2420 lines
60 KiB
JSON
2420 lines
60 KiB
JSON
[
|
|
{
|
|
"T1001": [
|
|
{
|
|
"id": "T1001",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1002": [
|
|
{
|
|
"id": "T1560",
|
|
"explanation": "Created to consolidate behavior around encrypting and compressing collected data"
|
|
}
|
|
],
|
|
"change-type": "One or More Techniques Became New Technique"
|
|
},
|
|
{
|
|
"T1003": [
|
|
{
|
|
"id": "T1003",
|
|
"explanation": "Renamed, Name change from Credential Dumping and new sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1004": [
|
|
{
|
|
"id": "T1547.004",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1005": [
|
|
{
|
|
"id": "T1005",
|
|
"explanation": "Fixed technique reference in description and minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1006": [
|
|
{
|
|
"id": "T1006",
|
|
"explanation": "Renamed, Name change from File System Logical Offsets"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1007": [
|
|
{
|
|
"id": "T1007",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1008": [
|
|
{
|
|
"id": "T1008",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1009": [
|
|
{
|
|
"id": "T1027.001",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1010": [
|
|
{
|
|
"id": "T1010",
|
|
"explanation": "Fixed technique reference in description"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1011": [
|
|
{
|
|
"id": "T1011",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1012": [
|
|
{
|
|
"id": "T1012",
|
|
"explanation": "Fixed technique reference in description and minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1013": [
|
|
{
|
|
"id": "T1547.010",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1014": [
|
|
{
|
|
"id": "T1014",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1015": [
|
|
{
|
|
"id": "T1546.008",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1016": [
|
|
{
|
|
"id": "T1016",
|
|
"explanation": "Fixed technique reference in description and minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1017": [
|
|
{
|
|
"id": "T1072",
|
|
"explanation": "Name change from Application Deployment Software"
|
|
}
|
|
],
|
|
"change-type": "Merged into Existing Technique"
|
|
},
|
|
{
|
|
"T1018": [
|
|
{
|
|
"id": "T1018",
|
|
"explanation": "Fixed technique reference in description and minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1019": [
|
|
{
|
|
"id": "T1542.001",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1020": [
|
|
{
|
|
"id": "T1020",
|
|
"explanation": "Fixed technique reference in description"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1021": [
|
|
{
|
|
"id": "T1021",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1022": [
|
|
{
|
|
"id": "T1560",
|
|
"explanation": "Created to consolidate behavior around encrypting and compressing collected data"
|
|
}
|
|
],
|
|
"change-type": "One or More Techniques Became New Technique"
|
|
},
|
|
{
|
|
"T1023": [
|
|
{
|
|
"id": "T1547.009",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1024": [
|
|
{
|
|
"id": "T1573",
|
|
"explanation": "Created to consolidate behavior around encrypted C2"
|
|
}
|
|
],
|
|
"change-type": "One or More Techniques Became New Technique"
|
|
},
|
|
{
|
|
"T1025": [
|
|
{
|
|
"id": "T1025",
|
|
"explanation": "Fixed technique reference in description and minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1026": [
|
|
{
|
|
"id": "N/A",
|
|
"explanation": "Deprecated from ATT&CK due to lack of in the wild use. Existing Group/Software procedure examples did not fit the core idea behind the technique"
|
|
}
|
|
],
|
|
"change-type": "Deprecated"
|
|
},
|
|
{
|
|
"T1027": [
|
|
{
|
|
"id": "T1027",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1028": [
|
|
{
|
|
"id": "T1021.006",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1029": [
|
|
{
|
|
"id": "T1029",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1030": [
|
|
{
|
|
"id": "T1030",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1031": [
|
|
{
|
|
"id": "T1543.003",
|
|
"explanation": "Existing technique that became a sub-technique. Consolidates Modify Existing Service and New Service techniques into one sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Multiple Techniques Became New Sub-Technique"
|
|
},
|
|
{
|
|
"T1032": [
|
|
{
|
|
"id": "T1573",
|
|
"explanation": "Created to consolidate behavior around encrypted C2"
|
|
}
|
|
],
|
|
"change-type": "One or More Techniques Became New Technique"
|
|
},
|
|
{
|
|
"T1033": [
|
|
{
|
|
"id": "T1033",
|
|
"explanation": "Fixed technique reference in description and minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1034": [
|
|
{
|
|
"id": "T1574.007",
|
|
"explanation": "Deprecated and split into separate Unquoted Path, PATH Environment Variable, and Search Order Hijacking sub-techniques."
|
|
},
|
|
{
|
|
"id": "T1574.008",
|
|
"explanation": "Deprecated and split into separate Unquoted Path, PATH Environment Variable, and Search Order Hijacking sub-techniques."
|
|
},
|
|
{
|
|
"id": "T1574.009",
|
|
"explanation": "Deprecated and split into separate Unquoted Path, PATH Environment Variable, and Search Order Hijacking sub-techniques."
|
|
}
|
|
],
|
|
"change-type": "Became Multiple Sub-Techniques"
|
|
},
|
|
{
|
|
"T1035": [
|
|
{
|
|
"id": "T1569.002",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1036": [
|
|
{
|
|
"id": "T1036",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1037": [
|
|
{
|
|
"id": "T1037",
|
|
"explanation": "Remove from lateral-movement, Renamed, Name change from Logon Scripts and new sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1038": [
|
|
{
|
|
"id": "T1574.001",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1039": [
|
|
{
|
|
"id": "T1039",
|
|
"explanation": "Fixed technique reference in description and minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1040": [
|
|
{
|
|
"id": "T1040",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1041": [
|
|
{
|
|
"id": "T1041",
|
|
"explanation": "Renamed, Name change from Exfiltration over Command and Control Channel and added data sources"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1042": [
|
|
{
|
|
"id": "T1546.001",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1043": [
|
|
{
|
|
"id": "N/A",
|
|
"explanation": "Deprecated from ATT&CK because the behavior is redundant and describes most benign network communications."
|
|
}
|
|
],
|
|
"change-type": "Deprecated"
|
|
},
|
|
{
|
|
"T1044": [
|
|
{
|
|
"id": "T1574.010",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1045": [
|
|
{
|
|
"id": "T1027.002",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1046": [
|
|
{
|
|
"id": "T1046",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1047": [
|
|
{
|
|
"id": "T1047",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1048": [
|
|
{
|
|
"id": "T1048",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1049": [
|
|
{
|
|
"id": "T1049",
|
|
"explanation": "Fixed technique reference in description and minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1050": [
|
|
{
|
|
"id": "T1543.003",
|
|
"explanation": "Existing technique that became a sub-technique. Consolidates Modify Existing Service and New Service techniques into one sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Multiple Techniques Became New Sub-Technique"
|
|
},
|
|
{
|
|
"T1051": [
|
|
{
|
|
"id": "N/A",
|
|
"explanation": "Deprecated from ATT&CK due to lack of in the wild use"
|
|
}
|
|
],
|
|
"change-type": "Deprecated"
|
|
},
|
|
{
|
|
"T1052": [
|
|
{
|
|
"id": "T1052",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1053": [
|
|
{
|
|
"id": "T1053",
|
|
"explanation": "Renamed, Name change from Local Job Scheduling and new sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1054": [
|
|
{
|
|
"id": "T1562.006",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1055": [
|
|
{
|
|
"id": "T1055",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1056": [
|
|
{
|
|
"id": "T1056",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1057": [
|
|
{
|
|
"id": "T1057",
|
|
"explanation": "Fixed technique reference in description and minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1058": [
|
|
{
|
|
"id": "T1574.011",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1059": [
|
|
{
|
|
"id": "T1059",
|
|
"explanation": "Renamed, Name change from Command-Line Interface and new sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1060": [
|
|
{
|
|
"id": "T1547.001",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1061": [
|
|
{
|
|
"id": "N/A",
|
|
"explanation": "Deprecated from ATT&CK because the behavior is redundant and implied by use of remote desktop tools like Remote Desktop Protocol. Existing Group/Software procedure examples were remapped appropriately"
|
|
}
|
|
],
|
|
"change-type": "Deprecated"
|
|
},
|
|
{
|
|
"T1062": [
|
|
{
|
|
"id": "N/A",
|
|
"explanation": "Deprecated from ATT&CK due to lack of in the wild use"
|
|
}
|
|
],
|
|
"change-type": "Deprecated"
|
|
},
|
|
{
|
|
"T1063": [
|
|
{
|
|
"id": "T1518.001",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1064": [
|
|
{
|
|
"id": "T1059.004",
|
|
"explanation": "Deprecated and split into separate Unix Shell, Visual Basic, JavaScript/Jscript, and Python sub-techniques of Command and Scripting Interpreter."
|
|
},
|
|
{
|
|
"id": "T1059.005",
|
|
"explanation": "Deprecated and split into separate Unix Shell, Visual Basic, JavaScript/Jscript, and Python sub-techniques of Command and Scripting Interpreter."
|
|
},
|
|
{
|
|
"id": "T1059.006",
|
|
"explanation": "Deprecated and split into separate Unix Shell, Visual Basic, JavaScript/Jscript, and Python sub-techniques of Command and Scripting Interpreter."
|
|
},
|
|
{
|
|
"id": "T1059.007",
|
|
"explanation": "Deprecated and split into separate Unix Shell, Visual Basic, JavaScript/Jscript, and Python sub-techniques of Command and Scripting Interpreter."
|
|
}
|
|
],
|
|
"change-type": "Became Multiple Sub-Techniques"
|
|
},
|
|
{
|
|
"T1065": [
|
|
{
|
|
"id": "T1571",
|
|
"explanation": "Created to refine the idea behind Common and Uncommonly Used Port to focus the behavior on use of a non-standard port for C2 based on the protocol used"
|
|
}
|
|
],
|
|
"change-type": "One or More Techniques Became New Technique"
|
|
},
|
|
{
|
|
"T1066": [
|
|
{
|
|
"id": "T1027.005",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1067": [
|
|
{
|
|
"id": "T1542.003",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1068": [
|
|
{
|
|
"id": "T1068",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1069": [
|
|
{
|
|
"id": "T1069",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1070": [
|
|
{
|
|
"id": "T1070",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1071": [
|
|
{
|
|
"id": "T1071",
|
|
"explanation": "Renamed, Name change from Standard Application Layer Protocol and new sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1072": [
|
|
{
|
|
"id": "T1072",
|
|
"explanation": "Renamed, Name change from Application Deployment Software"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1073": [
|
|
{
|
|
"id": "T1574.002",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1074": [
|
|
{
|
|
"id": "T1074",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1075": [
|
|
{
|
|
"id": "T1550.002",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1076": [
|
|
{
|
|
"id": "T1021.001",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1077": [
|
|
{
|
|
"id": "T1021.002",
|
|
"explanation": "Existing technique that became a sub-technique and was renamed from Windows Admin Shares"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1078": [
|
|
{
|
|
"id": "T1078",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1079": [
|
|
{
|
|
"id": "T1573",
|
|
"explanation": "Created to consolidate behavior around encrypted C2"
|
|
}
|
|
],
|
|
"change-type": "One or More Techniques Became New Technique"
|
|
},
|
|
{
|
|
"T1080": [
|
|
{
|
|
"id": "T1080",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1081": [
|
|
{
|
|
"id": "T1552.001",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1082": [
|
|
{
|
|
"id": "T1082",
|
|
"explanation": "Fixed technique reference in description and minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1083": [
|
|
{
|
|
"id": "T1083",
|
|
"explanation": "Fixed technique reference in description and minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1084": [
|
|
{
|
|
"id": "T1546.003",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1085": [
|
|
{
|
|
"id": "T1218.011",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1086": [
|
|
{
|
|
"id": "T1059.001",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1087": [
|
|
{
|
|
"id": "T1087",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1088": [
|
|
{
|
|
"id": "T1548.002",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1089": [
|
|
{
|
|
"id": "T1562.001",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1090": [
|
|
{
|
|
"id": "T1090",
|
|
"explanation": "Renamed, Name change from Connection Proxy and new sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1091": [
|
|
{
|
|
"id": "T1091",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1092": [
|
|
{
|
|
"id": "T1092",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1093": [
|
|
{
|
|
"id": "T1055.012",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1094": [
|
|
{
|
|
"id": "T1095",
|
|
"explanation": "Merged with and name change from Standard Non-Application Layer Protocol"
|
|
}
|
|
],
|
|
"change-type": "Merged into Existing Technique"
|
|
},
|
|
{
|
|
"T1095": [
|
|
{
|
|
"id": "T1095",
|
|
"explanation": "Renamed, Name change from Standard Non-Application Layer Protocol"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1096": [
|
|
{
|
|
"id": "T1564.004",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1097": [
|
|
{
|
|
"id": "T1550.003",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1098": [
|
|
{
|
|
"id": "T1098",
|
|
"explanation": "Remove from credential-access, New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1099": [
|
|
{
|
|
"id": "T1070.006",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1100": [
|
|
{
|
|
"id": "T1505.003",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1101": [
|
|
{
|
|
"id": "T1547.005",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1102": [
|
|
{
|
|
"id": "T1102",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1103": [
|
|
{
|
|
"id": "T1546.010",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1104": [
|
|
{
|
|
"id": "T1104",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1105": [
|
|
{
|
|
"id": "T1105",
|
|
"explanation": "Renamed, Name change from Remote File Copy"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1106": [
|
|
{
|
|
"id": "T1106",
|
|
"explanation": "Renamed, Name change from Execution through API"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1107": [
|
|
{
|
|
"id": "T1070.004",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1108": [
|
|
{
|
|
"id": "N/A",
|
|
"explanation": "Deprecated from ATT&CK because the behavior is too high level and is sufficiently covered by Valid Accounts and External Remote Services. Existing Group/Software procedure examples were remapped appropriately"
|
|
}
|
|
],
|
|
"change-type": "Deprecated"
|
|
},
|
|
{
|
|
"T1109": [
|
|
{
|
|
"id": "T1542.002",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1110": [
|
|
{
|
|
"id": "T1110",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1111": [
|
|
{
|
|
"id": "T1111",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1112": [
|
|
{
|
|
"id": "T1112",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1113": [
|
|
{
|
|
"id": "T1113",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1114": [
|
|
{
|
|
"id": "T1114",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1115": [
|
|
{
|
|
"id": "T1115",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1116": [
|
|
{
|
|
"id": "T1553.002",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1117": [
|
|
{
|
|
"id": "T1218.010",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1118": [
|
|
{
|
|
"id": "T1218.004",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1119": [
|
|
{
|
|
"id": "T1119",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1120": [
|
|
{
|
|
"id": "T1120",
|
|
"explanation": "Fixed technique reference in description and minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1121": [
|
|
{
|
|
"id": "T1218.009",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1122": [
|
|
{
|
|
"id": "T1546.015",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1123": [
|
|
{
|
|
"id": "T1123",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1124": [
|
|
{
|
|
"id": "T1124",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1125": [
|
|
{
|
|
"id": "T1125",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1126": [
|
|
{
|
|
"id": "T1070.005",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1127": [
|
|
{
|
|
"id": "T1127",
|
|
"explanation": "Renamed, Minor description update, sub-technique added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1128": [
|
|
{
|
|
"id": "T1546.007",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1129": [
|
|
{
|
|
"id": "T1129",
|
|
"explanation": "Renamed, Name change from Execution through Module Load"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1130": [
|
|
{
|
|
"id": "T1553.004",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1131": [
|
|
{
|
|
"id": "T1547.002",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1132": [
|
|
{
|
|
"id": "T1132",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1133": [
|
|
{
|
|
"id": "T1133",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1134": [
|
|
{
|
|
"id": "T1134",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1135": [
|
|
{
|
|
"id": "T1135",
|
|
"explanation": "Fixed technique reference in description, added Linux, and minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1136": [
|
|
{
|
|
"id": "T1136",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1137": [
|
|
{
|
|
"id": "T1137",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1138": [
|
|
{
|
|
"id": "T1546.011",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1139": [
|
|
{
|
|
"id": "T1552.003",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1140": [
|
|
{
|
|
"id": "T1140",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1141": [
|
|
{
|
|
"id": "T1056.002",
|
|
"explanation": "Broken out from pre-defined behavior within Input Capture"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1142": [
|
|
{
|
|
"id": "T1555.001",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1143": [
|
|
{
|
|
"id": "T1564.003",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1144": [
|
|
{
|
|
"id": "T1553.001",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1145": [
|
|
{
|
|
"id": "T1552.004",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1146": [
|
|
{
|
|
"id": "T1070.003",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1147": [
|
|
{
|
|
"id": "T1564.002",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1148": [
|
|
{
|
|
"id": "T1562.003",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1149": [
|
|
{
|
|
"id": "N/A",
|
|
"explanation": "Deprecated from ATT&CK due to lack of in the wild use"
|
|
}
|
|
],
|
|
"change-type": "Deprecated"
|
|
},
|
|
{
|
|
"T1150": [
|
|
{
|
|
"id": "T1547.011",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Multiple Techniques Became New Sub-Technique"
|
|
},
|
|
{
|
|
"T1151": [
|
|
{
|
|
"id": "T1036.006",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1152": [
|
|
{
|
|
"id": "T1569.001",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1153": [
|
|
{
|
|
"id": "N/A",
|
|
"explanation": "Deprecated from ATT&CK due to lack of in the wild use"
|
|
}
|
|
],
|
|
"change-type": "Deprecated"
|
|
},
|
|
{
|
|
"T1154": [
|
|
{
|
|
"id": "T1546.005",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1155": [
|
|
{
|
|
"id": "T1059.002",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1156": [
|
|
{
|
|
"id": "T1546.004",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1157": [
|
|
{
|
|
"id": "T1574.004",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1158": [
|
|
{
|
|
"id": "T1564.001",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1159": [
|
|
{
|
|
"id": "T1543.001",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1160": [
|
|
{
|
|
"id": "T1543.004",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1161": [
|
|
{
|
|
"id": "T1546.006",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1162": [
|
|
{
|
|
"id": "T1547.011",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Multiple Techniques Became New Sub-Technique"
|
|
},
|
|
{
|
|
"T1163": [
|
|
{
|
|
"id": "T1037.004",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1164": [
|
|
{
|
|
"id": "T1547.007",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1165": [
|
|
{
|
|
"id": "T1037.005",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1166": [
|
|
{
|
|
"id": "T1548.001",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1167": [
|
|
{
|
|
"id": "T1555.002",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1168": [
|
|
{
|
|
"id": "T1053",
|
|
"explanation": "Name change from Local Job Scheduling and new sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Merged into Existing Technique"
|
|
},
|
|
{
|
|
"T1169": [
|
|
{
|
|
"id": "T1548.003",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Multiple Techniques Became New Sub-Technique"
|
|
},
|
|
{
|
|
"T1170": [
|
|
{
|
|
"id": "T1218.005",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1171": [
|
|
{
|
|
"id": "T1557.001",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1172": [
|
|
{
|
|
"id": "T1090.004",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1173": [
|
|
{
|
|
"id": "T1559.002",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1174": [
|
|
{
|
|
"id": "T1556.002",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1175": [
|
|
{
|
|
"id": "T1021.003",
|
|
"explanation": "Deprecated and split into separate Component Object Model and Distributed Component Object Model sub-techniques."
|
|
},
|
|
{
|
|
"id": "T1559.001",
|
|
"explanation": "Deprecated and split into separate Component Object Model and Distributed Component Object Model sub-techniques."
|
|
}
|
|
],
|
|
"change-type": "Became Multiple Sub-Techniques"
|
|
},
|
|
{
|
|
"T1176": [
|
|
{
|
|
"id": "T1176",
|
|
"explanation": "Data sources changed and minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1177": [
|
|
{
|
|
"id": "T1547.008",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1178": [
|
|
{
|
|
"id": "T1134.005",
|
|
"explanation": "Added due to manipulation of token information"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1179": [
|
|
{
|
|
"id": "T1056.004",
|
|
"explanation": "Existing technique that became a sub-technique and was renamed from API Hooking. Scope change to only credential access for API hooking was based on available procedure examples"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1180": [
|
|
{
|
|
"id": "T1546.002",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1181": [
|
|
{
|
|
"id": "T1055.011",
|
|
"explanation": "Broken out from pre-defined behavior within Process Injection"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1182": [
|
|
{
|
|
"id": "T1546.009",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1183": [
|
|
{
|
|
"id": "T1546.012",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1184": [
|
|
{
|
|
"id": "T1563.001",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1185": [
|
|
{
|
|
"id": "T1185",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1186": [
|
|
{
|
|
"id": "T1055.013",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1187": [
|
|
{
|
|
"id": "T1187",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1188": [
|
|
{
|
|
"id": "T1090.003",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1189": [
|
|
{
|
|
"id": "T1189",
|
|
"explanation": "Fixed technique reference in description and minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1190": [
|
|
{
|
|
"id": "T1190",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1191": [
|
|
{
|
|
"id": "T1218.003",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1192": [
|
|
{
|
|
"id": "T1566.002",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1193": [
|
|
{
|
|
"id": "T1566.001",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1194": [
|
|
{
|
|
"id": "T1566.003",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1195": [
|
|
{
|
|
"id": "T1195",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1196": [
|
|
{
|
|
"id": "T1218.002",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1197": [
|
|
{
|
|
"id": "T1197",
|
|
"explanation": "Fixed technique reference in description and minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1198": [
|
|
{
|
|
"id": "T1553.003",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1199": [
|
|
{
|
|
"id": "T1199",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1200": [
|
|
{
|
|
"id": "T1200",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1201": [
|
|
{
|
|
"id": "T1201",
|
|
"explanation": "Fixed technique reference in description and minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1202": [
|
|
{
|
|
"id": "T1202",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1203": [
|
|
{
|
|
"id": "T1203",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1204": [
|
|
{
|
|
"id": "T1204",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1205": [
|
|
{
|
|
"id": "T1205",
|
|
"explanation": "Renamed, Technique renamed and sub-technique added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1206": [
|
|
{
|
|
"id": "T1548.003",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Multiple Techniques Became New Sub-Technique"
|
|
},
|
|
{
|
|
"T1207": [
|
|
{
|
|
"id": "T1207",
|
|
"explanation": "Renamed, Name change from DCShadow"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1208": [
|
|
{
|
|
"id": "T1558.003",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1209": [
|
|
{
|
|
"id": "T1547.003",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1210": [
|
|
{
|
|
"id": "T1210",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1211": [
|
|
{
|
|
"id": "T1211",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1212": [
|
|
{
|
|
"id": "T1212",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1213": [
|
|
{
|
|
"id": "T1213",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1214": [
|
|
{
|
|
"id": "T1552.002",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1215": [
|
|
{
|
|
"id": "T1547.006",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1216": [
|
|
{
|
|
"id": "T1216",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1217": [
|
|
{
|
|
"id": "T1217",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1218": [
|
|
{
|
|
"id": "T1218",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1219": [
|
|
{
|
|
"id": "T1219",
|
|
"explanation": "Renamed, Name change from Remote Access Tools and fixed technique reference in description"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1220": [
|
|
{
|
|
"id": "T1220",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1221": [
|
|
{
|
|
"id": "T1221",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1222": [
|
|
{
|
|
"id": "T1222",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1223": [
|
|
{
|
|
"id": "T1218.001",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1480": [
|
|
{
|
|
"id": "T1480",
|
|
"explanation": "New sub-technique added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1482": [
|
|
{
|
|
"id": "T1482",
|
|
"explanation": "Fixed technique reference in description and minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1483": [
|
|
{
|
|
"id": "T1568.002",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1484": [
|
|
{
|
|
"id": "T1484",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1485": [
|
|
{
|
|
"id": "T1485",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1486": [
|
|
{
|
|
"id": "T1486",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1487": [
|
|
{
|
|
"id": "T1561.002",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1488": [
|
|
{
|
|
"id": "T1561.001",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1489": [
|
|
{
|
|
"id": "T1489",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1490": [
|
|
{
|
|
"id": "T1490",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1491": [
|
|
{
|
|
"id": "T1491",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1492": [
|
|
{
|
|
"id": "T1565.001",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1493": [
|
|
{
|
|
"id": "T1565.002",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1494": [
|
|
{
|
|
"id": "T1565.003",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1495": [
|
|
{
|
|
"id": "T1495",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1496": [
|
|
{
|
|
"id": "T1496",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1497": [
|
|
{
|
|
"id": "T1497",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1498": [
|
|
{
|
|
"id": "T1498",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1499": [
|
|
{
|
|
"id": "T1499",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1500": [
|
|
{
|
|
"id": "T1027.004",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1501": [
|
|
{
|
|
"id": "T1543.002",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1502": [
|
|
{
|
|
"id": "T1134.004",
|
|
"explanation": "Added due to manipulation of tokens"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1503": [
|
|
{
|
|
"id": "T1555.003",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1504": [
|
|
{
|
|
"id": "T1546.013",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1505": [
|
|
{
|
|
"id": "T1505",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1506": [
|
|
{
|
|
"id": "T1550.004",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1514": [
|
|
{
|
|
"id": "T1548.004",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1518": [
|
|
{
|
|
"id": "T1518",
|
|
"explanation": "New sub-techniques added"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1519": [
|
|
{
|
|
"id": "T1546.014",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1522": [
|
|
{
|
|
"id": "T1552.005",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1525": [
|
|
{
|
|
"id": "T1525",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1526": [
|
|
{
|
|
"id": "T1526",
|
|
"explanation": "Minor description update"
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1527": [
|
|
{
|
|
"id": "T1550.001",
|
|
"explanation": "Existing technique that became a sub-technique"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1528": [
|
|
{
|
|
"id": "T1528",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1529": [
|
|
{
|
|
"id": "T1529",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1530": [
|
|
{
|
|
"id": "T1530",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1531": [
|
|
{
|
|
"id": "T1531",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1534": [
|
|
{
|
|
"id": "T1534",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1535": [
|
|
{
|
|
"id": "T1535",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1536": [
|
|
{
|
|
"id": "T1578.004",
|
|
"explanation": "Created as distinct behavior within Modify Cloud Compute Infrastructure"
|
|
}
|
|
],
|
|
"change-type": "Became a Sub-Technique"
|
|
},
|
|
{
|
|
"T1537": [
|
|
{
|
|
"id": "T1537",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1538": [
|
|
{
|
|
"id": "T1538",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
},
|
|
{
|
|
"T1539": [
|
|
{
|
|
"id": "T1539",
|
|
"explanation": ""
|
|
}
|
|
],
|
|
"change-type": "Remains Technique"
|
|
}
|
|
] |