mitre-attack / mitre-attack/attack-stix-data
Techniques listed on the campaign are not present on the related group
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 671
- Forks
- 145
- PR merge metrics
- No merged PRs in 30d
Description
I am trying to identify a campaign group based on the techniques used in the campaign. In my mind, all techniques used in a campaign should be in the group that runs it. On the website, this information appears this way (each technique on a campaign is present in the group that runs it).
But when I try to do this from the STIX file information, there are a lot of techniques on the campaigns that are not associated with the group, for example:
OilRig Group (intrusion-set--4ca1929c-7d64-4aab-b849-badbfc0c760d)
There are 76 techniques listed as used by the group
But on the Juicy Mix campaign (campaign--7ab2f1a1-26af-4204-ad84-d640fde391da) that OilRig conducted, there are five techniques:
1. T1074.001: Local Data Staging
2. T1132.001: Standard Encoding
3. T1217: Browser Information Discovery
4. T1518: Software Discovery
5. T1584.004: Compromise Infrastructure: Server
that are not listed on the 76 techniques used by the group.
Resuming: the correspondence occurs in all campaigns on the website, but not in every campaign in the STIX file (enterprise-attack.json).
Is it worth listing all these inconsistencies, or are they not important?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with enterprise-attack.json and compare the cited Juicy Mix campaign techniques with the OilRig intrusion-set relationships, using the object IDs in the issue. Determine whether the mismatches are expected STIX modeling or inconsistent data; done means documenting the conclusion and, if they are errors, identifying the affected relationships.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- json
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100