", "value": "Password" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Password Cracking" }, "off_tech_parent_label": { "type": "literal", "value": "Brute Force" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyUserCredential" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Credential" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Password" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1110" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Disk Encryption" }, "top_def_tech_label": { "type": "literal", "value": "Platform Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Disk Encryption" }, "def_artifact_rel_label": { "type": "literal", "value": "encrypts" }, "def_artifact_label": { "type": "literal", "value": "Storage" }, "off_artifact_label": { "type": "literal", "value": "Cloud Storage" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Cloud Storage Object Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiskEncryption" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Storage" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1619" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Disk Encryption" }, "top_def_tech_label": { "type": "literal", "value": "Platform Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Disk Encryption" }, "def_artifact_rel_label": { "type": "literal", "value": "encrypts" }, "def_artifact_label": { "type": "literal", "value": "Storage" }, "off_artifact_label": { "type": "literal", "value": "Storage" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Hidden File System" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiskEncryption" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Storage" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Storage" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Domain Account Monitoring" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Domain Account Monitoring" }, "def_artifact_rel_label": { "type": "literal", "value": "monitors" }, "def_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Domain Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Domain Account Monitoring" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Domain Account Monitoring" }, "def_artifact_rel_label": { "type": "literal", "value": "monitors" }, "def_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Domain Account Monitoring" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Domain Account Monitoring" }, "def_artifact_rel_label": { "type": "literal", "value": "monitors" }, "def_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Exchange Email Delegate Permissions" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Domain Account Monitoring" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Domain Account Monitoring" }, "def_artifact_rel_label": { "type": "literal", "value": "monitors" }, "def_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Domain Account Monitoring" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Domain Account Monitoring" }, "def_artifact_rel_label": { "type": "literal", "value": "monitors" }, "def_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Domain Account Monitoring" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Domain Account Monitoring" }, "def_artifact_rel_label": { "type": "literal", "value": "monitors" }, "def_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "uses" }, "off_tech_label": { "type": "literal", "value": "Domain Accounts" }, "off_tech_parent_label": { "type": "literal", "value": "Valid Accounts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#uses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1078" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Domain Account Monitoring" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Domain Account Monitoring" }, "def_artifact_rel_label": { "type": "literal", "value": "monitors" }, "def_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Domain Account" }, "off_tech_parent_label": { "type": "literal", "value": "Create Account" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1087.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1136" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Domain Account Monitoring" }, "top_def_tech_label": { "type": "literal", "value": "User Behavior Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Domain Account Monitoring" }, "def_artifact_rel_label": { "type": "literal", "value": "monitors" }, "def_artifact_label": { "type": "literal", "value": "Domain User Account" }, "off_artifact_label": { "type": "literal", "value": "Global User Account" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Add Office 365 Global Administrator Role" }, "off_tech_parent_label": { "type": "literal", "value": "Account Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainAccountMonitoring" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainUserAccount" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GlobalUserAccount" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1098" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Domain Trust Policy" }, "top_def_tech_label": { "type": "literal", "value": "Credential Hardening" }, "def_tactic_label": { "type": "literal", "value": "Harden" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Domain Trust Policy" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Directory Service" }, "off_artifact_label": { "type": "literal", "value": "Directory Service" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "System Owner/User Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Harden" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DomainTrustPolicy" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DirectoryService" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "interprets" }, "off_tech_label": { "type": "literal", "value": "XSL Script Processing" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Network Init Script File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Network Logon Script" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Mac)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Office Template Macros" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "System Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Rc.common" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Thread Execution Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Registry Run Keys / Startup Folder" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Office Template Macros" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Mac)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "PowerShell Profile Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "PowerShell Profile" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Rename System Utilities" }, "off_tech_parent_label": { "type": "literal", "value": "Masquerading" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by PATH Environment Variable" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Deobfuscate/Decode Files or Information" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Windows)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Internal Spearphishing" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Impair Command History Logging" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "Component Object Model Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LC_LOAD_DYLIB Addition" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by PATH Environment Variable" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Unquoted Path" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "Component Object Model Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Shortcut Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Thread Execution Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Windows)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-execute" }, "off_tech_label": { "type": "literal", "value": "System Network Configuration Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Unquoted Path" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Runtime Data Manipulation" }, "off_tech_parent_label": { "type": "literal", "value": "Data Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Command and Scripting Interpreter Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by PATH Environment Variable" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Screensaver" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "off_tech_label": { "type": "literal", "value": "Software Packing" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Compile After Delivery" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Office Application File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "VBA Stomping" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Microsoft HTML Application" }, "off_artifact_rel_label": { "type": "literal", "value": "interprets" }, "off_tech_label": { "type": "literal", "value": "Mshta Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Microsoft HTML Application" }, "off_artifact_rel_label": { "type": "literal", "value": "interprets" }, "off_tech_label": { "type": "literal", "value": "Mshta Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Spearphishing Link" }, "off_tech_parent_label": { "type": "literal", "value": "Phishing" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "reads" }, "off_tech_label": { "type": "literal", "value": "Local Email Collection" }, "off_tech_parent_label": { "type": "literal", "value": "Email Collection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "PowerShell Profile Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "PowerShell Profile" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Registry Run Keys / Startup Folder" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "System Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Rc.common" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LC_LOAD_DYLIB Addition" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Web Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Shell" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Binary Padding" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Shortcut Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Malicious File Execution" }, "off_tech_parent_label": { "type": "literal", "value": "User Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Network Init Script File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Network Logon Script" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Unquoted Path" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Office Application File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Outlook Forms" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Spearphishing Attachment" }, "off_tech_parent_label": { "type": "literal", "value": "Phishing" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Invalid Code Signature" }, "off_tech_parent_label": { "type": "literal", "value": "Masquerading" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Dynamic Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Screensaver" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Email Filtering" }, "top_def_tech_label": { "type": "literal", "value": "Network Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Email Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "reads" }, "off_tech_label": { "type": "literal", "value": "Local Email Collection" }, "off_tech_parent_label": { "type": "literal", "value": "Email Collection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Email Filtering" }, "top_def_tech_label": { "type": "literal", "value": "Network Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Email Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Internal Spearphishing" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Email Filtering" }, "top_def_tech_label": { "type": "literal", "value": "Network Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Email Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Spearphishing Attachment" }, "off_tech_parent_label": { "type": "literal", "value": "Phishing" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Email Filtering" }, "top_def_tech_label": { "type": "literal", "value": "Network Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Email Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Spearphishing Link" }, "off_tech_parent_label": { "type": "literal", "value": "Phishing" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Email Removal" }, "top_def_tech_label": { "type": "literal", "value": "File Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Email Removal" }, "def_artifact_rel_label": { "type": "literal", "value": "may-access" }, "def_artifact_label": { "type": "literal", "value": "Mail Server" }, "off_artifact_label": { "type": "literal", "value": "Mail Server" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Remote Email Collection" }, "off_tech_parent_label": { "type": "literal", "value": "Email Collection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRemoval" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Email Removal" }, "top_def_tech_label": { "type": "literal", "value": "File Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Email Removal" }, "def_artifact_rel_label": { "type": "literal", "value": "may-access" }, "def_artifact_label": { "type": "literal", "value": "Mail Server" }, "off_artifact_label": { "type": "literal", "value": "Mail Server" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Transport Agent" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRemoval" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Email Removal" }, "top_def_tech_label": { "type": "literal", "value": "File Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Email Removal" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Internal Spearphishing" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRemoval" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Email Removal" }, "top_def_tech_label": { "type": "literal", "value": "File Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Email Removal" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "reads" }, "off_tech_label": { "type": "literal", "value": "Local Email Collection" }, "off_tech_parent_label": { "type": "literal", "value": "Email Collection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRemoval" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Email Removal" }, "top_def_tech_label": { "type": "literal", "value": "File Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Email Removal" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Spearphishing Link" }, "off_tech_parent_label": { "type": "literal", "value": "Phishing" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRemoval" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Email Removal" }, "top_def_tech_label": { "type": "literal", "value": "File Eviction" }, "def_tactic_label": { "type": "literal", "value": "Evict" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Email Removal" }, "def_artifact_rel_label": { "type": "literal", "value": "deletes" }, "def_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Spearphishing Attachment" }, "off_tech_parent_label": { "type": "literal", "value": "Phishing" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Evict" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRemoval" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#deletes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Microsoft HTML Application" }, "off_artifact_rel_label": { "type": "literal", "value": "interprets" }, "off_tech_label": { "type": "literal", "value": "Mshta Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Screensaver" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Office Application File" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "VBA Stomping" }, "off_tech_parent_label": { "type": "literal", "value": "Hide Artifacts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1564" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Unquoted Path" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by PATH Environment Variable" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "System Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Rc.common" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Spearphishing Link" }, "off_tech_parent_label": { "type": "literal", "value": "Phishing" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Office Template Macros" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Command and Scripting Interpreter Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Registry Run Keys / Startup Folder" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LC_LOAD_DYLIB Addition" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Network Init Script File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Network Logon Script" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Network Init Script File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Network Logon Script" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Spearphishing Attachment" }, "off_tech_parent_label": { "type": "literal", "value": "Phishing" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1566" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "System Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Rc.common" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "PowerShell Profile Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "PowerShell Profile" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Binary Padding" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Rename System Utilities" }, "off_tech_parent_label": { "type": "literal", "value": "Masquerading" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Mac)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Microsoft HTML Application" }, "off_artifact_rel_label": { "type": "literal", "value": "interprets" }, "off_tech_label": { "type": "literal", "value": "Mshta Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MicrosoftHTMLApplication" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Shortcut Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "Component Object Model Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Shortcut Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Unquoted Path" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Registry Run Keys / Startup Folder" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by PATH Environment Variable" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Web Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Shell" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Thread Execution Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LC_LOAD_DYLIB Addition" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Invalid Code Signature" }, "off_tech_parent_label": { "type": "literal", "value": "Masquerading" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Windows)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Unquoted Path" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Thread Execution Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Office Application File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Outlook Forms" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OfficeApplicationFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Runtime Data Manipulation" }, "off_tech_parent_label": { "type": "literal", "value": "Data Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by PATH Environment Variable" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Internal Spearphishing" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1534" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "interprets" }, "off_tech_label": { "type": "literal", "value": "XSL Script Processing" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Screensaver" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "off_tech_label": { "type": "literal", "value": "Software Packing" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Mac)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Windows)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Document File" }, "off_artifact_label": { "type": "literal", "value": "Email" }, "off_artifact_rel_label": { "type": "literal", "value": "reads" }, "off_tech_label": { "type": "literal", "value": "Local Email Collection" }, "off_tech_parent_label": { "type": "literal", "value": "Email Collection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Email" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#reads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Compile After Delivery" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "PowerShell Profile Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "PowerShell Profile" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-execute" }, "off_tech_label": { "type": "literal", "value": "System Network Configuration Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Malicious File Execution" }, "off_tech_parent_label": { "type": "literal", "value": "User Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Office Template Macros" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Impair Command History Logging" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Deobfuscate/Decode Files or Information" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "top_def_tech_label": { "type": "literal", "value": "File Analysis" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Emulated File Analysis" }, "def_artifact_rel_label": { "type": "literal", "value": "analyzes" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "Component Object Model Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Endpoint Health Beacon" }, "top_def_tech_label": { "type": "literal", "value": "Platform Monitoring" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Endpoint Health Beacon" }, "def_artifact_rel_label": { "type": "literal", "value": "monitors" }, "def_artifact_label": { "type": "literal", "value": "Network Node" }, "off_artifact_label": { "type": "literal", "value": "Mail Server" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Remote Email Collection" }, "off_tech_parent_label": { "type": "literal", "value": "Email Collection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1114" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Endpoint Health Beacon" }, "top_def_tech_label": { "type": "literal", "value": "Platform Monitoring" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Endpoint Health Beacon" }, "def_artifact_rel_label": { "type": "literal", "value": "monitors" }, "def_artifact_label": { "type": "literal", "value": "Network Node" }, "off_artifact_label": { "type": "literal", "value": "Mail Server" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Transport Agent" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MailServer" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Endpoint Health Beacon" }, "top_def_tech_label": { "type": "literal", "value": "Platform Monitoring" }, "def_tactic_label": { "type": "literal", "value": "Detect" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Endpoint Health Beacon" }, "def_artifact_rel_label": { "type": "literal", "value": "monitors" }, "def_artifact_label": { "type": "literal", "value": "Network Node" }, "off_artifact_label": { "type": "literal", "value": "Web Server" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Web Shell" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Detect" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#EndpointHealthBeacon" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#monitors" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkNode" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebServer" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Application Window Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Shortcut Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "off_tech_label": { "type": "literal", "value": "Software Packing" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Remote System Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Process Doppelgänging" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Service Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Registry Run Keys / Startup Folder" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Thread Execution Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Screensaver" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppCert DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "interprets" }, "off_tech_label": { "type": "literal", "value": "XSL Script Processing" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Mac)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Control Panel Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Asynchronous Procedure Call" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "Component Object Model Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "Component Object Model Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Asynchronous Procedure Call" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "CMSTP" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Thread Execution Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Windows)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Owner/User Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Mshta Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-execute" }, "off_tech_label": { "type": "literal", "value": "System Network Configuration Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppInit DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Network Init Script File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Network Logon Script" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Unquoted Path" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Runtime Data Manipulation" }, "off_tech_parent_label": { "type": "literal", "value": "Data Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Process Doppelgänging" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Parent PID Spoofing" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Windows Management Instrumentation Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "System Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Rc.common" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Network Configuration Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Malicious File Execution" }, "off_tech_parent_label": { "type": "literal", "value": "User Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "PowerShell Profile Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "PowerShell Profile" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Command and Scripting Interpreter Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Rundll32 Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "System Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Rc.common" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "XSL Script Processing" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Control Panel Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppInit DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Invalid Code Signature" }, "off_tech_parent_label": { "type": "literal", "value": "Masquerading" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Office Template Macros" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Network Init Script File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Network Logon Script" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "CMSTP" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Office Template Macros" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Compiled HTML File" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Parent PID Spoofing" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppCert DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Mshta Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Screensaver" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Process Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1057" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Rename System Utilities" }, "off_tech_parent_label": { "type": "literal", "value": "Masquerading" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Windows)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Impair Command History Logging" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by PATH Environment Variable" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LC_LOAD_DYLIB Addition" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Time Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1124" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Deobfuscate/Decode Files or Information" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by PATH Environment Variable" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Mac)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Information Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1082" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "PowerShell Profile Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "PowerShell Profile" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LC_LOAD_DYLIB Addition" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Binary Padding" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Unquoted Path" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by PATH Environment Variable" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Registry Run Keys / Startup Folder" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Compiled HTML File" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Rundll32 Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Compile After Delivery" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Shortcut Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Unquoted Path" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Web Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Shell" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Deobfuscate/Decode Files or Information" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "SQL Stored Procedures" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Office Template Macros" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "System Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Rc.common" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Network Init Script File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Network Logon Script" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Invalid Code Signature" }, "off_tech_parent_label": { "type": "literal", "value": "Masquerading" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Control Panel Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppInit DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Rundll32 Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Parent PID Spoofing" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Malicious File Execution" }, "off_tech_parent_label": { "type": "literal", "value": "User Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1204" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "PowerShell Profile Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "PowerShell Profile" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Network Configuration Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "System Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Rc.common" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Network Init Script File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Network Logon Script" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Thread Execution Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LC_LOAD_DYLIB Addition" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Binary Padding" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Screensaver" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppInit DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Process Doppelgänging" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Registry Run Keys / Startup Folder" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "PowerShell Profile Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "PowerShell Profile" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Unquoted Path" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Unquoted Path" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Deobfuscate/Decode Files or Information" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Mshta Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "XSL Script Processing" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by PATH Environment Variable" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Runtime Data Manipulation" }, "off_tech_parent_label": { "type": "literal", "value": "Data Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Compile After Delivery" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "SQL Stored Procedures" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Service Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-execute" }, "off_tech_label": { "type": "literal", "value": "System Network Configuration Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Registry Run Keys / Startup Folder" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Windows Management Instrumentation Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Owner/User Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1033" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "CMSTP" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Remote System Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1018" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Asynchronous Procedure Call" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Process Doppelgänging" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Windows)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Information Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1082" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Thread Execution Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Application Window Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "Component Object Model Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Time Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1124" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "Component Object Model Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Shortcut Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppCert DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Control Panel Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Deobfuscate/Decode Files or Information" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Mac)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Shortcut Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Command and Scripting Interpreter Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Rundll32 Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "off_tech_label": { "type": "literal", "value": "Software Packing" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Process Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1057" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by PATH Environment Variable" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Unquoted Path" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Compiled HTML File" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "interprets" }, "off_tech_label": { "type": "literal", "value": "XSL Script Processing" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LC_LOAD_DYLIB Addition" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Impair Command History Logging" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by PATH Environment Variable" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Asynchronous Procedure Call" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Windows)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Mac)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Parent PID Spoofing" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Rename System Utilities" }, "off_tech_parent_label": { "type": "literal", "value": "Masquerading" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Screensaver" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "CMSTP" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Compiled HTML File" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Office Template Macros" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppCert DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Mshta Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Web Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Shell" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Unquoted Path" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Command and Scripting Interpreter Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Deobfuscate/Decode Files or Information" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Command and Scripting Interpreter Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1059" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Scheduled Job" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Scheduled Job" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Native API Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1106" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Windows Management Instrumentation Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Windows Management Instrumentation Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Windows Management Instrumentation Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Windows Management Instrumentation Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Windows Management Instrumentation Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Execution Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Execution" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1047" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Deobfuscate/Decode Files or Information" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Deobfuscate/Decode Files or Information" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Deobfuscate/Decode Files or Information" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Deobfuscate/Decode Files or Information" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "XSL Script Processing" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "XSL Script Processing" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "IO Port Restriction" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "Removable Media Device" }, "off_artifact_label": { "type": "literal", "value": "Removable Media Device" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Replication Through Removable Media" }, "off_tech_parent_label": { "type": "literal", "value": "Initial Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Initial Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1091" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "XSL Script Processing" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "XSL Script Processing" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "XSL Script Processing" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "interprets" }, "off_tech_label": { "type": "literal", "value": "XSL Script Processing" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "interprets" }, "off_tech_label": { "type": "literal", "value": "XSL Script Processing" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#interprets" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1220" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "IO Port Restriction" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "Input Device" }, "off_artifact_label": { "type": "literal", "value": "Keyboard Input Device" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Keylogging" }, "off_tech_parent_label": { "type": "literal", "value": "Input Capture" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Authentication Service" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Authentication Service" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Authentication Service" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Modify Authentication Process" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Authentication Service" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Modify Authentication Process" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Local Data Staging" }, "off_tech_parent_label": { "type": "literal", "value": "Data Staged" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1074" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "IO Port Restriction" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "Input Device" }, "off_artifact_label": { "type": "literal", "value": "Video Input Device" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Video Capture" }, "off_tech_parent_label": { "type": "literal", "value": "Collection Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#VideoInputDevice" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1125" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "IO Port Restriction" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "Input Device" }, "off_artifact_label": { "type": "literal", "value": "Audio Input Device" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Audio Capture" }, "off_tech_parent_label": { "type": "literal", "value": "Collection Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AudioInputDevice" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1123" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Get System Time" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Time Based Evasion" }, "off_tech_parent_label": { "type": "literal", "value": "Virtualization/Sandbox Evasion" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemTime" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1497" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Get Screen Capture" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Screen Capture" }, "off_tech_parent_label": { "type": "literal", "value": "Collection Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetScreenCapture" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1113" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "IO Port Restriction" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "Removable Media Device" }, "off_artifact_label": { "type": "literal", "value": "Removable Media Device" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Data from Removable Media" }, "off_tech_parent_label": { "type": "literal", "value": "Collection Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Collection" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1025" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Runtime Data Manipulation" }, "off_tech_parent_label": { "type": "literal", "value": "Data Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Runtime Data Manipulation" }, "off_tech_parent_label": { "type": "literal", "value": "Data Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Impact" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1565" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Elevated Execution with Prompt" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Authentication Service" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Authentication Service" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Use Alternate Authentication Material" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1550" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "IO Port Restriction" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "Removable Media Device" }, "off_artifact_label": { "type": "literal", "value": "Removable Media Device" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Replication Through Removable Media" }, "off_tech_parent_label": { "type": "literal", "value": "Lateral Movement Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Lateral Movement" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1091" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Parent PID Spoofing" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Parent PID Spoofing" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Parent PID Spoofing" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Parent PID Spoofing" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Parent PID Spoofing" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "IO Port Restriction" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "Removable Media Device" }, "off_artifact_label": { "type": "literal", "value": "Removable Media Device" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Communication Through Removable Media" }, "off_tech_parent_label": { "type": "literal", "value": "Command and Control Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Command And Control" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1092" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "off_tech_label": { "type": "literal", "value": "Software Packing" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "obfuscates" }, "off_tech_label": { "type": "literal", "value": "Software Packing" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#obfuscates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Unquoted Path" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Compile After Delivery" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Compile After Delivery" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Unquoted Path" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Binary Padding" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Binary Padding" }, "off_tech_parent_label": { "type": "literal", "value": "Obfuscated Files or Information" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1027" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by PATH Environment Variable" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by PATH Environment Variable" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Rename System Utilities" }, "off_tech_parent_label": { "type": "literal", "value": "Masquerading" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Rename System Utilities" }, "off_tech_parent_label": { "type": "literal", "value": "Masquerading" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Move File" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Match Legitimate Name or Location" }, "off_tech_parent_label": { "type": "literal", "value": "Masquerading" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MoveFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Invalid Code Signature" }, "off_tech_parent_label": { "type": "literal", "value": "Masquerading" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Invalid Code Signature" }, "off_tech_parent_label": { "type": "literal", "value": "Masquerading" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1036" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Dynamic-link Library Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "VDSO Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Process Doppelgänging" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Process Doppelgänging" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Process Doppelgänging" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Process Doppelgänging" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Process Doppelgänging" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Ptrace System Calls" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Thread Local Storage" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Asynchronous Procedure Call" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Asynchronous Procedure Call" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Asynchronous Procedure Call" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Asynchronous Procedure Call" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Thread Execution Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Thread Execution Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Asynchronous Procedure Call" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Thread Execution Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Thread Execution Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Asynchronous Procedure Call" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Asynchronous Procedure Call" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Thread Execution Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Asynchronous Procedure Call" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Asynchronous Procedure Call" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Thread Execution Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Asynchronous Procedure Call" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Thread Local Storage" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Ptrace System Calls" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Registry Run Keys / Startup Folder" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Registry Run Keys / Startup Folder" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Process Doppelgänging" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Process Doppelgänging" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Process Doppelgänging" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Process Doppelgänging" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Process Doppelgänging" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Shortcut Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "VDSO Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.014" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Startup Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Shortcut Modification" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Autostart Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserStartupScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1547" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Dynamic-link Library Injection" }, "off_tech_parent_label": { "type": "literal", "value": "Process Injection" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1055" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-create" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-create" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by PATH Environment Variable" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by PATH Environment Variable" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Search Order Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Unquoted Path" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Path Interception by Unquoted Path" }, "off_tech_parent_label": { "type": "literal", "value": "Hijack Execution Flow" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1574" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Trap" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Screensaver" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "creates" }, "off_tech_label": { "type": "literal", "value": "Screensaver" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#creates" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "IO Port Restriction" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "Removable Media Device" }, "off_artifact_label": { "type": "literal", "value": "Removable Media Device" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Exfiltration over USB" }, "off_tech_parent_label": { "type": "literal", "value": "Exfiltration Over Physical Medium" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Exfiltration" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1052.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1052" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Control Panel Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Control Panel Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Control Panel Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Control Panel Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Control Panel Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "Component Object Model Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "loads" }, "off_tech_label": { "type": "literal", "value": "Component Object Model Hijacking" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#loads" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.015" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "CMSTP" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "CMSTP" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "CMSTP" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "CMSTP" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "CMSTP" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Mshta Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Mshta Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Mshta Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Mshta Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Mshta Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "PowerShell Profile Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "PowerShell Profile" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "PowerShell Profile Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "PowerShell Profile" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Rundll32 Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Rundll32 Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Rundll32 Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Rundll32 Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppInit DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppInit DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Rundll32 Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.011" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppInit DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppInit DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppInit DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Thread" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Mavinject" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateThread" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppCert DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppCert DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create File" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Compiled HTML File" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppCert DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppCert DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Compiled HTML File" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppCert DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Compiled HTML File" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Compiled HTML File" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Compiled HTML File" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Compiled HTML File" }, "off_tech_parent_label": { "type": "literal", "value": "Signed Binary Proxy Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1218" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Impair Command History Logging" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Impair Command History Logging" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Operating System Process" }, "off_artifact_rel_label": { "type": "literal", "value": "disables" }, "off_tech_label": { "type": "literal", "value": "Disable or Modify Tools" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Netsh Helper DLL" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Operating System Process" }, "off_artifact_rel_label": { "type": "literal", "value": "disables" }, "off_tech_label": { "type": "literal", "value": "Disable or Modify Tools" }, "off_tech_parent_label": { "type": "literal", "value": "Impair Defenses" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#disables" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1562" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Netsh Helper DLL" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LC_LOAD_DYLIB Addition" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LC_LOAD_DYLIB Addition" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Scheduled Job" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Schtasks Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Scheduled Job" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Schtasks Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Parent PID Spoofing" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Parent PID Spoofing" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Parent PID Spoofing" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Parent PID Spoofing" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Parent PID Spoofing" }, "off_tech_parent_label": { "type": "literal", "value": "Access Token Manipulation" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1134" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Mac)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Mac)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Windows)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Windows)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "System Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Rc.common" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "System Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Rc.common" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Network Init Script File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Network Logon Script" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Network Init Script File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Network Logon Script" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Scheduled Job" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Elevated Execution with Prompt" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Scheduled Job" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Persistence Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Bypass User Access Control" }, "off_tech_parent_label": { "type": "literal", "value": "Abuse Elevation Control Mechanism" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1548" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Network Init Script File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Network Logon Script" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Network Init Script File Resource" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Network Logon Script" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkInitScriptFileResource" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Scheduled Job" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Scheduled Job" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Privilege Escalation Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Privilege Escalation" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PrivilegeEscalationTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "System Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Rc.common" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "System Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Rc.common" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Windows)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Windows)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Mac)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "User Init Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Logon Script (Mac)" }, "off_tech_parent_label": { "type": "literal", "value": "Boot or Logon Initialization Scripts" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#UserInitScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1037" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "LSASS Memory" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "LSASS Memory" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Authentication Service" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "LSASS Memory" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Authentication Service" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "LSASS Memory" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "LSA Secrets" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "LSA Secrets" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.004" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Message Transfer Agent" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Transport Agent" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Message Transfer Agent" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Transport Agent" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MessageTransferAgent" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Security Account Manager" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Security Account Manager" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Authentication Service" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Security Account Manager" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Authentication Service" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Security Account Manager" }, "off_tech_parent_label": { "type": "literal", "value": "OS Credential Dumping" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.002" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1003" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Web Shell" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Web Shell" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Web Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Shell" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Web Script File" }, "off_artifact_rel_label": { "type": "literal", "value": "adds" }, "off_tech_label": { "type": "literal", "value": "Web Shell" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#WebScriptFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#adds" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "SQL Stored Procedures" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "SQL Stored Procedures" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "SQL Stored Procedures" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "SQL Stored Procedures" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "SQL Stored Procedures" }, "off_tech_parent_label": { "type": "literal", "value": "Server Software Component" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1505" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Read File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Credentials from Web Browsers" }, "off_tech_parent_label": { "type": "literal", "value": "Credentials from Password Stores" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ReadFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555.003" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1555" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "IO Port Restriction" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "Input Device" }, "off_artifact_label": { "type": "literal", "value": "Keyboard Input Device" }, "off_artifact_rel_label": { "type": "literal", "value": "accesses" }, "off_tech_label": { "type": "literal", "value": "Keylogging" }, "off_tech_parent_label": { "type": "literal", "value": "Input Capture" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#IOPortRestriction" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#InputDevice" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#accesses" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1056" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Authentication Service" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Modify Authentication Process" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Authentication Service" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "Modify Authentication Process" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1556" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Office Template Macros" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Office Template Macros" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Office Template Macros" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Office Template Macros" }, "off_tech_parent_label": { "type": "literal", "value": "Office Application Startup" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1137" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Scheduled Job" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Schtasks Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Scheduled Job" }, "off_artifact_rel_label": { "type": "literal", "value": "executes" }, "off_tech_label": { "type": "literal", "value": "Schtasks Execution" }, "off_tech_parent_label": { "type": "literal", "value": "Scheduled Task/Job Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#executes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.005" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1053" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LC_LOAD_DYLIB Addition" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "LC_LOAD_DYLIB Addition" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.006" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Netsh Helper DLL" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_rel_label": { "type": "literal", "value": "produces" }, "off_tech_label": { "type": "literal", "value": "Netsh Helper DLL" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#produces" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Authentication Service" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Exploitation for Credential Access" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "isolates" }, "def_artifact_label": { "type": "literal", "value": "Process" }, "off_artifact_label": { "type": "literal", "value": "Authentication Service" }, "off_artifact_rel_label": { "type": "literal", "value": "may-access" }, "off_tech_label": { "type": "literal", "value": "Exploitation for Credential Access" }, "off_tech_parent_label": { "type": "literal", "value": "Credential Access Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Credential Access" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#isolates" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Process" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#AuthenticationService" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-access" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1212" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Binary" }, "off_artifact_rel_label": { "type": "literal", "value": "may-modify" }, "off_tech_label": { "type": "literal", "value": "Accessibility Features" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableBinary" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Deobfuscate/Decode Files or Information" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Get Running Processes" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "Security Software Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Software Discovery" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetRunningProcesses" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518.001" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1518" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Get Running Processes" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Service Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetRunningProcesses" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Service Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Service Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Service Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Service Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Service Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1007" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppCert DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppCert DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppCert DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppCert DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppCert DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.009" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-execute" }, "off_tech_label": { "type": "literal", "value": "System Network Configuration Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_rel_label": { "type": "literal", "value": "may-add" }, "off_tech_label": { "type": "literal", "value": "Deobfuscate/Decode Files or Information" }, "off_tech_parent_label": { "type": "literal", "value": "Defense Evasion Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Defense Evasion" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-add" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1140" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseEvasionTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "Executable Script" }, "off_artifact_rel_label": { "type": "literal", "value": "may-execute" }, "off_tech_label": { "type": "literal", "value": "System Network Configuration Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-execute" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppInit DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Get System Network Config Value" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Network Configuration Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemNetworkConfigValue" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Network Configuration Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppInit DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Network Configuration Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppInit DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppInit DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Network Configuration Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Mandatory Access Control" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Network Configuration Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#MandatoryAccessControl" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Network Configuration Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1016" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "invokes" }, "off_tech_label": { "type": "literal", "value": "AppInit DLLs" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#invokes" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.010" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Get System Time" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Time Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#GetSystemTime" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1124" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Allowlisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "PowerShell Profile Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "PowerShell Profile" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "blocks" }, "def_artifact_label": { "type": "literal", "value": "Executable File" }, "off_artifact_label": { "type": "literal", "value": "PowerShell Profile Script" }, "off_artifact_rel_label": { "type": "literal", "value": "modifies" }, "off_tech_label": { "type": "literal", "value": "PowerShell Profile" }, "off_tech_parent_label": { "type": "literal", "value": "Event Triggered Execution" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "false", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Persistence" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#blocks" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableFile" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#PowerShellProfileScript" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#modifies" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.013" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1546" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "System Call Filtering" }, "def_artifact_rel_label": { "type": "literal", "value": "filters" }, "def_artifact_label": { "type": "literal", "value": "System Call" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Time Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#filters" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1124" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Executable Denylisting" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Time Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting" }, "def_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#restricts" }, "def_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess" }, "off_artifact_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#may-invoke" }, "off_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#T1124" }, "off_tech_parent": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique" }, "off_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "off_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007" } }, { "query_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "top_def_tech_label": { "type": "literal", "value": "Execution Isolation" }, "def_tactic_label": { "type": "literal", "value": "Isolate" }, "def_tactic_rel_label": { "type": "literal", "value": "enables" }, "def_tech_label": { "type": "literal", "value": "Hardware-based Process Isolation" }, "def_artifact_rel_label": { "type": "literal", "value": "restricts" }, "def_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_label": { "type": "literal", "value": "Create Process" }, "off_artifact_rel_label": { "type": "literal", "value": "may-invoke" }, "off_tech_label": { "type": "literal", "value": "System Time Discovery" }, "off_tech_parent_label": { "type": "literal", "value": "Discovery Technique" }, "off_tech_parent_is_toplevel": { "type": "literal", "value": "true", "datatype": "http://www.w3.org/2001/XMLSchema#boolean" }, "off_tactic_rel_label": { "type": "literal", "value": "enables" }, "off_tactic_label": { "type": "literal", "value": "Discovery" }, "def_tactic": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate" }, "def_tactic_rel": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#enables" }, "def_tech": { "type": "uri", "value": "http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsol