{ "metadata": { "file": "de-split-crosswalk.json", "domain": "enterprise-attack", "description": "This file maps Enterprise ATT&CK techniques from their previous ATT&CK IDs and STIX IDs to the ATT&CK IDs and STIX IDs used after the Defense Evasion tactic split. The Defense Evasion (TA0005) tactic has been renamed to Stealth (TA0005), and a new tactic named Defense Impairment (TA0112) has been created.", "date": "2026-04-28" }, "existing-techniques": { "T1548": { "attack-v18-attack-id": "T1548", "attack-v19-attack-id": "T1548", "attack-v18-stix-id": "attack-pattern--67720091-eee3-4d2d-ae16-8264567f6f5b", "attack-v19-stix-id": "attack-pattern--67720091-eee3-4d2d-ae16-8264567f6f5b", "attack-v18-name": "Abuse Elevation Control Mechanism", "attack-v19-name": "Abuse Elevation Control Mechanism", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Left Defense Evasion" }, "T1548.002": { "attack-v18-attack-id": "T1548.002", "attack-v19-attack-id": "T1548.002", "attack-v18-stix-id": "attack-pattern--120d5519-3098-4e1c-9191-2aa61232f073", "attack-v19-stix-id": "attack-pattern--120d5519-3098-4e1c-9191-2aa61232f073", "attack-v18-name": "Abuse Elevation Control Mechanism: Bypass User Account Control", "attack-v19-name": "Abuse Elevation Control Mechanism: Bypass User Account Control", "attack-v19-parent-attack-id": "T1548", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Left Defense Evasion" }, "T1548.004": { "attack-v18-attack-id": "T1548.004", "attack-v19-attack-id": "T1548.004", "attack-v18-stix-id": "attack-pattern--b84903f0-c7d5-435d-a69e-de47cc3578c0", "attack-v19-stix-id": "attack-pattern--b84903f0-c7d5-435d-a69e-de47cc3578c0", "attack-v18-name": "Abuse Elevation Control Mechanism: Elevated Execution with Prompt", "attack-v19-name": "Abuse Elevation Control Mechanism: Elevated Execution with Prompt", "attack-v19-parent-attack-id": "T1548", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Left Defense Evasion" }, "T1548.001": { "attack-v18-attack-id": "T1548.001", "attack-v19-attack-id": "T1548.001", "attack-v18-stix-id": "attack-pattern--6831414d-bb70-42b7-8030-d4e06b2660c9", "attack-v19-stix-id": "attack-pattern--6831414d-bb70-42b7-8030-d4e06b2660c9", "attack-v18-name": "Abuse Elevation Control Mechanism: Setuid and Setgid", "attack-v19-name": "Abuse Elevation Control Mechanism: Setuid and Setgid", "attack-v19-parent-attack-id": "T1548", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Left Defense Evasion" }, "T1548.003": { "attack-v18-attack-id": "T1548.003", "attack-v19-attack-id": "T1548.003", "attack-v18-stix-id": "attack-pattern--1365fe3b-0f50-455d-b4da-266ce31c23b0", "attack-v19-stix-id": "attack-pattern--1365fe3b-0f50-455d-b4da-266ce31c23b0", "attack-v18-name": "Abuse Elevation Control Mechanism: Sudo and Sudo Caching", "attack-v19-name": "Abuse Elevation Control Mechanism: Sudo and Sudo Caching", "attack-v19-parent-attack-id": "T1548", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Left Defense Evasion" }, "T1548.006": { "attack-v18-attack-id": "T1548.006", "attack-v19-attack-id": "T1548.006", "attack-v18-stix-id": "attack-pattern--e8a0a025-3601-4755-abfb-8d08283329fb", "attack-v19-stix-id": "attack-pattern--e8a0a025-3601-4755-abfb-8d08283329fb", "attack-v18-name": "Abuse Elevation Control Mechanism: TCC Manipulation", "attack-v19-name": "Abuse Elevation Control Mechanism: TCC Manipulation", "attack-v19-parent-attack-id": "T1548", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Left Defense Evasion" }, "T1548.005": { "attack-v18-attack-id": "T1548.005", "attack-v19-attack-id": "T1548.005", "attack-v18-stix-id": "attack-pattern--6fa224c7-5091-4595-bf15-3fc9fe2f2c7c", "attack-v19-stix-id": "attack-pattern--6fa224c7-5091-4595-bf15-3fc9fe2f2c7c", "attack-v18-name": "Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access", "attack-v19-name": "Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access", "attack-v19-parent-attack-id": "T1548", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Left Defense Evasion" }, "T1134": { "attack-v18-attack-id": "T1134", "attack-v19-attack-id": "T1134", "attack-v18-stix-id": "attack-pattern--dcaa092b-7de9-4a21-977f-7fcb77e89c48", "attack-v19-stix-id": "attack-pattern--dcaa092b-7de9-4a21-977f-7fcb77e89c48", "attack-v18-name": "Access Token Manipulation", "attack-v19-name": "Access Token Manipulation", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1134.002": { "attack-v18-attack-id": "T1134.002", "attack-v19-attack-id": "T1134.002", "attack-v18-stix-id": "attack-pattern--677569f9-a8b0-459e-ab24-7f18091fa7bf", "attack-v19-stix-id": "attack-pattern--677569f9-a8b0-459e-ab24-7f18091fa7bf", "attack-v18-name": "Access Token Manipulation: Create Process with Token", "attack-v19-name": "Access Token Manipulation: Create Process with Token", "attack-v19-parent-attack-id": "T1134", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1134.003": { "attack-v18-attack-id": "T1134.003", "attack-v19-attack-id": "T1134.003", "attack-v18-stix-id": "attack-pattern--8cdeb020-e31e-4f88-a582-f53dcfbda819", "attack-v19-stix-id": "attack-pattern--8cdeb020-e31e-4f88-a582-f53dcfbda819", "attack-v18-name": "Access Token Manipulation: Make and Impersonate Token", "attack-v19-name": "Access Token Manipulation: Make and Impersonate Token", "attack-v19-parent-attack-id": "T1134", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1134.004": { "attack-v18-attack-id": "T1134.004", "attack-v19-attack-id": "T1134.004", "attack-v18-stix-id": "attack-pattern--93591901-3172-4e94-abf8-6034ab26f44a", "attack-v19-stix-id": "attack-pattern--93591901-3172-4e94-abf8-6034ab26f44a", "attack-v18-name": "Access Token Manipulation: Parent PID Spoofing", "attack-v19-name": "Access Token Manipulation: Parent PID Spoofing", "attack-v19-parent-attack-id": "T1134", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1134.005": { "attack-v18-attack-id": "T1134.005", "attack-v19-attack-id": "T1134.005", "attack-v18-stix-id": "attack-pattern--b7dc639b-24cd-482d-a7f1-8897eda21023", "attack-v19-stix-id": "attack-pattern--b7dc639b-24cd-482d-a7f1-8897eda21023", "attack-v18-name": "Access Token Manipulation: SID-History Injection", "attack-v19-name": "Access Token Manipulation: SID-History Injection", "attack-v19-parent-attack-id": "T1134", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1134.001": { "attack-v18-attack-id": "T1134.001", "attack-v19-attack-id": "T1134.001", "attack-v18-stix-id": "attack-pattern--86850eff-2729-40c3-b85e-c4af26da4a2d", "attack-v19-stix-id": "attack-pattern--86850eff-2729-40c3-b85e-c4af26da4a2d", "attack-v18-name": "Access Token Manipulation: Token Impersonation/Theft", "attack-v19-name": "Access Token Manipulation: Token Impersonation/Theft", "attack-v19-parent-attack-id": "T1134", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1197": { "attack-v18-attack-id": "T1197", "attack-v19-attack-id": "T1197", "attack-v18-stix-id": "attack-pattern--c8e87b83-edbb-48d4-9295-4974897525b7", "attack-v19-stix-id": "attack-pattern--c8e87b83-edbb-48d4-9295-4974897525b7", "attack-v18-name": "BITS Jobs", "attack-v19-name": "BITS Jobs", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion", "persistence" ], "attack-v19-tactics": [ "stealth", "persistence", "execution" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1612": { "attack-v18-attack-id": "T1612", "attack-v19-attack-id": "T1612", "attack-v18-stix-id": "attack-pattern--800f9819-7007-4540-a520-40e655876800", "attack-v19-stix-id": "attack-pattern--800f9819-7007-4540-a520-40e655876800", "attack-v18-name": "Build Image on Host", "attack-v19-name": "Build Image on Host", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1622": { "attack-v18-attack-id": "T1622", "attack-v19-attack-id": "T1622", "attack-v18-stix-id": "attack-pattern--e4dc8c01-417f-458d-9ee0-bb0617c1b391", "attack-v19-stix-id": "attack-pattern--e4dc8c01-417f-458d-9ee0-bb0617c1b391", "attack-v18-name": "Debugger Evasion", "attack-v19-name": "Debugger Evasion", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion", "discovery" ], "attack-v19-tactics": [ "stealth", "discovery" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1678": { "attack-v18-attack-id": "T1678", "attack-v19-attack-id": "T1678", "attack-v18-stix-id": "attack-pattern--a1df809c-7d0e-459f-8fe5-25474bab770b", "attack-v19-stix-id": "attack-pattern--a1df809c-7d0e-459f-8fe5-25474bab770b", "attack-v18-name": "Delay Execution", "attack-v19-name": "Delay Execution", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1140": { "attack-v18-attack-id": "T1140", "attack-v19-attack-id": "T1140", "attack-v18-stix-id": "attack-pattern--3ccef7ae-cb5e-48f6-8302-897105fbf55c", "attack-v19-stix-id": "attack-pattern--3ccef7ae-cb5e-48f6-8302-897105fbf55c", "attack-v18-name": "Deobfuscate/Decode Files or Information", "attack-v19-name": "Deobfuscate/Decode Files or Information", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1610": { "attack-v18-attack-id": "T1610", "attack-v19-attack-id": "T1610", "attack-v18-stix-id": "attack-pattern--56e0d8b8-3e25-49dd-9050-3aa252f5aa92", "attack-v19-stix-id": "attack-pattern--56e0d8b8-3e25-49dd-9050-3aa252f5aa92", "attack-v18-name": "Deploy Container", "attack-v19-name": "Deploy Container", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion", "execution" ], "attack-v19-tactics": [ "execution" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Left Defense Evasion" }, "T1006": { "attack-v18-attack-id": "T1006", "attack-v19-attack-id": "T1006", "attack-v18-stix-id": "attack-pattern--0c8ab3eb-df48-4b9c-ace7-beacaac81cc5", "attack-v19-stix-id": "attack-pattern--0c8ab3eb-df48-4b9c-ace7-beacaac81cc5", "attack-v18-name": "Direct Volume Access", "attack-v19-name": "Direct Volume Access", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1484": { "attack-v18-attack-id": "T1484", "attack-v19-attack-id": "T1484", "attack-v18-stix-id": "attack-pattern--ebb42bbe-62d7-47d7-a55f-3b08b61d792d", "attack-v19-stix-id": "attack-pattern--ebb42bbe-62d7-47d7-a55f-3b08b61d792d", "attack-v18-name": "Domain or Tenant Policy Modification", "attack-v19-name": "Domain or Tenant Policy Modification", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "defense-impairment", "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Moved to new tactic Defense Impairment, and Remains in Additional Tactic(s)" }, "T1484.001": { "attack-v18-attack-id": "T1484.001", "attack-v19-attack-id": "T1484.001", "attack-v18-stix-id": "attack-pattern--5d2be8b9-d24c-4e98-83bf-2f5f79477163", "attack-v19-stix-id": "attack-pattern--5d2be8b9-d24c-4e98-83bf-2f5f79477163", "attack-v18-name": "Domain or Tenant Policy Modification: Group Policy Modification", "attack-v19-name": "Domain or Tenant Policy Modification: Group Policy Modification", "attack-v19-parent-attack-id": "T1484", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "defense-impairment", "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment, and Remains in Additional Tactic(s)" }, "T1484.002": { "attack-v18-attack-id": "T1484.002", "attack-v19-attack-id": "T1484.002", "attack-v18-stix-id": "attack-pattern--24769ab5-14bd-4f4e-a752-cfb185da53ee", "attack-v19-stix-id": "attack-pattern--24769ab5-14bd-4f4e-a752-cfb185da53ee", "attack-v18-name": "Domain or Tenant Policy Modification: Trust Modification", "attack-v19-name": "Domain or Tenant Policy Modification: Trust Modification", "attack-v19-parent-attack-id": "T1484", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "defense-impairment", "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment, and Remains in Additional Tactic(s)" }, "T1672": { "attack-v18-attack-id": "T1672", "attack-v19-attack-id": "T1684.002", "attack-v18-stix-id": "attack-pattern--e1c2db92-7ae3-4e6a-90b4-157c1c1565cb", "attack-v19-stix-id": "attack-pattern--fcf5bccf-be7a-48ff-b7a7-8d6019279301", "attack-v18-name": "Email Spoofing", "attack-v19-name": "Social Engineering: Email Spoofing", "attack-v19-parent-attack-id": "T1684", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Revoked T1672", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1480": { "attack-v18-attack-id": "T1480", "attack-v19-attack-id": "T1480", "attack-v18-stix-id": "attack-pattern--853c4192-4311-43e1-bfbb-b11b14911852", "attack-v19-stix-id": "attack-pattern--853c4192-4311-43e1-bfbb-b11b14911852", "attack-v18-name": "Execution Guardrails", "attack-v19-name": "Execution Guardrails", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1480.001": { "attack-v18-attack-id": "T1480.001", "attack-v19-attack-id": "T1480.001", "attack-v18-stix-id": "attack-pattern--f244b8dd-af6c-4391-a497-fc03627ce995", "attack-v19-stix-id": "attack-pattern--f244b8dd-af6c-4391-a497-fc03627ce995", "attack-v18-name": "Execution Guardrails: Environmental Keying", "attack-v19-name": "Execution Guardrails: Environmental Keying", "attack-v19-parent-attack-id": "T1480", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1480.002": { "attack-v18-attack-id": "T1480.002", "attack-v19-attack-id": "T1480.002", "attack-v18-stix-id": "attack-pattern--49fca0d2-685d-41eb-8bd4-05451cc3a742", "attack-v19-stix-id": "attack-pattern--49fca0d2-685d-41eb-8bd4-05451cc3a742", "attack-v18-name": "Execution Guardrails: Mutual Exclusion", "attack-v19-name": "Execution Guardrails: Mutual Exclusion", "attack-v19-parent-attack-id": "T1480", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1211": { "attack-v18-attack-id": "T1211", "attack-v19-attack-id": "T1211", "attack-v18-stix-id": "attack-pattern--fe926152-f431-4baf-956c-4ad3cb0bf23b", "attack-v19-stix-id": "attack-pattern--fe926152-f431-4baf-956c-4ad3cb0bf23b", "attack-v18-name": "Exploitation for Defense Evasion", "attack-v19-name": "Exploitation for Stealth", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1222": { "attack-v18-attack-id": "T1222", "attack-v19-attack-id": "T1222", "attack-v18-stix-id": "attack-pattern--65917ae0-b854-4139-83fe-bf2441cf0196", "attack-v19-stix-id": "attack-pattern--65917ae0-b854-4139-83fe-bf2441cf0196", "attack-v18-name": "File and Directory Permissions Modification", "attack-v19-name": "File and Directory Permissions Modification", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1222.002": { "attack-v18-attack-id": "T1222.002", "attack-v19-attack-id": "T1222.002", "attack-v18-stix-id": "attack-pattern--09b130a2-a77e-4af0-a361-f46f9aad1345", "attack-v19-stix-id": "attack-pattern--09b130a2-a77e-4af0-a361-f46f9aad1345", "attack-v18-name": "File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification", "attack-v19-name": "File and Directory Permissions Modification: Linux and Mac Permissions", "attack-v19-parent-attack-id": "T1222", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1222.001": { "attack-v18-attack-id": "T1222.001", "attack-v19-attack-id": "T1222.001", "attack-v18-stix-id": "attack-pattern--34e793de-0274-4982-9c1a-246ed1c19dee", "attack-v19-stix-id": "attack-pattern--34e793de-0274-4982-9c1a-246ed1c19dee", "attack-v18-name": "File and Directory Permissions Modification: Windows File and Directory Permissions Modification", "attack-v19-name": "File and Directory Permissions Modification: Windows Permissions", "attack-v19-parent-attack-id": "T1222", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1564": { "attack-v18-attack-id": "T1564", "attack-v19-attack-id": "T1564", "attack-v18-stix-id": "attack-pattern--22905430-4901-4c2a-84f6-98243cb173f8", "attack-v19-stix-id": "attack-pattern--22905430-4901-4c2a-84f6-98243cb173f8", "attack-v18-name": "Hide Artifacts", "attack-v19-name": "Hide Artifacts", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1564.013": { "attack-v18-attack-id": "T1564.013", "attack-v19-attack-id": "T1564.013", "attack-v18-stix-id": "attack-pattern--5bd41255-a224-4425-a2e2-e9d293eafe1c", "attack-v19-stix-id": "attack-pattern--5bd41255-a224-4425-a2e2-e9d293eafe1c", "attack-v18-name": "Hide Artifacts: Bind Mounts", "attack-v19-name": "Hide Artifacts: Bind Mounts", "attack-v19-parent-attack-id": "T1564", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1564.008": { "attack-v18-attack-id": "T1564.008", "attack-v19-attack-id": "T1564.008", "attack-v18-stix-id": "attack-pattern--0cf55441-b176-4332-89e7-2c4c7799d0ff", "attack-v19-stix-id": "attack-pattern--0cf55441-b176-4332-89e7-2c4c7799d0ff", "attack-v18-name": "Hide Artifacts: Email Hiding Rules", "attack-v19-name": "Hide Artifacts: Email Hiding Rules", "attack-v19-parent-attack-id": "T1564", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1564.014": { "attack-v18-attack-id": "T1564.014", "attack-v19-attack-id": "T1564.014", "attack-v18-stix-id": "attack-pattern--762e6f29-a62f-4d96-91ed-d0073181431f", "attack-v19-stix-id": "attack-pattern--762e6f29-a62f-4d96-91ed-d0073181431f", "attack-v18-name": "Hide Artifacts: Extended Attributes", "attack-v19-name": "Hide Artifacts: Extended Attributes", "attack-v19-parent-attack-id": "T1564", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1564.012": { "attack-v18-attack-id": "T1564.012", "attack-v19-attack-id": "T1564.012", "attack-v18-stix-id": "attack-pattern--09b008a9-b4eb-462a-a751-a0eb58050cd9", "attack-v19-stix-id": "attack-pattern--09b008a9-b4eb-462a-a751-a0eb58050cd9", "attack-v18-name": "Hide Artifacts: File/Path Exclusions", "attack-v19-name": "Hide Artifacts: File/Path Exclusions", "attack-v19-parent-attack-id": "T1564", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1564.005": { "attack-v18-attack-id": "T1564.005", "attack-v19-attack-id": "T1564.005", "attack-v18-stix-id": "attack-pattern--dfebc3b7-d19d-450b-81c7-6dafe4184c04", "attack-v19-stix-id": "attack-pattern--dfebc3b7-d19d-450b-81c7-6dafe4184c04", "attack-v18-name": "Hide Artifacts: Hidden File System", "attack-v19-name": "Hide Artifacts: Hidden File System", "attack-v19-parent-attack-id": "T1564", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1564.001": { "attack-v18-attack-id": "T1564.001", "attack-v19-attack-id": "T1564.001", "attack-v18-stix-id": "attack-pattern--ec8fc7e2-b356-455c-8db5-2e37be158e7d", "attack-v19-stix-id": "attack-pattern--ec8fc7e2-b356-455c-8db5-2e37be158e7d", "attack-v18-name": "Hide Artifacts: Hidden Files and Directories", "attack-v19-name": "Hide Artifacts: Hidden Files and Directories", "attack-v19-parent-attack-id": "T1564", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1564.002": { "attack-v18-attack-id": "T1564.002", "attack-v19-attack-id": "T1564.002", "attack-v18-stix-id": "attack-pattern--8c4aef43-48d5-49aa-b2af-c0cd58d30c3d", "attack-v19-stix-id": "attack-pattern--8c4aef43-48d5-49aa-b2af-c0cd58d30c3d", "attack-v18-name": "Hide Artifacts: Hidden Users", "attack-v19-name": "Hide Artifacts: Hidden Users", "attack-v19-parent-attack-id": "T1564", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1564.003": { "attack-v18-attack-id": "T1564.003", "attack-v19-attack-id": "T1564.003", "attack-v18-stix-id": "attack-pattern--cbb66055-0325-4111-aca0-40547b6ad5b0", "attack-v19-stix-id": "attack-pattern--cbb66055-0325-4111-aca0-40547b6ad5b0", "attack-v18-name": "Hide Artifacts: Hidden Window", "attack-v19-name": "Hide Artifacts: Hidden Window", "attack-v19-parent-attack-id": "T1564", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1564.011": { "attack-v18-attack-id": "T1564.011", "attack-v19-attack-id": "T1564.011", "attack-v18-stix-id": "attack-pattern--4a2975db-414e-4c0c-bd92-775987514b4b", "attack-v19-stix-id": "attack-pattern--4a2975db-414e-4c0c-bd92-775987514b4b", "attack-v18-name": "Hide Artifacts: Ignore Process Interrupts", "attack-v19-name": "Hide Artifacts: Ignore Process Interrupts", "attack-v19-parent-attack-id": "T1564", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1564.004": { "attack-v18-attack-id": "T1564.004", "attack-v19-attack-id": "T1564.004", "attack-v18-stix-id": "attack-pattern--f2857333-11d4-45bf-b064-2c28d8525be5", "attack-v19-stix-id": "attack-pattern--f2857333-11d4-45bf-b064-2c28d8525be5", "attack-v18-name": "Hide Artifacts: NTFS File Attributes", "attack-v19-name": "Hide Artifacts: NTFS File Attributes", "attack-v19-parent-attack-id": "T1564", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1564.010": { "attack-v18-attack-id": "T1564.010", "attack-v19-attack-id": "T1564.010", "attack-v18-stix-id": "attack-pattern--ffe59ad3-ad9b-4b9f-b74f-5beb3c309dc1", "attack-v19-stix-id": "attack-pattern--ffe59ad3-ad9b-4b9f-b74f-5beb3c309dc1", "attack-v18-name": "Hide Artifacts: Process Argument Spoofing", "attack-v19-name": "Hide Artifacts: Process Argument Spoofing", "attack-v19-parent-attack-id": "T1564", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1564.009": { "attack-v18-attack-id": "T1564.009", "attack-v19-attack-id": "T1564.009", "attack-v18-stix-id": "attack-pattern--b22e5153-ac28-4cc6-865c-2054e36285cb", "attack-v19-stix-id": "attack-pattern--b22e5153-ac28-4cc6-865c-2054e36285cb", "attack-v18-name": "Hide Artifacts: Resource Forking", "attack-v19-name": "Hide Artifacts: Resource Forking", "attack-v19-parent-attack-id": "T1564", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1564.006": { "attack-v18-attack-id": "T1564.006", "attack-v19-attack-id": "T1564.006", "attack-v18-stix-id": "attack-pattern--b5327dd1-6bf9-4785-a199-25bcbd1f4a9d", "attack-v19-stix-id": "attack-pattern--b5327dd1-6bf9-4785-a199-25bcbd1f4a9d", "attack-v18-name": "Hide Artifacts: Run Virtual Instance", "attack-v19-name": "Hide Artifacts: Run Virtual Instance", "attack-v19-parent-attack-id": "T1564", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1564.007": { "attack-v18-attack-id": "T1564.007", "attack-v19-attack-id": "T1564.007", "attack-v18-stix-id": "attack-pattern--c898c4b5-bf36-4e6e-a4ad-5b8c4c13e35b", "attack-v19-stix-id": "attack-pattern--c898c4b5-bf36-4e6e-a4ad-5b8c4c13e35b", "attack-v18-name": "Hide Artifacts: VBA Stomping", "attack-v19-name": "Hide Artifacts: VBA Stomping", "attack-v19-parent-attack-id": "T1564", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1574": { "attack-v18-attack-id": "T1574", "attack-v19-attack-id": "T1574", "attack-v18-stix-id": "attack-pattern--aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", "attack-v19-stix-id": "attack-pattern--aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", "attack-v18-name": "Hijack Execution Flow", "attack-v19-name": "Hijack Execution Flow", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion", "persistence", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "execution" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1574.014": { "attack-v18-attack-id": "T1574.014", "attack-v19-attack-id": "T1574.014", "attack-v18-stix-id": "attack-pattern--356662f7-e315-4759-86c9-6214e2a50ff8", "attack-v19-stix-id": "attack-pattern--356662f7-e315-4759-86c9-6214e2a50ff8", "attack-v18-name": "Hijack Execution Flow: AppDomainManager", "attack-v19-name": "Hijack Execution Flow: AppDomainManager", "attack-v19-parent-attack-id": "T1574", "attack-v18-tactics": [ "defense-evasion", "persistence", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "execution" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1574.012": { "attack-v18-attack-id": "T1574.012", "attack-v19-attack-id": "T1574.012", "attack-v18-stix-id": "attack-pattern--ffeb0780-356e-4261-b036-cfb6bd234335", "attack-v19-stix-id": "attack-pattern--ffeb0780-356e-4261-b036-cfb6bd234335", "attack-v18-name": "Hijack Execution Flow: COR_PROFILER", "attack-v19-name": "Hijack Execution Flow: COR_PROFILER", "attack-v19-parent-attack-id": "T1574", "attack-v18-tactics": [ "defense-evasion", "persistence", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "execution" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1574.001": { "attack-v18-attack-id": "T1574.001", "attack-v19-attack-id": "T1574.001", "attack-v18-stix-id": "attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34", "attack-v19-stix-id": "attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34", "attack-v18-name": "Hijack Execution Flow: DLL", "attack-v19-name": "Hijack Execution Flow: DLL", "attack-v19-parent-attack-id": "T1574", "attack-v18-tactics": [ "defense-evasion", "persistence", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "execution" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1574.004": { "attack-v18-attack-id": "T1574.004", "attack-v19-attack-id": "T1574.004", "attack-v18-stix-id": "attack-pattern--fc742192-19e3-466c-9eb5-964a97b29490", "attack-v19-stix-id": "attack-pattern--fc742192-19e3-466c-9eb5-964a97b29490", "attack-v18-name": "Hijack Execution Flow: Dylib Hijacking", "attack-v19-name": "Hijack Execution Flow: Dylib Hijacking", "attack-v19-parent-attack-id": "T1574", "attack-v18-tactics": [ "defense-evasion", "persistence", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "execution" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1574.006": { "attack-v18-attack-id": "T1574.006", "attack-v19-attack-id": "T1574.006", "attack-v18-stix-id": "attack-pattern--633a100c-b2c9-41bf-9be5-905c1b16c825", "attack-v19-stix-id": "attack-pattern--633a100c-b2c9-41bf-9be5-905c1b16c825", "attack-v18-name": "Hijack Execution Flow: Dynamic Linker Hijacking", "attack-v19-name": "Hijack Execution Flow: Dynamic Linker Hijacking", "attack-v19-parent-attack-id": "T1574", "attack-v18-tactics": [ "defense-evasion", "persistence", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "execution" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1574.005": { "attack-v18-attack-id": "T1574.005", "attack-v19-attack-id": "T1574.005", "attack-v18-stix-id": "attack-pattern--70d81154-b187-45f9-8ec5-295d01255979", "attack-v19-stix-id": "attack-pattern--70d81154-b187-45f9-8ec5-295d01255979", "attack-v18-name": "Hijack Execution Flow: Executable Installer File Permissions Weakness", "attack-v19-name": "Hijack Execution Flow: Executable Installer File Permissions Weakness", "attack-v19-parent-attack-id": "T1574", "attack-v18-tactics": [ "defense-evasion", "persistence", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "execution" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1574.013": { "attack-v18-attack-id": "T1574.013", "attack-v19-attack-id": "T1574.013", "attack-v18-stix-id": "attack-pattern--a4657bc9-d22f-47d2-a7b7-dd6ec33f3dde", "attack-v19-stix-id": "attack-pattern--a4657bc9-d22f-47d2-a7b7-dd6ec33f3dde", "attack-v18-name": "Hijack Execution Flow: KernelCallbackTable", "attack-v19-name": "Hijack Execution Flow: KernelCallbackTable", "attack-v19-parent-attack-id": "T1574", "attack-v18-tactics": [ "defense-evasion", "persistence", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "execution" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1574.007": { "attack-v18-attack-id": "T1574.007", "attack-v19-attack-id": "T1574.007", "attack-v18-stix-id": "attack-pattern--0c2d00da-7742-49e7-9928-4514e5075d32", "attack-v19-stix-id": "attack-pattern--0c2d00da-7742-49e7-9928-4514e5075d32", "attack-v18-name": "Hijack Execution Flow: Path Interception by PATH Environment Variable", "attack-v19-name": "Hijack Execution Flow: Path Interception by PATH Environment Variable", "attack-v19-parent-attack-id": "T1574", "attack-v18-tactics": [ "defense-evasion", "persistence", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "execution" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1574.008": { "attack-v18-attack-id": "T1574.008", "attack-v19-attack-id": "T1574.008", "attack-v18-stix-id": "attack-pattern--58af3705-8740-4c68-9329-ec015a7013c2", "attack-v19-stix-id": "attack-pattern--58af3705-8740-4c68-9329-ec015a7013c2", "attack-v18-name": "Hijack Execution Flow: Path Interception by Search Order Hijacking", "attack-v19-name": "Hijack Execution Flow: Path Interception by Search Order Hijacking", "attack-v19-parent-attack-id": "T1574", "attack-v18-tactics": [ "defense-evasion", "persistence", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "execution" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1574.009": { "attack-v18-attack-id": "T1574.009", "attack-v19-attack-id": "T1574.009", "attack-v18-stix-id": "attack-pattern--bf96a5a3-3bce-43b7-8597-88545984c07b", "attack-v19-stix-id": "attack-pattern--bf96a5a3-3bce-43b7-8597-88545984c07b", "attack-v18-name": "Hijack Execution Flow: Path Interception by Unquoted Path", "attack-v19-name": "Hijack Execution Flow: Path Interception by Unquoted Path", "attack-v19-parent-attack-id": "T1574", "attack-v18-tactics": [ "defense-evasion", "persistence", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "execution" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1574.010": { "attack-v18-attack-id": "T1574.010", "attack-v19-attack-id": "T1574.010", "attack-v18-stix-id": "attack-pattern--9e8b28c9-35fe-48ac-a14d-e6cc032dcbcd", "attack-v19-stix-id": "attack-pattern--9e8b28c9-35fe-48ac-a14d-e6cc032dcbcd", "attack-v18-name": "Hijack Execution Flow: Services File Permissions Weakness", "attack-v19-name": "Hijack Execution Flow: Services File Permissions Weakness", "attack-v19-parent-attack-id": "T1574", "attack-v18-tactics": [ "defense-evasion", "persistence", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "execution" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1574.011": { "attack-v18-attack-id": "T1574.011", "attack-v19-attack-id": "T1574.011", "attack-v18-stix-id": "attack-pattern--17cc750b-e95b-4d7d-9dde-49e0de24148c", "attack-v19-stix-id": "attack-pattern--17cc750b-e95b-4d7d-9dde-49e0de24148c", "attack-v18-name": "Hijack Execution Flow: Services Registry Permissions Weakness", "attack-v19-name": "Hijack Execution Flow: Services Registry Permissions Weakness", "attack-v19-parent-attack-id": "T1574", "attack-v18-tactics": [ "defense-evasion", "persistence", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "execution" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1562": { "attack-v18-attack-id": "T1562", "attack-v19-attack-id": "T1685", "attack-v18-stix-id": "attack-pattern--3d333250-30e4-4a82-9edc-756c68afc529", "attack-v19-stix-id": "attack-pattern--bbde9781-60aa-4b8a-a911-895b0c1b3872", "attack-v18-name": "Impair Defenses", "attack-v19-name": "Disable or Modify Tools", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "T1562 revoked by T1685; T1562.001 and T1562.006 were also revoked by T1685 and merged into parent T1685", "technique-change-type": "Merged into new technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1562.007": { "attack-v18-attack-id": "T1562.007", "attack-v19-attack-id": "T1686.001", "attack-v18-stix-id": "attack-pattern--77532a55-c283-4cd2-bc5d-2d0b65e9d88c", "attack-v19-stix-id": "attack-pattern--ee474564-64be-4b83-a958-53f238f49b01", "attack-v18-name": "Impair Defenses: Disable or Modify Cloud Firewall", "attack-v19-name": "Disable or Modify System Firewall: Cloud Firewall", "attack-v19-parent-attack-id": "T1686", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Revoked T1562.007", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1562.008": { "attack-v18-attack-id": "T1562.008", "attack-v19-attack-id": "T1685.002", "attack-v18-stix-id": "attack-pattern--cacc40da-4c9e-462c-80d5-fd70a178b12d", "attack-v19-stix-id": "attack-pattern--34ff60a3-a3f8-42e4-bed0-af9a2cb563d7", "attack-v18-name": "Impair Defenses: Disable or Modify Cloud Logs", "attack-v19-name": "Disable or Modify Tools: Disable or Modify Cloud Log", "attack-v19-parent-attack-id": "T1685", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Revoked T1562.008", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1562.012": { "attack-v18-attack-id": "T1562.012", "attack-v19-attack-id": "T1685.004", "attack-v18-stix-id": "attack-pattern--562e9b64-7239-493d-80f4-2bff900d9054", "attack-v19-stix-id": "attack-pattern--23d69d00-80c4-42ff-9dac-dbd0459dad75", "attack-v18-name": "Impair Defenses: Disable or Modify Linux Audit System", "attack-v19-name": "Disable or Modify Tools: Disable or Modify Linux Audit System Log", "attack-v19-parent-attack-id": "T1685", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Revoked T1562.012", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1562.013": { "attack-v18-attack-id": "T1562.013", "attack-v19-attack-id": "T1686.002", "attack-v18-stix-id": "attack-pattern--a0f84e1d-d25c-4dd1-bb26-3c0e68471530", "attack-v19-stix-id": "attack-pattern--a29aa77c-a88d-4f19-bab9-7751941b2e2d", "attack-v18-name": "Impair Defenses: Disable or Modify Network Device Firewall", "attack-v19-name": "Disable or Modify System Firewall: Network Device Firewall", "attack-v19-parent-attack-id": "T1686", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Revoked T1562.013", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1562.004": { "attack-v18-attack-id": "T1562.004", "attack-v19-attack-id": "T1686", "attack-v18-stix-id": "attack-pattern--5372c5fe-f424-4def-bcd5-d3a8e770f07b", "attack-v19-stix-id": "attack-pattern--eec096b8-c207-43df-b6c1-11523861e452", "attack-v18-name": "Impair Defenses: Disable or Modify System Firewall", "attack-v19-name": "Disable or Modify System Firewall", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Revoked T1562.004", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1562.001": { "attack-v18-attack-id": "T1562.001", "attack-v19-attack-id": "T1685", "attack-v18-stix-id": "attack-pattern--ac08589e-ee59-4935-8667-d845e38fe579", "attack-v19-stix-id": "attack-pattern--bbde9781-60aa-4b8a-a911-895b0c1b3872", "attack-v18-name": "Impair Defenses: Disable or Modify Tools", "attack-v19-name": "Disable or Modify Tools", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "T1562.001 revoked by T1685, along with T1562 and T1562.006", "technique-change-type": "Merged into new technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1562.002": { "attack-v18-attack-id": "T1562.002", "attack-v19-attack-id": "T1685.001", "attack-v18-stix-id": "attack-pattern--4eb28bed-d11a-4641-9863-c2ac017d910a", "attack-v19-stix-id": "attack-pattern--1411e6b8-80a6-4465-9909-54eaa9c67ce0", "attack-v18-name": "Impair Defenses: Disable Windows Event Logging", "attack-v19-name": "Disable or Modify Tools: Disable or Modify Windows Event Log", "attack-v19-parent-attack-id": "T1685", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Revoked T1562.002", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1562.010": { "attack-v18-attack-id": "T1562.010", "attack-v19-attack-id": "T1689", "attack-v18-stix-id": "attack-pattern--824add00-99a1-4b15-9a2d-6c5683b7b497", "attack-v19-stix-id": "attack-pattern--30904c16-39f9-41c6-b01a-500eb8878442", "attack-v18-name": "Impair Defenses: Downgrade Attack", "attack-v19-name": "Downgrade Attack", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Revoked T1562.010", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1562.003": { "attack-v18-attack-id": "T1562.003", "attack-v19-attack-id": "T1690", "attack-v18-stix-id": "attack-pattern--8f504411-cb96-4dac-a537-8d2bb7679c59", "attack-v19-stix-id": "attack-pattern--b831f51c-d22f-4724-bbab-60d056bd1150", "attack-v18-name": "Impair Defenses: Impair Command History Logging", "attack-v19-name": "Prevent Command History Logging", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Revoked T1562.003", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1562.006": { "attack-v18-attack-id": "T1562.006", "attack-v19-attack-id": "T1685", "attack-v18-stix-id": "attack-pattern--74d2a63f-3c7b-4852-92da-02d8fbab16da", "attack-v19-stix-id": "attack-pattern--bbde9781-60aa-4b8a-a911-895b0c1b3872", "attack-v18-name": "Impair Defenses: Indicator Blocking", "attack-v19-name": "Disable or Modify Tools", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "T1562.006 revoked by T1685, along with T1562 and T1562.001", "technique-change-type": "Merged into new technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1562.009": { "attack-v18-attack-id": "T1562.009", "attack-v19-attack-id": "T1688", "attack-v18-stix-id": "attack-pattern--28170e17-8384-415c-8486-2e6b294cb803", "attack-v19-stix-id": "attack-pattern--c7660f19-f8c5-4ae3-a5e5-24381c270376", "attack-v18-name": "Impair Defenses: Safe Mode Boot", "attack-v19-name": "Safe Mode Boot", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Revoked T1562.009", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1562.011": { "attack-v18-attack-id": "T1562.011", "attack-v19-attack-id": "T1685.003", "attack-v18-stix-id": "attack-pattern--bef8aaee-961d-4359-a308-4c2182bcedff", "attack-v19-stix-id": "attack-pattern--0ff4bd68-aebb-4039-9e00-9f92c705edf4", "attack-v18-name": "Impair Defenses: Spoof Security Alerting", "attack-v19-name": "Disable or Modify Tools: Modify or Spoof Tool UI", "attack-v19-parent-attack-id": "T1685", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Revoked T1562.011", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1656": { "attack-v18-attack-id": "T1656", "attack-v19-attack-id": "T1684.001", "attack-v18-stix-id": "attack-pattern--c9e0c59e-162e-40a4-b8b1-78fab4329ada", "attack-v19-stix-id": "attack-pattern--cd92d2b8-ce43-4666-9472-f1b4b9f4f8be", "attack-v18-name": "Impersonation", "attack-v19-name": "Social Engineering: Impersonation", "attack-v19-parent-attack-id": "T1684", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Revoked T1656", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1070": { "attack-v18-attack-id": "T1070", "attack-v19-attack-id": "T1070", "attack-v18-stix-id": "attack-pattern--799ace7f-e227-4411-baa0-8868704f2a69", "attack-v19-stix-id": "attack-pattern--799ace7f-e227-4411-baa0-8868704f2a69", "attack-v18-name": "Indicator Removal", "attack-v19-name": "Indicator Removal", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1070.003": { "attack-v18-attack-id": "T1070.003", "attack-v19-attack-id": "T1070.003", "attack-v18-stix-id": "attack-pattern--3aef9463-9a7a-43ba-8957-a867e07c1e6a", "attack-v19-stix-id": "attack-pattern--3aef9463-9a7a-43ba-8957-a867e07c1e6a", "attack-v18-name": "Indicator Removal: Clear Command History", "attack-v19-name": "Indicator Removal: Clear Command History", "attack-v19-parent-attack-id": "T1070", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1070.002": { "attack-v18-attack-id": "T1070.002", "attack-v19-attack-id": "T1685.006", "attack-v18-stix-id": "attack-pattern--2bce5b30-7014-4a5d-ade7-12913fe6ac36", "attack-v19-stix-id": "attack-pattern--5e29d64d-2b14-4f92-875e-4c9c498e213c", "attack-v18-name": "Indicator Removal: Clear Linux or Mac System Logs", "attack-v19-name": "Disable or Modify Tools: Clear Linux or Mac System Logs", "attack-v19-parent-attack-id": "T1685", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Revoked T1070.002", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1070.008": { "attack-v18-attack-id": "T1070.008", "attack-v19-attack-id": "T1070.008", "attack-v18-stix-id": "attack-pattern--438c967d-3996-4870-bfc2-3954752a1927", "attack-v19-stix-id": "attack-pattern--438c967d-3996-4870-bfc2-3954752a1927", "attack-v18-name": "Indicator Removal: Clear Mailbox Data", "attack-v19-name": "Indicator Removal: Clear Mailbox Data", "attack-v19-parent-attack-id": "T1070", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1070.007": { "attack-v18-attack-id": "T1070.007", "attack-v19-attack-id": "T1070.007", "attack-v18-stix-id": "attack-pattern--3975dbb5-0e1e-4f5b-bae1-cf2ab84b46dc", "attack-v19-stix-id": "attack-pattern--3975dbb5-0e1e-4f5b-bae1-cf2ab84b46dc", "attack-v18-name": "Indicator Removal: Clear Network Connection History and Configurations", "attack-v19-name": "Indicator Removal: Clear Network Connection History and Configurations", "attack-v19-parent-attack-id": "T1070", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1070.009": { "attack-v18-attack-id": "T1070.009", "attack-v19-attack-id": "T1070.009", "attack-v18-stix-id": "attack-pattern--d2c4e5ea-dbdf-4113-805a-b1e2a337fb33", "attack-v19-stix-id": "attack-pattern--d2c4e5ea-dbdf-4113-805a-b1e2a337fb33", "attack-v18-name": "Indicator Removal: Clear Persistence", "attack-v19-name": "Indicator Removal: Clear Persistence", "attack-v19-parent-attack-id": "T1070", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1070.001": { "attack-v18-attack-id": "T1070.001", "attack-v19-attack-id": "T1685.005", "attack-v18-stix-id": "attack-pattern--6495ae23-3ab4-43c5-a94f-5638a2c31fd2", "attack-v19-stix-id": "attack-pattern--75b9a4d2-d4e2-4ca1-9aab-1badd9e05fd0", "attack-v18-name": "Indicator Removal: Clear Windows Event Logs", "attack-v19-name": "Disable or Modify Tools: Clear Windows Event Logs", "attack-v19-parent-attack-id": "T1685", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Revoked T1070.001", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1070.004": { "attack-v18-attack-id": "T1070.004", "attack-v19-attack-id": "T1070.004", "attack-v18-stix-id": "attack-pattern--d63a3fb8-9452-4e9d-a60a-54be68d5998c", "attack-v19-stix-id": "attack-pattern--d63a3fb8-9452-4e9d-a60a-54be68d5998c", "attack-v18-name": "Indicator Removal: File Deletion", "attack-v19-name": "Indicator Removal: File Deletion", "attack-v19-parent-attack-id": "T1070", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1070.005": { "attack-v18-attack-id": "T1070.005", "attack-v19-attack-id": "T1070.005", "attack-v18-stix-id": "attack-pattern--a750a9f6-0bde-4bb3-9aae-1e2786e9780c", "attack-v19-stix-id": "attack-pattern--a750a9f6-0bde-4bb3-9aae-1e2786e9780c", "attack-v18-name": "Indicator Removal: Network Share Connection Removal", "attack-v19-name": "Indicator Removal: Network Share Connection Removal", "attack-v19-parent-attack-id": "T1070", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1070.010": { "attack-v18-attack-id": "T1070.010", "attack-v19-attack-id": "T1070.010", "attack-v18-stix-id": "attack-pattern--cc36eeae-2209-4e63-89d3-c97e19edf280", "attack-v19-stix-id": "attack-pattern--cc36eeae-2209-4e63-89d3-c97e19edf280", "attack-v18-name": "Indicator Removal: Relocate Malware", "attack-v19-name": "Indicator Removal: Relocate Malware", "attack-v19-parent-attack-id": "T1070", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1070.006": { "attack-v18-attack-id": "T1070.006", "attack-v19-attack-id": "T1070.006", "attack-v18-stix-id": "attack-pattern--47f2d673-ca62-47e9-929b-1b0be9657611", "attack-v19-stix-id": "attack-pattern--47f2d673-ca62-47e9-929b-1b0be9657611", "attack-v18-name": "Indicator Removal: Timestomp", "attack-v19-name": "Indicator Removal: Timestomp", "attack-v19-parent-attack-id": "T1070", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1202": { "attack-v18-attack-id": "T1202", "attack-v19-attack-id": "T1202", "attack-v18-stix-id": "attack-pattern--3b0e52ce-517a-4614-a523-1bd5deef6c5e", "attack-v19-stix-id": "attack-pattern--3b0e52ce-517a-4614-a523-1bd5deef6c5e", "attack-v18-name": "Indirect Command Execution", "attack-v19-name": "Indirect Command Execution", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1036": { "attack-v18-attack-id": "T1036", "attack-v19-attack-id": "T1036", "attack-v18-stix-id": "attack-pattern--42e8de7b-37b2-4258-905a-6897815e58e0", "attack-v19-stix-id": "attack-pattern--42e8de7b-37b2-4258-905a-6897815e58e0", "attack-v18-name": "Masquerading", "attack-v19-name": "Masquerading", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1036.009": { "attack-v18-attack-id": "T1036.009", "attack-v19-attack-id": "T1036.009", "attack-v18-stix-id": "attack-pattern--34a80bc4-80f2-46e6-94ff-f3265a4b657c", "attack-v19-stix-id": "attack-pattern--34a80bc4-80f2-46e6-94ff-f3265a4b657c", "attack-v18-name": "Masquerading: Break Process Trees", "attack-v19-name": "Masquerading: Break Process Trees", "attack-v19-parent-attack-id": "T1036", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1036.012": { "attack-v18-attack-id": "T1036.012", "attack-v19-attack-id": "T1036.012", "attack-v18-stix-id": "attack-pattern--afac5dbc-4383-4fb6-9ba6-45b25d49e530", "attack-v19-stix-id": "attack-pattern--afac5dbc-4383-4fb6-9ba6-45b25d49e530", "attack-v18-name": "Masquerading: Browser Fingerprint", "attack-v19-name": "Masquerading: Browser Fingerprint", "attack-v19-parent-attack-id": "T1036", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1036.007": { "attack-v18-attack-id": "T1036.007", "attack-v19-attack-id": "T1036.007", "attack-v18-stix-id": "attack-pattern--11f29a39-0942-4d62-92b6-fe236cf3066e", "attack-v19-stix-id": "attack-pattern--11f29a39-0942-4d62-92b6-fe236cf3066e", "attack-v18-name": "Masquerading: Double File Extension", "attack-v19-name": "Masquerading: Double File Extension", "attack-v19-parent-attack-id": "T1036", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1036.001": { "attack-v18-attack-id": "T1036.001", "attack-v19-attack-id": "T1036.001", "attack-v18-stix-id": "attack-pattern--b4b7458f-81f2-4d38-84be-1c5ba0167a52", "attack-v19-stix-id": "attack-pattern--b4b7458f-81f2-4d38-84be-1c5ba0167a52", "attack-v18-name": "Masquerading: Invalid Code Signature", "attack-v19-name": "Masquerading: Invalid Code Signature", "attack-v19-parent-attack-id": "T1036", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1036.010": { "attack-v18-attack-id": "T1036.010", "attack-v19-attack-id": "T1036.010", "attack-v18-stix-id": "attack-pattern--d349c66e-18e1-4d8b-a2d7-65af7cbd2ba0", "attack-v19-stix-id": "attack-pattern--d349c66e-18e1-4d8b-a2d7-65af7cbd2ba0", "attack-v18-name": "Masquerading: Masquerade Account Name", "attack-v19-name": "Masquerading: Masquerade Account Name", "attack-v19-parent-attack-id": "T1036", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1036.008": { "attack-v18-attack-id": "T1036.008", "attack-v19-attack-id": "T1036.008", "attack-v18-stix-id": "attack-pattern--208884f1-7b83-4473-ac22-4e1cf6c41471", "attack-v19-stix-id": "attack-pattern--208884f1-7b83-4473-ac22-4e1cf6c41471", "attack-v18-name": "Masquerading: Masquerade File Type", "attack-v19-name": "Masquerading: Masquerade File Type", "attack-v19-parent-attack-id": "T1036", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1036.004": { "attack-v18-attack-id": "T1036.004", "attack-v19-attack-id": "T1036.004", "attack-v18-stix-id": "attack-pattern--7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", "attack-v19-stix-id": "attack-pattern--7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", "attack-v18-name": "Masquerading: Masquerade Task or Service", "attack-v19-name": "Masquerading: Masquerade Task or Service", "attack-v19-parent-attack-id": "T1036", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1036.005": { "attack-v18-attack-id": "T1036.005", "attack-v19-attack-id": "T1036.005", "attack-v18-stix-id": "attack-pattern--1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "attack-v19-stix-id": "attack-pattern--1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "attack-v18-name": "Masquerading: Match Legitimate Resource Name or Location", "attack-v19-name": "Masquerading: Match Legitimate Resource Name or Location", "attack-v19-parent-attack-id": "T1036", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1036.011": { "attack-v18-attack-id": "T1036.011", "attack-v19-attack-id": "T1036.011", "attack-v18-stix-id": "attack-pattern--514dc7b3-0b80-4382-80a9-2e2d294f5019", "attack-v19-stix-id": "attack-pattern--514dc7b3-0b80-4382-80a9-2e2d294f5019", "attack-v18-name": "Masquerading: Overwrite Process Arguments", "attack-v19-name": "Masquerading: Overwrite Process Arguments", "attack-v19-parent-attack-id": "T1036", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1036.003": { "attack-v18-attack-id": "T1036.003", "attack-v19-attack-id": "T1036.003", "attack-v18-stix-id": "attack-pattern--bd5b58a4-a52d-4a29-bc0d-3f1d3968eb6b", "attack-v19-stix-id": "attack-pattern--bd5b58a4-a52d-4a29-bc0d-3f1d3968eb6b", "attack-v18-name": "Masquerading: Rename Legitimate Utilities", "attack-v19-name": "Masquerading: Rename Legitimate Utilities", "attack-v19-parent-attack-id": "T1036", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1036.002": { "attack-v18-attack-id": "T1036.002", "attack-v19-attack-id": "T1036.002", "attack-v18-stix-id": "attack-pattern--77eae145-55db-4519-8ae5-77b0c7215d69", "attack-v19-stix-id": "attack-pattern--77eae145-55db-4519-8ae5-77b0c7215d69", "attack-v18-name": "Masquerading: Right-to-Left Override", "attack-v19-name": "Masquerading: Right-to-Left Override", "attack-v19-parent-attack-id": "T1036", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1036.006": { "attack-v18-attack-id": "T1036.006", "attack-v19-attack-id": "T1036.006", "attack-v18-stix-id": "attack-pattern--e51137a5-1cdc-499e-911a-abaedaa5ac86", "attack-v19-stix-id": "attack-pattern--e51137a5-1cdc-499e-911a-abaedaa5ac86", "attack-v18-name": "Masquerading: Space after Filename", "attack-v19-name": "Masquerading: Space after Filename", "attack-v19-parent-attack-id": "T1036", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1556": { "attack-v18-attack-id": "T1556", "attack-v19-attack-id": "T1556", "attack-v18-stix-id": "attack-pattern--f4c1826f-a322-41cd-9557-562100848c84", "attack-v19-stix-id": "attack-pattern--f4c1826f-a322-41cd-9557-562100848c84", "attack-v18-name": "Modify Authentication Process", "attack-v19-name": "Modify Authentication Process", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "credential-access", "defense-evasion", "persistence" ], "attack-v19-tactics": [ "defense-impairment", "persistence", "credential-access" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Moved to new tactic Defense Impairment, and Remains in Additional Tactic(s)" }, "T1556.009": { "attack-v18-attack-id": "T1556.009", "attack-v19-attack-id": "T1556.009", "attack-v18-stix-id": "attack-pattern--ceaeb6d8-95ee-4da2-9d42-dc6aa6ca43ae", "attack-v19-stix-id": "attack-pattern--ceaeb6d8-95ee-4da2-9d42-dc6aa6ca43ae", "attack-v18-name": "Modify Authentication Process: Conditional Access Policies", "attack-v19-name": "Modify Authentication Process: Conditional Access Policies", "attack-v19-parent-attack-id": "T1556", "attack-v18-tactics": [ "credential-access", "defense-evasion", "persistence" ], "attack-v19-tactics": [ "defense-impairment", "persistence", "credential-access" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment, and Remains in Additional Tactic(s)" }, "T1556.001": { "attack-v18-attack-id": "T1556.001", "attack-v19-attack-id": "T1556.001", "attack-v18-stix-id": "attack-pattern--d4b96d2c-1032-4b22-9235-2b5b649d0605", "attack-v19-stix-id": "attack-pattern--d4b96d2c-1032-4b22-9235-2b5b649d0605", "attack-v18-name": "Modify Authentication Process: Domain Controller Authentication", "attack-v19-name": "Modify Authentication Process: Domain Controller Authentication", "attack-v19-parent-attack-id": "T1556", "attack-v18-tactics": [ "credential-access", "defense-evasion", "persistence" ], "attack-v19-tactics": [ "defense-impairment", "persistence", "credential-access" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment, and Remains in Additional Tactic(s)" }, "T1556.007": { "attack-v18-attack-id": "T1556.007", "attack-v19-attack-id": "T1556.007", "attack-v18-stix-id": "attack-pattern--54ca26f3-c172-4231-93e5-ccebcac2161f", "attack-v19-stix-id": "attack-pattern--54ca26f3-c172-4231-93e5-ccebcac2161f", "attack-v18-name": "Modify Authentication Process: Hybrid Identity", "attack-v19-name": "Modify Authentication Process: Hybrid Identity", "attack-v19-parent-attack-id": "T1556", "attack-v18-tactics": [ "credential-access", "defense-evasion", "persistence" ], "attack-v19-tactics": [ "defense-impairment", "persistence", "credential-access" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment, and Remains in Additional Tactic(s)" }, "T1556.006": { "attack-v18-attack-id": "T1556.006", "attack-v19-attack-id": "T1556.006", "attack-v18-stix-id": "attack-pattern--b4409cd8-0da9-46e1-a401-a241afd4d1cc", "attack-v19-stix-id": "attack-pattern--b4409cd8-0da9-46e1-a401-a241afd4d1cc", "attack-v18-name": "Modify Authentication Process: Multi-Factor Authentication", "attack-v19-name": "Modify Authentication Process: Multi-Factor Authentication", "attack-v19-parent-attack-id": "T1556", "attack-v18-tactics": [ "credential-access", "defense-evasion", "persistence" ], "attack-v19-tactics": [ "defense-impairment", "persistence", "credential-access" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment, and Remains in Additional Tactic(s)" }, "T1556.004": { "attack-v18-attack-id": "T1556.004", "attack-v19-attack-id": "T1556.004", "attack-v18-stix-id": "attack-pattern--fa44a152-ac48-441e-a524-dd7b04b8adcd", "attack-v19-stix-id": "attack-pattern--fa44a152-ac48-441e-a524-dd7b04b8adcd", "attack-v18-name": "Modify Authentication Process: Network Device Authentication", "attack-v19-name": "Modify Authentication Process: Network Device Authentication", "attack-v19-parent-attack-id": "T1556", "attack-v18-tactics": [ "credential-access", "defense-evasion", "persistence" ], "attack-v19-tactics": [ "defense-impairment", "persistence", "credential-access" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment, and Remains in Additional Tactic(s)" }, "T1556.008": { "attack-v18-attack-id": "T1556.008", "attack-v19-attack-id": "T1556.008", "attack-v18-stix-id": "attack-pattern--90c4a591-d02d-490b-92aa-619d9701ac04", "attack-v19-stix-id": "attack-pattern--90c4a591-d02d-490b-92aa-619d9701ac04", "attack-v18-name": "Modify Authentication Process: Network Provider DLL", "attack-v19-name": "Modify Authentication Process: Network Provider DLL", "attack-v19-parent-attack-id": "T1556", "attack-v18-tactics": [ "credential-access", "defense-evasion", "persistence" ], "attack-v19-tactics": [ "defense-impairment", "persistence", "credential-access" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment, and Remains in Additional Tactic(s)" }, "T1556.002": { "attack-v18-attack-id": "T1556.002", "attack-v19-attack-id": "T1556.002", "attack-v18-stix-id": "attack-pattern--3731fbcd-0e43-47ae-ae6c-d15e510f0d42", "attack-v19-stix-id": "attack-pattern--3731fbcd-0e43-47ae-ae6c-d15e510f0d42", "attack-v18-name": "Modify Authentication Process: Password Filter DLL", "attack-v19-name": "Modify Authentication Process: Password Filter DLL", "attack-v19-parent-attack-id": "T1556", "attack-v18-tactics": [ "credential-access", "defense-evasion", "persistence" ], "attack-v19-tactics": [ "defense-impairment", "persistence", "credential-access" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment, and Remains in Additional Tactic(s)" }, "T1556.003": { "attack-v18-attack-id": "T1556.003", "attack-v19-attack-id": "T1556.003", "attack-v18-stix-id": "attack-pattern--06c00069-771a-4d57-8ef5-d3718c1a8771", "attack-v19-stix-id": "attack-pattern--06c00069-771a-4d57-8ef5-d3718c1a8771", "attack-v18-name": "Modify Authentication Process: Pluggable Authentication Modules", "attack-v19-name": "Modify Authentication Process: Pluggable Authentication Modules", "attack-v19-parent-attack-id": "T1556", "attack-v18-tactics": [ "credential-access", "defense-evasion", "persistence" ], "attack-v19-tactics": [ "defense-impairment", "persistence", "credential-access" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment, and Remains in Additional Tactic(s)" }, "T1556.005": { "attack-v18-attack-id": "T1556.005", "attack-v19-attack-id": "T1556.005", "attack-v18-stix-id": "attack-pattern--d50955c2-272d-4ac8-95da-10c29dda1c48", "attack-v19-stix-id": "attack-pattern--d50955c2-272d-4ac8-95da-10c29dda1c48", "attack-v18-name": "Modify Authentication Process: Reversible Encryption", "attack-v19-name": "Modify Authentication Process: Reversible Encryption", "attack-v19-parent-attack-id": "T1556", "attack-v18-tactics": [ "credential-access", "defense-evasion", "persistence" ], "attack-v19-tactics": [ "defense-impairment", "persistence", "credential-access" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment, and Remains in Additional Tactic(s)" }, "T1578": { "attack-v18-attack-id": "T1578", "attack-v19-attack-id": "T1578", "attack-v18-stix-id": "attack-pattern--144e007b-e638-431d-a894-45d90c54ab90", "attack-v19-stix-id": "attack-pattern--144e007b-e638-431d-a894-45d90c54ab90", "attack-v18-name": "Modify Cloud Compute Infrastructure", "attack-v19-name": "Modify Cloud Compute Infrastructure", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1578.002": { "attack-v18-attack-id": "T1578.002", "attack-v19-attack-id": "T1578.002", "attack-v18-stix-id": "attack-pattern--cf1c2504-433f-4c4e-a1f8-91de45a0318c", "attack-v19-stix-id": "attack-pattern--cf1c2504-433f-4c4e-a1f8-91de45a0318c", "attack-v18-name": "Modify Cloud Compute Infrastructure: Create Cloud Instance", "attack-v19-name": "Modify Cloud Compute Infrastructure: Create Cloud Instance", "attack-v19-parent-attack-id": "T1578", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1578.001": { "attack-v18-attack-id": "T1578.001", "attack-v19-attack-id": "T1578.001", "attack-v18-stix-id": "attack-pattern--ed2e45f9-d338-4eb2-8ce5-3a2e03323bc1", "attack-v19-stix-id": "attack-pattern--ed2e45f9-d338-4eb2-8ce5-3a2e03323bc1", "attack-v18-name": "Modify Cloud Compute Infrastructure: Create Snapshot", "attack-v19-name": "Modify Cloud Compute Infrastructure: Create Snapshot", "attack-v19-parent-attack-id": "T1578", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1578.003": { "attack-v18-attack-id": "T1578.003", "attack-v19-attack-id": "T1578.003", "attack-v18-stix-id": "attack-pattern--70857657-bd0b-4695-ad3e-b13f92cac1b4", "attack-v19-stix-id": "attack-pattern--70857657-bd0b-4695-ad3e-b13f92cac1b4", "attack-v18-name": "Modify Cloud Compute Infrastructure: Delete Cloud Instance", "attack-v19-name": "Modify Cloud Compute Infrastructure: Delete Cloud Instance", "attack-v19-parent-attack-id": "T1578", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1578.005": { "attack-v18-attack-id": "T1578.005", "attack-v19-attack-id": "T1578.005", "attack-v18-stix-id": "attack-pattern--ca00366b-83a1-4c7b-a0ce-8ff950a7c87f", "attack-v19-stix-id": "attack-pattern--ca00366b-83a1-4c7b-a0ce-8ff950a7c87f", "attack-v18-name": "Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations", "attack-v19-name": "Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations", "attack-v19-parent-attack-id": "T1578", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1578.004": { "attack-v18-attack-id": "T1578.004", "attack-v19-attack-id": "T1578.004", "attack-v18-stix-id": "attack-pattern--0708ae90-d0eb-4938-9a76-d0fc94f6eec1", "attack-v19-stix-id": "attack-pattern--0708ae90-d0eb-4938-9a76-d0fc94f6eec1", "attack-v18-name": "Modify Cloud Compute Infrastructure: Revert Cloud Instance", "attack-v19-name": "Modify Cloud Compute Infrastructure: Revert Cloud Instance", "attack-v19-parent-attack-id": "T1578", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1666": { "attack-v18-attack-id": "T1666", "attack-v19-attack-id": "T1666", "attack-v18-stix-id": "attack-pattern--0ce73446-8722-4086-9d43-514f1d0f669e", "attack-v19-stix-id": "attack-pattern--0ce73446-8722-4086-9d43-514f1d0f669e", "attack-v18-name": "Modify Cloud Resource Hierarchy", "attack-v19-name": "Modify Cloud Resource Hierarchy", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1112": { "attack-v18-attack-id": "T1112", "attack-v19-attack-id": "T1112", "attack-v18-stix-id": "attack-pattern--57340c81-c025-4189-8fa0-fc7ede51bae4", "attack-v19-stix-id": "attack-pattern--57340c81-c025-4189-8fa0-fc7ede51bae4", "attack-v18-name": "Modify Registry", "attack-v19-name": "Modify Registry", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion", "persistence" ], "attack-v19-tactics": [ "defense-impairment", "persistence" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Moved to new tactic Defense Impairment, and Remains in Additional Tactic(s)" }, "T1601": { "attack-v18-attack-id": "T1601", "attack-v19-attack-id": "T1601", "attack-v18-stix-id": "attack-pattern--ae7f3575-0a5e-427e-991b-fe03ad44c754", "attack-v19-stix-id": "attack-pattern--ae7f3575-0a5e-427e-991b-fe03ad44c754", "attack-v18-name": "Modify System Image", "attack-v19-name": "Modify System Image", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1601.002": { "attack-v18-attack-id": "T1601.002", "attack-v19-attack-id": "T1601.002", "attack-v18-stix-id": "attack-pattern--fc74ba38-dc98-461f-8611-b3dbf9978e3d", "attack-v19-stix-id": "attack-pattern--fc74ba38-dc98-461f-8611-b3dbf9978e3d", "attack-v18-name": "Modify System Image: Downgrade System Image", "attack-v19-name": "Modify System Image: Downgrade System Image", "attack-v19-parent-attack-id": "T1601", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1601.001": { "attack-v18-attack-id": "T1601.001", "attack-v19-attack-id": "T1601.001", "attack-v18-stix-id": "attack-pattern--d245808a-7086-4310-984a-a84aaaa43f8f", "attack-v19-stix-id": "attack-pattern--d245808a-7086-4310-984a-a84aaaa43f8f", "attack-v18-name": "Modify System Image: Patch System Image", "attack-v19-name": "Modify System Image: Patch System Image", "attack-v19-parent-attack-id": "T1601", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1599": { "attack-v18-attack-id": "T1599", "attack-v19-attack-id": "T1599", "attack-v18-stix-id": "attack-pattern--b8017880-4b1e-42de-ad10-ae7ac6705166", "attack-v19-stix-id": "attack-pattern--b8017880-4b1e-42de-ad10-ae7ac6705166", "attack-v18-name": "Network Boundary Bridging", "attack-v19-name": "Network Boundary Bridging", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1599.001": { "attack-v18-attack-id": "T1599.001", "attack-v19-attack-id": "T1599.001", "attack-v18-stix-id": "attack-pattern--4ffc1794-ec3b-45be-9e52-42dbcb2af2de", "attack-v19-stix-id": "attack-pattern--4ffc1794-ec3b-45be-9e52-42dbcb2af2de", "attack-v18-name": "Network Boundary Bridging: Network Address Translation Traversal", "attack-v19-name": "Network Boundary Bridging: Network Address Translation Traversal", "attack-v19-parent-attack-id": "T1599", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1027": { "attack-v18-attack-id": "T1027", "attack-v19-attack-id": "T1027", "attack-v18-stix-id": "attack-pattern--b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", "attack-v19-stix-id": "attack-pattern--b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", "attack-v18-name": "Obfuscated Files or Information", "attack-v19-name": "Obfuscated Files or Information", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1027.002": { "attack-v18-attack-id": "T1027.002", "attack-v19-attack-id": "T1027.002", "attack-v18-stix-id": "attack-pattern--deb98323-e13f-4b0c-8d94-175379069062", "attack-v19-stix-id": "attack-pattern--deb98323-e13f-4b0c-8d94-175379069062", "attack-v18-name": "Obfuscated Files or Information: Software Packing", "attack-v19-name": "Obfuscated Files or Information: Software Packing", "attack-v19-parent-attack-id": "T1027", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1027.001": { "attack-v18-attack-id": "T1027.001", "attack-v19-attack-id": "T1027.001", "attack-v18-stix-id": "attack-pattern--5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", "attack-v19-stix-id": "attack-pattern--5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", "attack-v18-name": "Obfuscated Files or Information: Binary Padding", "attack-v19-name": "Obfuscated Files or Information: Binary Padding", "attack-v19-parent-attack-id": "T1027", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1027.010": { "attack-v18-attack-id": "T1027.010", "attack-v19-attack-id": "T1027.010", "attack-v18-stix-id": "attack-pattern--d511a6f6-4a33-41d5-bc95-c343875d1377", "attack-v19-stix-id": "attack-pattern--d511a6f6-4a33-41d5-bc95-c343875d1377", "attack-v18-name": "Obfuscated Files or Information: Command Obfuscation", "attack-v19-name": "Obfuscated Files or Information: Command Obfuscation", "attack-v19-parent-attack-id": "T1027", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1027.004": { "attack-v18-attack-id": "T1027.004", "attack-v19-attack-id": "T1027.004", "attack-v18-stix-id": "attack-pattern--c726e0a2-a57a-4b7b-a973-d0f013246617", "attack-v19-stix-id": "attack-pattern--c726e0a2-a57a-4b7b-a973-d0f013246617", "attack-v18-name": "Obfuscated Files or Information: Compile After Delivery", "attack-v19-name": "Obfuscated Files or Information: Compile After Delivery", "attack-v19-parent-attack-id": "T1027", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1027.015": { "attack-v18-attack-id": "T1027.015", "attack-v19-attack-id": "T1027.015", "attack-v18-stix-id": "attack-pattern--fbd91bfc-75c2-4f0c-8116-3b4e722906b3", "attack-v19-stix-id": "attack-pattern--fbd91bfc-75c2-4f0c-8116-3b4e722906b3", "attack-v18-name": "Obfuscated Files or Information: Compression", "attack-v19-name": "Obfuscated Files or Information: Compression", "attack-v19-parent-attack-id": "T1027", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1027.007": { "attack-v18-attack-id": "T1027.007", "attack-v19-attack-id": "T1027.007", "attack-v18-stix-id": "attack-pattern--ea4c2f9c-9df1-477c-8c42-6da1118f2ac4", "attack-v19-stix-id": "attack-pattern--ea4c2f9c-9df1-477c-8c42-6da1118f2ac4", "attack-v18-name": "Obfuscated Files or Information: Dynamic API Resolution", "attack-v19-name": "Obfuscated Files or Information: Dynamic API Resolution", "attack-v19-parent-attack-id": "T1027", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1027.009": { "attack-v18-attack-id": "T1027.009", "attack-v19-attack-id": "T1027.009", "attack-v18-stix-id": "attack-pattern--0533ab23-3f7d-463f-9bd8-634d27e4dee1", "attack-v19-stix-id": "attack-pattern--0533ab23-3f7d-463f-9bd8-634d27e4dee1", "attack-v18-name": "Obfuscated Files or Information: Embedded Payloads", "attack-v19-name": "Obfuscated Files or Information: Embedded Payloads", "attack-v19-parent-attack-id": "T1027", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1027.013": { "attack-v18-attack-id": "T1027.013", "attack-v19-attack-id": "T1027.013", "attack-v18-stix-id": "attack-pattern--0d91b3c0-5e50-47c3-949a-2a796f04d144", "attack-v19-stix-id": "attack-pattern--0d91b3c0-5e50-47c3-949a-2a796f04d144", "attack-v18-name": "Obfuscated Files or Information: Encrypted/Encoded File", "attack-v19-name": "Obfuscated Files or Information: Encrypted/Encoded File", "attack-v19-parent-attack-id": "T1027", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1027.011": { "attack-v18-attack-id": "T1027.011", "attack-v19-attack-id": "T1027.011", "attack-v18-stix-id": "attack-pattern--02c5abff-30bf-4703-ab92-1f6072fae939", "attack-v19-stix-id": "attack-pattern--02c5abff-30bf-4703-ab92-1f6072fae939", "attack-v18-name": "Obfuscated Files or Information: Fileless Storage", "attack-v19-name": "Obfuscated Files or Information: Fileless Storage", "attack-v19-parent-attack-id": "T1027", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1027.006": { "attack-v18-attack-id": "T1027.006", "attack-v19-attack-id": "T1027.006", "attack-v18-stix-id": "attack-pattern--d4dc46e3-5ba5-45b9-8204-010867cacfcb", "attack-v19-stix-id": "attack-pattern--d4dc46e3-5ba5-45b9-8204-010867cacfcb", "attack-v18-name": "Obfuscated Files or Information: HTML Smuggling", "attack-v19-name": "Obfuscated Files or Information: HTML Smuggling", "attack-v19-parent-attack-id": "T1027", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1027.005": { "attack-v18-attack-id": "T1027.005", "attack-v19-attack-id": "T1027.005", "attack-v18-stix-id": "attack-pattern--b0533c6e-8fea-4788-874f-b799cacc4b92", "attack-v19-stix-id": "attack-pattern--b0533c6e-8fea-4788-874f-b799cacc4b92", "attack-v18-name": "Obfuscated Files or Information: Indicator Removal from Tools", "attack-v19-name": "Obfuscated Files or Information: Indicator Removal from Tools", "attack-v19-parent-attack-id": "T1027", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1027.016": { "attack-v18-attack-id": "T1027.016", "attack-v19-attack-id": "T1027.016", "attack-v18-stix-id": "attack-pattern--671cd17f-a765-48fd-adc4-dad1941b1ae3", "attack-v19-stix-id": "attack-pattern--671cd17f-a765-48fd-adc4-dad1941b1ae3", "attack-v18-name": "Obfuscated Files or Information: Junk Code Insertion", "attack-v19-name": "Obfuscated Files or Information: Junk Code Insertion", "attack-v19-parent-attack-id": "T1027", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1027.012": { "attack-v18-attack-id": "T1027.012", "attack-v19-attack-id": "T1027.012", "attack-v18-stix-id": "attack-pattern--887274fc-2d63-4bdc-82f3-fae56d1d5fdc", "attack-v19-stix-id": "attack-pattern--887274fc-2d63-4bdc-82f3-fae56d1d5fdc", "attack-v18-name": "Obfuscated Files or Information: LNK Icon Smuggling", "attack-v19-name": "Obfuscated Files or Information: LNK Icon Smuggling", "attack-v19-parent-attack-id": "T1027", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1027.014": { "attack-v18-attack-id": "T1027.014", "attack-v19-attack-id": "T1027.014", "attack-v18-stix-id": "attack-pattern--b577dfc1-0177-4522-8d5a-782127c8592b", "attack-v19-stix-id": "attack-pattern--b577dfc1-0177-4522-8d5a-782127c8592b", "attack-v18-name": "Obfuscated Files or Information: Polymorphic Code", "attack-v19-name": "Obfuscated Files or Information: Polymorphic Code", "attack-v19-parent-attack-id": "T1027", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1027.003": { "attack-v18-attack-id": "T1027.003", "attack-v19-attack-id": "T1027.003", "attack-v18-stix-id": "attack-pattern--c2e147a9-d1a8-4074-811a-d8789202d916", "attack-v19-stix-id": "attack-pattern--c2e147a9-d1a8-4074-811a-d8789202d916", "attack-v18-name": "Obfuscated Files or Information: Steganography", "attack-v19-name": "Obfuscated Files or Information: Steganography", "attack-v19-parent-attack-id": "T1027", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1027.008": { "attack-v18-attack-id": "T1027.008", "attack-v19-attack-id": "T1027.008", "attack-v18-stix-id": "attack-pattern--2f41939b-54c3-41d6-8f8b-35f1ec18ed97", "attack-v19-stix-id": "attack-pattern--2f41939b-54c3-41d6-8f8b-35f1ec18ed97", "attack-v18-name": "Obfuscated Files or Information: Stripped Payloads", "attack-v19-name": "Obfuscated Files or Information: Stripped Payloads", "attack-v19-parent-attack-id": "T1027", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1027.017": { "attack-v18-attack-id": "T1027.017", "attack-v19-attack-id": "T1027.017", "attack-v18-stix-id": "attack-pattern--78b9e70d-1605-459c-b23d-e3a25036968c", "attack-v19-stix-id": "attack-pattern--78b9e70d-1605-459c-b23d-e3a25036968c", "attack-v18-name": "Obfuscated Files or Information: SVG Smuggling", "attack-v19-name": "Obfuscated Files or Information: SVG Smuggling", "attack-v19-parent-attack-id": "T1027", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1647": { "attack-v18-attack-id": "T1647", "attack-v19-attack-id": "T1647", "attack-v18-stix-id": "attack-pattern--7d20fff9-8751-404e-badd-ccd71bda0236", "attack-v19-stix-id": "attack-pattern--7d20fff9-8751-404e-badd-ccd71bda0236", "attack-v18-name": "Plist File Modification", "attack-v19-name": "Plist File Modification", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1542": { "attack-v18-attack-id": "T1542", "attack-v19-attack-id": "T1542", "attack-v18-stix-id": "attack-pattern--7f0ca133-88c4-40c6-a62f-b3083a7fbc2e", "attack-v19-stix-id": "attack-pattern--7f0ca133-88c4-40c6-a62f-b3083a7fbc2e", "attack-v18-name": "Pre-OS Boot", "attack-v19-name": "Pre-OS Boot", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion", "persistence" ], "attack-v19-tactics": [ "stealth", "persistence" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1542.003": { "attack-v18-attack-id": "T1542.003", "attack-v19-attack-id": "T1542.003", "attack-v18-stix-id": "attack-pattern--1b7b1806-7746-41a1-a35d-e48dae25ddba", "attack-v19-stix-id": "attack-pattern--1b7b1806-7746-41a1-a35d-e48dae25ddba", "attack-v18-name": "Pre-OS Boot: Bootkit", "attack-v19-name": "Pre-OS Boot: Bootkit", "attack-v19-parent-attack-id": "T1542", "attack-v18-tactics": [ "defense-evasion", "persistence" ], "attack-v19-tactics": [ "stealth", "persistence" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1542.002": { "attack-v18-attack-id": "T1542.002", "attack-v19-attack-id": "T1542.002", "attack-v18-stix-id": "attack-pattern--791481f8-e96a-41be-b089-a088763083d4", "attack-v19-stix-id": "attack-pattern--791481f8-e96a-41be-b089-a088763083d4", "attack-v18-name": "Pre-OS Boot: Component Firmware", "attack-v19-name": "Pre-OS Boot: Component Firmware", "attack-v19-parent-attack-id": "T1542", "attack-v18-tactics": [ "defense-evasion", "persistence" ], "attack-v19-tactics": [ "stealth", "persistence" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1542.004": { "attack-v18-attack-id": "T1542.004", "attack-v19-attack-id": "T1542.004", "attack-v18-stix-id": "attack-pattern--a6557c75-798f-42e4-be70-ab4502e0a3bc", "attack-v19-stix-id": "attack-pattern--a6557c75-798f-42e4-be70-ab4502e0a3bc", "attack-v18-name": "Pre-OS Boot: ROMMONkit", "attack-v19-name": "Pre-OS Boot: ROMMONkit", "attack-v19-parent-attack-id": "T1542", "attack-v18-tactics": [ "defense-evasion", "persistence" ], "attack-v19-tactics": [ "stealth", "persistence" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1542.001": { "attack-v18-attack-id": "T1542.001", "attack-v19-attack-id": "T1542.001", "attack-v18-stix-id": "attack-pattern--16ab6452-c3c1-497c-a47d-206018ca1ada", "attack-v19-stix-id": "attack-pattern--16ab6452-c3c1-497c-a47d-206018ca1ada", "attack-v18-name": "Pre-OS Boot: System Firmware", "attack-v19-name": "Pre-OS Boot: System Firmware", "attack-v19-parent-attack-id": "T1542", "attack-v18-tactics": [ "defense-evasion", "persistence" ], "attack-v19-tactics": [ "stealth", "persistence" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1542.005": { "attack-v18-attack-id": "T1542.005", "attack-v19-attack-id": "T1542.005", "attack-v18-stix-id": "attack-pattern--28abec6c-4443-4b03-8206-07f2e264a6b4", "attack-v19-stix-id": "attack-pattern--28abec6c-4443-4b03-8206-07f2e264a6b4", "attack-v18-name": "Pre-OS Boot: TFTP Boot", "attack-v19-name": "Pre-OS Boot: TFTP Boot", "attack-v19-parent-attack-id": "T1542", "attack-v18-tactics": [ "defense-evasion", "persistence" ], "attack-v19-tactics": [ "stealth", "persistence" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1055": { "attack-v18-attack-id": "T1055", "attack-v19-attack-id": "T1055", "attack-v18-stix-id": "attack-pattern--43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", "attack-v19-stix-id": "attack-pattern--43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", "attack-v18-name": "Process Injection", "attack-v19-name": "Process Injection", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1055.004": { "attack-v18-attack-id": "T1055.004", "attack-v19-attack-id": "T1055.004", "attack-v18-stix-id": "attack-pattern--7c0f17c9-1af6-4628-9cbd-9e45482dd605", "attack-v19-stix-id": "attack-pattern--7c0f17c9-1af6-4628-9cbd-9e45482dd605", "attack-v18-name": "Process Injection: Asynchronous Procedure Call", "attack-v19-name": "Process Injection: Asynchronous Procedure Call", "attack-v19-parent-attack-id": "T1055", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1055.001": { "attack-v18-attack-id": "T1055.001", "attack-v19-attack-id": "T1055.001", "attack-v18-stix-id": "attack-pattern--f4599aa0-4f85-4a32-80ea-fc39dc965945", "attack-v19-stix-id": "attack-pattern--f4599aa0-4f85-4a32-80ea-fc39dc965945", "attack-v18-name": "Process Injection: Dynamic-link Library Injection", "attack-v19-name": "Process Injection: Dynamic-link Library Injection", "attack-v19-parent-attack-id": "T1055", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1055.011": { "attack-v18-attack-id": "T1055.011", "attack-v19-attack-id": "T1055.011", "attack-v18-stix-id": "attack-pattern--0042a9f5-f053-4769-b3ef-9ad018dfa298", "attack-v19-stix-id": "attack-pattern--0042a9f5-f053-4769-b3ef-9ad018dfa298", "attack-v18-name": "Process Injection: Extra Window Memory Injection", "attack-v19-name": "Process Injection: Extra Window Memory Injection", "attack-v19-parent-attack-id": "T1055", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1055.015": { "attack-v18-attack-id": "T1055.015", "attack-v19-attack-id": "T1055.015", "attack-v18-stix-id": "attack-pattern--eb2cb5cb-ae87-4de0-8c35-da2a17aafb99", "attack-v19-stix-id": "attack-pattern--eb2cb5cb-ae87-4de0-8c35-da2a17aafb99", "attack-v18-name": "Process Injection: ListPlanting", "attack-v19-name": "Process Injection: ListPlanting", "attack-v19-parent-attack-id": "T1055", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1055.002": { "attack-v18-attack-id": "T1055.002", "attack-v19-attack-id": "T1055.002", "attack-v18-stix-id": "attack-pattern--806a49c4-970d-43f9-9acc-ac0ee11e6662", "attack-v19-stix-id": "attack-pattern--806a49c4-970d-43f9-9acc-ac0ee11e6662", "attack-v18-name": "Process Injection: Portable Executable Injection", "attack-v19-name": "Process Injection: Portable Executable Injection", "attack-v19-parent-attack-id": "T1055", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1055.009": { "attack-v18-attack-id": "T1055.009", "attack-v19-attack-id": "T1055.009", "attack-v18-stix-id": "attack-pattern--d201d4cc-214d-4a74-a1ba-b3fa09fd4591", "attack-v19-stix-id": "attack-pattern--d201d4cc-214d-4a74-a1ba-b3fa09fd4591", "attack-v18-name": "Process Injection: Proc Memory", "attack-v19-name": "Process Injection: Proc Memory", "attack-v19-parent-attack-id": "T1055", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1055.013": { "attack-v18-attack-id": "T1055.013", "attack-v19-attack-id": "T1055.013", "attack-v18-stix-id": "attack-pattern--7007935a-a8a7-4c0b-bd98-4e85be8ed197", "attack-v19-stix-id": "attack-pattern--7007935a-a8a7-4c0b-bd98-4e85be8ed197", "attack-v18-name": "Process Injection: Process Doppelg\u00e4nging", "attack-v19-name": "Process Injection: Process Doppelg\u00e4nging", "attack-v19-parent-attack-id": "T1055", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1055.012": { "attack-v18-attack-id": "T1055.012", "attack-v19-attack-id": "T1055.012", "attack-v18-stix-id": "attack-pattern--b200542e-e877-4395-875b-cf1a44537ca4", "attack-v19-stix-id": "attack-pattern--b200542e-e877-4395-875b-cf1a44537ca4", "attack-v18-name": "Process Injection: Process Hollowing", "attack-v19-name": "Process Injection: Process Hollowing", "attack-v19-parent-attack-id": "T1055", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1055.008": { "attack-v18-attack-id": "T1055.008", "attack-v19-attack-id": "T1055.008", "attack-v18-stix-id": "attack-pattern--ea016b56-ae0e-47fe-967a-cc0ad51af67f", "attack-v19-stix-id": "attack-pattern--ea016b56-ae0e-47fe-967a-cc0ad51af67f", "attack-v18-name": "Process Injection: Ptrace System Calls", "attack-v19-name": "Process Injection: Ptrace System Calls", "attack-v19-parent-attack-id": "T1055", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1055.003": { "attack-v18-attack-id": "T1055.003", "attack-v19-attack-id": "T1055.003", "attack-v18-stix-id": "attack-pattern--41d9846c-f6af-4302-a654-24bba2729bc6", "attack-v19-stix-id": "attack-pattern--41d9846c-f6af-4302-a654-24bba2729bc6", "attack-v18-name": "Process Injection: Thread Execution Hijacking", "attack-v19-name": "Process Injection: Thread Execution Hijacking", "attack-v19-parent-attack-id": "T1055", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1055.005": { "attack-v18-attack-id": "T1055.005", "attack-v19-attack-id": "T1055.005", "attack-v18-stix-id": "attack-pattern--e49ee9d2-0d98-44ef-85e5-5d3100065744", "attack-v19-stix-id": "attack-pattern--e49ee9d2-0d98-44ef-85e5-5d3100065744", "attack-v18-name": "Process Injection: Thread Local Storage", "attack-v19-name": "Process Injection: Thread Local Storage", "attack-v19-parent-attack-id": "T1055", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1055.014": { "attack-v18-attack-id": "T1055.014", "attack-v19-attack-id": "T1055.014", "attack-v18-stix-id": "attack-pattern--98be40f2-c86b-4ade-b6fc-4964932040e5", "attack-v19-stix-id": "attack-pattern--98be40f2-c86b-4ade-b6fc-4964932040e5", "attack-v18-name": "Process Injection: VDSO Hijacking", "attack-v19-name": "Process Injection: VDSO Hijacking", "attack-v19-parent-attack-id": "T1055", "attack-v18-tactics": [ "defense-evasion", "privilege-escalation" ], "attack-v19-tactics": [ "stealth", "privilege-escalation" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1620": { "attack-v18-attack-id": "T1620", "attack-v19-attack-id": "T1620", "attack-v18-stix-id": "attack-pattern--4933e63b-9b77-476e-ab29-761bc5b7d15a", "attack-v19-stix-id": "attack-pattern--4933e63b-9b77-476e-ab29-761bc5b7d15a", "attack-v18-name": "Reflective Code Loading", "attack-v19-name": "Reflective Code Loading", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1207": { "attack-v18-attack-id": "T1207", "attack-v19-attack-id": "T1207", "attack-v18-stix-id": "attack-pattern--564998d8-ab3e-4123-93fb-eccaa6b9714a", "attack-v19-stix-id": "attack-pattern--564998d8-ab3e-4123-93fb-eccaa6b9714a", "attack-v18-name": "Rogue Domain Controller", "attack-v19-name": "Rogue Domain Controller", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1014": { "attack-v18-attack-id": "T1014", "attack-v19-attack-id": "T1014", "attack-v18-stix-id": "attack-pattern--0f20e3cb-245b-4a61-8a91-2d93f7cb0e9b", "attack-v19-stix-id": "attack-pattern--0f20e3cb-245b-4a61-8a91-2d93f7cb0e9b", "attack-v18-name": "Rootkit", "attack-v19-name": "Rootkit", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1679": { "attack-v18-attack-id": "T1679", "attack-v19-attack-id": "T1679", "attack-v18-stix-id": "attack-pattern--9b00925a-7c4b-4e53-bfc8-9a6a806fde03", "attack-v19-stix-id": "attack-pattern--9b00925a-7c4b-4e53-bfc8-9a6a806fde03", "attack-v18-name": "Selective Exclusion", "attack-v19-name": "Selective Exclusion", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1553": { "attack-v18-attack-id": "T1553", "attack-v19-attack-id": "T1553", "attack-v18-stix-id": "attack-pattern--b83e166d-13d7-4b52-8677-dff90c548fd7", "attack-v19-stix-id": "attack-pattern--b83e166d-13d7-4b52-8677-dff90c548fd7", "attack-v18-name": "Subvert Trust Controls", "attack-v19-name": "Subvert Trust Controls", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1553.002": { "attack-v18-attack-id": "T1553.002", "attack-v19-attack-id": "T1553.002", "attack-v18-stix-id": "attack-pattern--32901740-b42c-4fdd-bc02-345b5dc57082", "attack-v19-stix-id": "attack-pattern--32901740-b42c-4fdd-bc02-345b5dc57082", "attack-v18-name": "Subvert Trust Controls: Code Signing", "attack-v19-name": "Subvert Trust Controls: Code Signing", "attack-v19-parent-attack-id": "T1553", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1553.006": { "attack-v18-attack-id": "T1553.006", "attack-v19-attack-id": "T1553.006", "attack-v18-stix-id": "attack-pattern--565275d5-fcc3-4b66-b4e7-928e4cac6b8c", "attack-v19-stix-id": "attack-pattern--565275d5-fcc3-4b66-b4e7-928e4cac6b8c", "attack-v18-name": "Subvert Trust Controls: Code Signing Policy Modification", "attack-v19-name": "Subvert Trust Controls: Code Signing Policy Modification", "attack-v19-parent-attack-id": "T1553", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1553.001": { "attack-v18-attack-id": "T1553.001", "attack-v19-attack-id": "T1553.001", "attack-v18-stix-id": "attack-pattern--31a0a2ac-c67c-4a7e-b9ed-6a96477d4e8e", "attack-v19-stix-id": "attack-pattern--31a0a2ac-c67c-4a7e-b9ed-6a96477d4e8e", "attack-v18-name": "Subvert Trust Controls: Gatekeeper Bypass", "attack-v19-name": "Subvert Trust Controls: Gatekeeper Bypass", "attack-v19-parent-attack-id": "T1553", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1553.004": { "attack-v18-attack-id": "T1553.004", "attack-v19-attack-id": "T1553.004", "attack-v18-stix-id": "attack-pattern--c615231b-f253-4f58-9d47-d5b4cbdb6839", "attack-v19-stix-id": "attack-pattern--c615231b-f253-4f58-9d47-d5b4cbdb6839", "attack-v18-name": "Subvert Trust Controls: Install Root Certificate", "attack-v19-name": "Subvert Trust Controls: Install Root Certificate", "attack-v19-parent-attack-id": "T1553", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1553.005": { "attack-v18-attack-id": "T1553.005", "attack-v19-attack-id": "T1553.005", "attack-v18-stix-id": "attack-pattern--7e7c2fba-7cca-486c-9582-4c1bb2851961", "attack-v19-stix-id": "attack-pattern--7e7c2fba-7cca-486c-9582-4c1bb2851961", "attack-v18-name": "Subvert Trust Controls: Mark-of-the-Web Bypass", "attack-v19-name": "Subvert Trust Controls: Mark-of-the-Web Bypass", "attack-v19-parent-attack-id": "T1553", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1553.003": { "attack-v18-attack-id": "T1553.003", "attack-v19-attack-id": "T1553.003", "attack-v18-stix-id": "attack-pattern--543fceb5-cb92-40cb-aacf-6913d4db58bc", "attack-v19-stix-id": "attack-pattern--543fceb5-cb92-40cb-aacf-6913d4db58bc", "attack-v18-name": "Subvert Trust Controls: SIP and Trust Provider Hijacking", "attack-v19-name": "Subvert Trust Controls: SIP and Trust Provider Hijacking", "attack-v19-parent-attack-id": "T1553", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1218": { "attack-v18-attack-id": "T1218", "attack-v19-attack-id": "T1218", "attack-v18-stix-id": "attack-pattern--457c7820-d331-465a-915e-42f85500ccc4", "attack-v19-stix-id": "attack-pattern--457c7820-d331-465a-915e-42f85500ccc4", "attack-v18-name": "System Binary Proxy Execution", "attack-v19-name": "System Binary Proxy Execution", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1218.003": { "attack-v18-attack-id": "T1218.003", "attack-v19-attack-id": "T1218.003", "attack-v18-stix-id": "attack-pattern--4cbc6a62-9e34-4f94-8a19-5c1a11392a49", "attack-v19-stix-id": "attack-pattern--4cbc6a62-9e34-4f94-8a19-5c1a11392a49", "attack-v18-name": "System Binary Proxy Execution: CMSTP", "attack-v19-name": "System Binary Proxy Execution: CMSTP", "attack-v19-parent-attack-id": "T1218", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1218.001": { "attack-v18-attack-id": "T1218.001", "attack-v19-attack-id": "T1218.001", "attack-v18-stix-id": "attack-pattern--a6937325-9321-4e2e-bb2b-3ed2d40b2a9d", "attack-v19-stix-id": "attack-pattern--a6937325-9321-4e2e-bb2b-3ed2d40b2a9d", "attack-v18-name": "System Binary Proxy Execution: Compiled HTML File", "attack-v19-name": "System Binary Proxy Execution: Compiled HTML File", "attack-v19-parent-attack-id": "T1218", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1218.002": { "attack-v18-attack-id": "T1218.002", "attack-v19-attack-id": "T1218.002", "attack-v18-stix-id": "attack-pattern--4ff5d6a8-c062-4c68-a778-36fc5edd564f", "attack-v19-stix-id": "attack-pattern--4ff5d6a8-c062-4c68-a778-36fc5edd564f", "attack-v18-name": "System Binary Proxy Execution: Control Panel", "attack-v19-name": "System Binary Proxy Execution: Control Panel", "attack-v19-parent-attack-id": "T1218", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1218.015": { "attack-v18-attack-id": "T1218.015", "attack-v19-attack-id": "T1218.015", "attack-v18-stix-id": "attack-pattern--561ae9aa-c28a-4144-9eec-e7027a14c8c3", "attack-v19-stix-id": "attack-pattern--561ae9aa-c28a-4144-9eec-e7027a14c8c3", "attack-v18-name": "System Binary Proxy Execution: Electron Applications", "attack-v19-name": "System Binary Proxy Execution: Electron Applications", "attack-v19-parent-attack-id": "T1218", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1218.004": { "attack-v18-attack-id": "T1218.004", "attack-v19-attack-id": "T1218.004", "attack-v18-stix-id": "attack-pattern--2cd950a6-16c4-404a-aa01-044322395107", "attack-v19-stix-id": "attack-pattern--2cd950a6-16c4-404a-aa01-044322395107", "attack-v18-name": "System Binary Proxy Execution: InstallUtil", "attack-v19-name": "System Binary Proxy Execution: InstallUtil", "attack-v19-parent-attack-id": "T1218", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1218.013": { "attack-v18-attack-id": "T1218.013", "attack-v19-attack-id": "T1218.013", "attack-v18-stix-id": "attack-pattern--1bae753e-8e52-4055-a66d-2ead90303ca9", "attack-v19-stix-id": "attack-pattern--1bae753e-8e52-4055-a66d-2ead90303ca9", "attack-v18-name": "System Binary Proxy Execution: Mavinject", "attack-v19-name": "System Binary Proxy Execution: Mavinject", "attack-v19-parent-attack-id": "T1218", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1218.014": { "attack-v18-attack-id": "T1218.014", "attack-v19-attack-id": "T1218.014", "attack-v18-stix-id": "attack-pattern--ffbcfdb0-de22-4106-9ed3-fc23c8a01407", "attack-v19-stix-id": "attack-pattern--ffbcfdb0-de22-4106-9ed3-fc23c8a01407", "attack-v18-name": "System Binary Proxy Execution: MMC", "attack-v19-name": "System Binary Proxy Execution: MMC", "attack-v19-parent-attack-id": "T1218", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1218.005": { "attack-v18-attack-id": "T1218.005", "attack-v19-attack-id": "T1218.005", "attack-v18-stix-id": "attack-pattern--840a987a-99bd-4a80-a5c9-0cb2baa6cade", "attack-v19-stix-id": "attack-pattern--840a987a-99bd-4a80-a5c9-0cb2baa6cade", "attack-v18-name": "System Binary Proxy Execution: Mshta", "attack-v19-name": "System Binary Proxy Execution: Mshta", "attack-v19-parent-attack-id": "T1218", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1218.007": { "attack-v18-attack-id": "T1218.007", "attack-v19-attack-id": "T1218.007", "attack-v18-stix-id": "attack-pattern--365be77f-fc0e-42ee-bac8-4faf806d9336", "attack-v19-stix-id": "attack-pattern--365be77f-fc0e-42ee-bac8-4faf806d9336", "attack-v18-name": "System Binary Proxy Execution: Msiexec", "attack-v19-name": "System Binary Proxy Execution: Msiexec", "attack-v19-parent-attack-id": "T1218", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1218.008": { "attack-v18-attack-id": "T1218.008", "attack-v19-attack-id": "T1218.008", "attack-v18-stix-id": "attack-pattern--6e3bd510-6b33-41a4-af80-2d80f3ee0071", "attack-v19-stix-id": "attack-pattern--6e3bd510-6b33-41a4-af80-2d80f3ee0071", "attack-v18-name": "System Binary Proxy Execution: Odbcconf", "attack-v19-name": "System Binary Proxy Execution: Odbcconf", "attack-v19-parent-attack-id": "T1218", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1218.009": { "attack-v18-attack-id": "T1218.009", "attack-v19-attack-id": "T1218.009", "attack-v18-stix-id": "attack-pattern--c48a67ee-b657-45c1-91bf-6cdbe27205f8", "attack-v19-stix-id": "attack-pattern--c48a67ee-b657-45c1-91bf-6cdbe27205f8", "attack-v18-name": "System Binary Proxy Execution: Regsvcs/Regasm", "attack-v19-name": "System Binary Proxy Execution: Regsvcs/Regasm", "attack-v19-parent-attack-id": "T1218", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1218.010": { "attack-v18-attack-id": "T1218.010", "attack-v19-attack-id": "T1218.010", "attack-v18-stix-id": "attack-pattern--b97f1d35-4249-4486-a6b5-ee60ccf24fab", "attack-v19-stix-id": "attack-pattern--b97f1d35-4249-4486-a6b5-ee60ccf24fab", "attack-v18-name": "System Binary Proxy Execution: Regsvr32", "attack-v19-name": "System Binary Proxy Execution: Regsvr32", "attack-v19-parent-attack-id": "T1218", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1218.011": { "attack-v18-attack-id": "T1218.011", "attack-v19-attack-id": "T1218.011", "attack-v18-stix-id": "attack-pattern--045d0922-2310-4e60-b5e4-3302302cb3c5", "attack-v19-stix-id": "attack-pattern--045d0922-2310-4e60-b5e4-3302302cb3c5", "attack-v18-name": "System Binary Proxy Execution: Rundll32", "attack-v19-name": "System Binary Proxy Execution: Rundll32", "attack-v19-parent-attack-id": "T1218", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1218.012": { "attack-v18-attack-id": "T1218.012", "attack-v19-attack-id": "T1218.012", "attack-v18-stix-id": "attack-pattern--808e6329-ca91-4b87-ac2d-8eadc5f8f327", "attack-v19-stix-id": "attack-pattern--808e6329-ca91-4b87-ac2d-8eadc5f8f327", "attack-v18-name": "System Binary Proxy Execution: Verclsid", "attack-v19-name": "System Binary Proxy Execution: Verclsid", "attack-v19-parent-attack-id": "T1218", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1216": { "attack-v18-attack-id": "T1216", "attack-v19-attack-id": "T1216", "attack-v18-stix-id": "attack-pattern--f6fe9070-7a65-49ea-ae72-76292f42cebe", "attack-v19-stix-id": "attack-pattern--f6fe9070-7a65-49ea-ae72-76292f42cebe", "attack-v18-name": "System Script Proxy Execution", "attack-v19-name": "System Script Proxy Execution", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1216.001": { "attack-v18-attack-id": "T1216.001", "attack-v19-attack-id": "T1216.001", "attack-v18-stix-id": "attack-pattern--09cd431f-eaf4-4d2a-acaf-2a7acfe7ed58", "attack-v19-stix-id": "attack-pattern--09cd431f-eaf4-4d2a-acaf-2a7acfe7ed58", "attack-v18-name": "System Script Proxy Execution: PubPrn", "attack-v19-name": "System Script Proxy Execution: PubPrn", "attack-v19-parent-attack-id": "T1216", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1216.002": { "attack-v18-attack-id": "T1216.002", "attack-v19-attack-id": "T1216.002", "attack-v18-stix-id": "attack-pattern--e6f19759-dde3-47fc-99cc-d9f5fa4ade60", "attack-v19-stix-id": "attack-pattern--e6f19759-dde3-47fc-99cc-d9f5fa4ade60", "attack-v18-name": "System Script Proxy Execution: SyncAppvPublishingServer", "attack-v19-name": "System Script Proxy Execution: SyncAppvPublishingServer", "attack-v19-parent-attack-id": "T1216", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1221": { "attack-v18-attack-id": "T1221", "attack-v19-attack-id": "T1221", "attack-v18-stix-id": "attack-pattern--dc31fe1e-d722-49da-8f5f-92c7b5aff534", "attack-v19-stix-id": "attack-pattern--dc31fe1e-d722-49da-8f5f-92c7b5aff534", "attack-v18-name": "Template Injection", "attack-v19-name": "Template Injection", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1205": { "attack-v18-attack-id": "T1205", "attack-v19-attack-id": "T1205", "attack-v18-stix-id": "attack-pattern--451a9977-d255-43c9-b431-66de80130c8c", "attack-v19-stix-id": "attack-pattern--451a9977-d255-43c9-b431-66de80130c8c", "attack-v18-name": "Traffic Signaling", "attack-v19-name": "Traffic Signaling", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "command-and-control", "defense-evasion", "persistence" ], "attack-v19-tactics": [ "stealth", "command-and-control", "persistence" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1205.001": { "attack-v18-attack-id": "T1205.001", "attack-v19-attack-id": "T1205.001", "attack-v18-stix-id": "attack-pattern--8868cb5b-d575-4a60-acb2-07d37389a2fd", "attack-v19-stix-id": "attack-pattern--8868cb5b-d575-4a60-acb2-07d37389a2fd", "attack-v18-name": "Traffic Signaling: Port Knocking", "attack-v19-name": "Traffic Signaling: Port Knocking", "attack-v19-parent-attack-id": "T1205", "attack-v18-tactics": [ "command-and-control", "defense-evasion", "persistence" ], "attack-v19-tactics": [ "stealth", "command-and-control", "persistence" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1205.002": { "attack-v18-attack-id": "T1205.002", "attack-v19-attack-id": "T1205.002", "attack-v18-stix-id": "attack-pattern--005cc321-08ce-4d17-b1ea-cb5275926520", "attack-v19-stix-id": "attack-pattern--005cc321-08ce-4d17-b1ea-cb5275926520", "attack-v18-name": "Traffic Signaling: Socket Filters", "attack-v19-name": "Traffic Signaling: Socket Filters", "attack-v19-parent-attack-id": "T1205", "attack-v18-tactics": [ "command-and-control", "defense-evasion", "persistence" ], "attack-v19-tactics": [ "stealth", "command-and-control", "persistence" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1127": { "attack-v18-attack-id": "T1127", "attack-v19-attack-id": "T1127", "attack-v18-stix-id": "attack-pattern--ff25900d-76d5-449b-a351-8824e62fc81b", "attack-v19-stix-id": "attack-pattern--ff25900d-76d5-449b-a351-8824e62fc81b", "attack-v18-name": "Trusted Developer Utilities Proxy Execution", "attack-v19-name": "Trusted Developer Utilities Proxy Execution", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth", "execution" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1127.002": { "attack-v18-attack-id": "T1127.002", "attack-v19-attack-id": "T1127.002", "attack-v18-stix-id": "attack-pattern--cc279e50-df85-4c8e-be80-6dc2eda8849c", "attack-v19-stix-id": "attack-pattern--cc279e50-df85-4c8e-be80-6dc2eda8849c", "attack-v18-name": "Trusted Developer Utilities Proxy Execution: ClickOnce", "attack-v19-name": "Trusted Developer Utilities Proxy Execution: ClickOnce", "attack-v19-parent-attack-id": "T1127", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth", "execution" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1127.003": { "attack-v18-attack-id": "T1127.003", "attack-v19-attack-id": "T1127.003", "attack-v18-stix-id": "attack-pattern--7d356151-a69d-404e-896b-71618952702a", "attack-v19-stix-id": "attack-pattern--7d356151-a69d-404e-896b-71618952702a", "attack-v18-name": "Trusted Developer Utilities Proxy Execution: JamPlus", "attack-v19-name": "Trusted Developer Utilities Proxy Execution: JamPlus", "attack-v19-parent-attack-id": "T1127", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth", "execution" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1127.001": { "attack-v18-attack-id": "T1127.001", "attack-v19-attack-id": "T1127.001", "attack-v18-stix-id": "attack-pattern--c92e3d68-2349-49e4-a341-7edca2deff96", "attack-v19-stix-id": "attack-pattern--c92e3d68-2349-49e4-a341-7edca2deff96", "attack-v18-name": "Trusted Developer Utilities Proxy Execution: MSBuild", "attack-v19-name": "Trusted Developer Utilities Proxy Execution: MSBuild", "attack-v19-parent-attack-id": "T1127", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth", "execution" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1535": { "attack-v18-attack-id": "T1535", "attack-v19-attack-id": "T1535", "attack-v18-stix-id": "attack-pattern--59bd0dec-f8b2-4b9a-9141-37a1e6899761", "attack-v19-stix-id": "attack-pattern--59bd0dec-f8b2-4b9a-9141-37a1e6899761", "attack-v18-name": "Unused/Unsupported Cloud Regions", "attack-v19-name": "Unused/Unsupported Cloud Regions", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" }, "T1550": { "attack-v18-attack-id": "T1550", "attack-v19-attack-id": "T1550", "attack-v18-stix-id": "attack-pattern--51a14c76-dd3b-440b-9c20-2bf91d25a814", "attack-v19-stix-id": "attack-pattern--51a14c76-dd3b-440b-9c20-2bf91d25a814", "attack-v18-name": "Use Alternate Authentication Material", "attack-v19-name": "Use Alternate Authentication Material", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion", "lateral-movement" ], "attack-v19-tactics": [ "lateral-movement" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Left Defense Evasion" }, "T1550.001": { "attack-v18-attack-id": "T1550.001", "attack-v19-attack-id": "T1550.001", "attack-v18-stix-id": "attack-pattern--f005e783-57d4-4837-88ad-dbe7faee1c51", "attack-v19-stix-id": "attack-pattern--f005e783-57d4-4837-88ad-dbe7faee1c51", "attack-v18-name": "Use Alternate Authentication Material: Application Access Token", "attack-v19-name": "Use Alternate Authentication Material: Application Access Token", "attack-v19-parent-attack-id": "T1550", "attack-v18-tactics": [ "defense-evasion", "lateral-movement" ], "attack-v19-tactics": [ "lateral-movement" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Left Defense Evasion" }, "T1550.002": { "attack-v18-attack-id": "T1550.002", "attack-v19-attack-id": "T1550.002", "attack-v18-stix-id": "attack-pattern--e624264c-033a-424d-9fd7-fc9c3bbdb03e", "attack-v19-stix-id": "attack-pattern--e624264c-033a-424d-9fd7-fc9c3bbdb03e", "attack-v18-name": "Use Alternate Authentication Material: Pass the Hash", "attack-v19-name": "Use Alternate Authentication Material: Pass the Hash", "attack-v19-parent-attack-id": "T1550", "attack-v18-tactics": [ "defense-evasion", "lateral-movement" ], "attack-v19-tactics": [ "lateral-movement" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Left Defense Evasion" }, "T1550.003": { "attack-v18-attack-id": "T1550.003", "attack-v19-attack-id": "T1550.003", "attack-v18-stix-id": "attack-pattern--7b211ac6-c815-4189-93a9-ab415deca926", "attack-v19-stix-id": "attack-pattern--7b211ac6-c815-4189-93a9-ab415deca926", "attack-v18-name": "Use Alternate Authentication Material: Pass the Ticket", "attack-v19-name": "Use Alternate Authentication Material: Pass the Ticket", "attack-v19-parent-attack-id": "T1550", "attack-v18-tactics": [ "defense-evasion", "lateral-movement" ], "attack-v19-tactics": [ "lateral-movement" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Left Defense Evasion" }, "T1550.004": { "attack-v18-attack-id": "T1550.004", "attack-v19-attack-id": "T1550.004", "attack-v18-stix-id": "attack-pattern--c3c8c916-2f3c-4e71-94b2-240bdfc996f0", "attack-v19-stix-id": "attack-pattern--c3c8c916-2f3c-4e71-94b2-240bdfc996f0", "attack-v18-name": "Use Alternate Authentication Material: Web Session Cookie", "attack-v19-name": "Use Alternate Authentication Material: Web Session Cookie", "attack-v19-parent-attack-id": "T1550", "attack-v18-tactics": [ "defense-evasion", "lateral-movement" ], "attack-v19-tactics": [ "lateral-movement" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Left Defense Evasion" }, "T1078": { "attack-v18-attack-id": "T1078", "attack-v19-attack-id": "T1078", "attack-v18-stix-id": "attack-pattern--b17a1a56-e99c-403c-8948-561df0cffe81", "attack-v19-stix-id": "attack-pattern--b17a1a56-e99c-403c-8948-561df0cffe81", "attack-v18-name": "Valid Accounts", "attack-v19-name": "Valid Accounts", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion", "persistence", "privilege-escalation", "initial-access" ], "attack-v19-tactics": [ "stealth", "persistence", "privilege-escalation", "initial-access" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1078.004": { "attack-v18-attack-id": "T1078.004", "attack-v19-attack-id": "T1078.004", "attack-v18-stix-id": "attack-pattern--f232fa7a-025c-4d43-abc7-318e81a73d65", "attack-v19-stix-id": "attack-pattern--f232fa7a-025c-4d43-abc7-318e81a73d65", "attack-v18-name": "Valid Accounts: Cloud Accounts", "attack-v19-name": "Valid Accounts: Cloud Accounts", "attack-v19-parent-attack-id": "T1078", "attack-v18-tactics": [ "defense-evasion", "persistence", "privilege-escalation", "initial-access" ], "attack-v19-tactics": [ "stealth", "persistence", "privilege-escalation", "initial-access" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1078.001": { "attack-v18-attack-id": "T1078.001", "attack-v19-attack-id": "T1078.001", "attack-v18-stix-id": "attack-pattern--6151cbea-819b-455a-9fa6-99a1cc58797d", "attack-v19-stix-id": "attack-pattern--6151cbea-819b-455a-9fa6-99a1cc58797d", "attack-v18-name": "Valid Accounts: Default Accounts", "attack-v19-name": "Valid Accounts: Default Accounts", "attack-v19-parent-attack-id": "T1078", "attack-v18-tactics": [ "defense-evasion", "persistence", "privilege-escalation", "initial-access" ], "attack-v19-tactics": [ "stealth", "persistence", "privilege-escalation", "initial-access" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1078.002": { "attack-v18-attack-id": "T1078.002", "attack-v19-attack-id": "T1078.002", "attack-v18-stix-id": "attack-pattern--c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f", "attack-v19-stix-id": "attack-pattern--c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f", "attack-v18-name": "Valid Accounts: Domain Accounts", "attack-v19-name": "Valid Accounts: Domain Accounts", "attack-v19-parent-attack-id": "T1078", "attack-v18-tactics": [ "defense-evasion", "persistence", "privilege-escalation", "initial-access" ], "attack-v19-tactics": [ "stealth", "persistence", "privilege-escalation", "initial-access" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1078.003": { "attack-v18-attack-id": "T1078.003", "attack-v19-attack-id": "T1078.003", "attack-v18-stix-id": "attack-pattern--fdc47f44-dd32-4b99-af5f-209f556f63c2", "attack-v19-stix-id": "attack-pattern--fdc47f44-dd32-4b99-af5f-209f556f63c2", "attack-v18-name": "Valid Accounts: Local Accounts", "attack-v19-name": "Valid Accounts: Local Accounts", "attack-v19-parent-attack-id": "T1078", "attack-v18-tactics": [ "defense-evasion", "persistence", "privilege-escalation", "initial-access" ], "attack-v19-tactics": [ "stealth", "persistence", "privilege-escalation", "initial-access" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1497": { "attack-v18-attack-id": "T1497", "attack-v19-attack-id": "T1497", "attack-v18-stix-id": "attack-pattern--82caa33e-d11a-433a-94ea-9b5a5fbef81d", "attack-v19-stix-id": "attack-pattern--82caa33e-d11a-433a-94ea-9b5a5fbef81d", "attack-v18-name": "Virtualization/Sandbox Evasion", "attack-v19-name": "Virtualization/Sandbox Evasion", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion", "discovery" ], "attack-v19-tactics": [ "stealth", "discovery" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1497.001": { "attack-v18-attack-id": "T1497.001", "attack-v19-attack-id": "T1497.001", "attack-v18-stix-id": "attack-pattern--29be378d-262d-4e99-b00d-852d573628e6", "attack-v19-stix-id": "attack-pattern--29be378d-262d-4e99-b00d-852d573628e6", "attack-v18-name": "Virtualization/Sandbox Evasion: System Checks", "attack-v19-name": "Virtualization/Sandbox Evasion: System Checks", "attack-v19-parent-attack-id": "T1497", "attack-v18-tactics": [ "defense-evasion", "discovery" ], "attack-v19-tactics": [ "stealth", "discovery" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1497.003": { "attack-v18-attack-id": "T1497.003", "attack-v19-attack-id": "T1497.003", "attack-v18-stix-id": "attack-pattern--4bed873f-0b7d-41d4-b93a-b6905d1f90b0", "attack-v19-stix-id": "attack-pattern--4bed873f-0b7d-41d4-b93a-b6905d1f90b0", "attack-v18-name": "Virtualization/Sandbox Evasion: Time Based Checks", "attack-v19-name": "Virtualization/Sandbox Evasion: Time Based Checks", "attack-v19-parent-attack-id": "T1497", "attack-v18-tactics": [ "defense-evasion", "discovery" ], "attack-v19-tactics": [ "stealth", "discovery" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1497.002": { "attack-v18-attack-id": "T1497.002", "attack-v19-attack-id": "T1497.002", "attack-v18-stix-id": "attack-pattern--91541e7e-b969-40c6-bbd8-1b5352ec2938", "attack-v19-stix-id": "attack-pattern--91541e7e-b969-40c6-bbd8-1b5352ec2938", "attack-v18-name": "Virtualization/Sandbox Evasion: User Activity Based Checks", "attack-v19-name": "Virtualization/Sandbox Evasion: User Activity Based Checks", "attack-v19-parent-attack-id": "T1497", "attack-v18-tactics": [ "defense-evasion", "discovery" ], "attack-v19-tactics": [ "stealth", "discovery" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s)" }, "T1600": { "attack-v18-attack-id": "T1600", "attack-v19-attack-id": "T1600", "attack-v18-stix-id": "attack-pattern--1f9012ef-1e10-4e48-915e-e03563435fe8", "attack-v19-stix-id": "attack-pattern--1f9012ef-1e10-4e48-915e-e03563435fe8", "attack-v18-name": "Weaken Encryption", "attack-v19-name": "Weaken Encryption", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1600.002": { "attack-v18-attack-id": "T1600.002", "attack-v19-attack-id": "T1600.002", "attack-v18-stix-id": "attack-pattern--7efba77e-3bc4-4ca5-8292-d8201dcd64b5", "attack-v19-stix-id": "attack-pattern--7efba77e-3bc4-4ca5-8292-d8201dcd64b5", "attack-v18-name": "Weaken Encryption: Disable Crypto Hardware", "attack-v19-name": "Weaken Encryption: Disable Crypto Hardware", "attack-v19-parent-attack-id": "T1600", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1600.001": { "attack-v18-attack-id": "T1600.001", "attack-v19-attack-id": "T1600.001", "attack-v18-stix-id": "attack-pattern--3a40f208-a9c1-4efa-a598-4003c3681fb8", "attack-v19-stix-id": "attack-pattern--3a40f208-a9c1-4efa-a598-4003c3681fb8", "attack-v18-name": "Weaken Encryption: Reduce Key Space", "attack-v19-name": "Weaken Encryption: Reduce Key Space", "attack-v19-parent-attack-id": "T1600", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Remains sub-technique", "tactic-change-type": "Moved to new tactic Defense Impairment" }, "T1220": { "attack-v18-attack-id": "T1220", "attack-v19-attack-id": "T1220", "attack-v18-stix-id": "attack-pattern--ebbe170d-aa74-4946-8511-9921243415a3", "attack-v19-stix-id": "attack-pattern--ebbe170d-aa74-4946-8511-9921243415a3", "attack-v18-name": "XSL Script Processing", "attack-v19-name": "XSL Script Processing", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [ "defense-evasion" ], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Remains technique", "tactic-change-type": "Remains TA0005 -> renamed Stealth" } }, "new-techniques": { "T1686.003": { "attack-v19-attack-id": "T1686.003", "attack-v19-stix-id": "attack-pattern--291ede6c-1473-454c-b614-5ac5ea63c987", "attack-v19-name": "Disable or Modify System Firewall: Windows Host Firewall", "attack-v19-parent-attack-id": "T1686", "attack-v18-tactics": [], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Became a new sub-technique", "tactic-change-type": "N/A" }, "T1687": { "attack-v19-attack-id": "T1687", "attack-v19-stix-id": "attack-pattern--01c9b54f-c04e-41ba-b0c3-cfe784b3a463", "attack-v19-name": "Exploitation for Defense Impairment", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [], "attack-v19-tactics": [ "defense-impairment" ], "explanation": "", "technique-change-type": "Became a new technique", "tactic-change-type": "N/A" }, "T1684": { "attack-v19-attack-id": "T1684", "attack-v19-stix-id": "attack-pattern--41e4d77a-6275-4976-9e35-785985598519", "attack-v19-name": "Social Engineering", "attack-v19-parent-attack-id": "", "attack-v18-tactics": [], "attack-v19-tactics": [ "stealth" ], "explanation": "", "technique-change-type": "Became a new technique", "tactic-change-type": "N/A" } } }