mitre-attack / mitre-attack/attack-stix-data

Techniques listed on the campaign are not present on the related group

Open
#62 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
671
Forks
145
PR merge metrics
No merged PRs in 30d

Description

I am trying to identify a campaign group based on the techniques used in the campaign. In my mind, all techniques used in a campaign should be in the group that runs it. On the website, this information appears this way (each technique on a campaign is present in the group that runs it).

But when I try to do this from the STIX file information, there are a lot of techniques on the campaigns that are not associated with the group, for example:
OilRig Group (intrusion-set--4ca1929c-7d64-4aab-b849-badbfc0c760d)
There are 76 techniques listed as used by the group
But on the Juicy Mix campaign (campaign--7ab2f1a1-26af-4204-ad84-d640fde391da)  that OilRig conducted, there are five techniques: 
 1. T1074.001: Local Data Staging
      2. T1132.001: Standard Encoding
      3. T1217: Browser Information Discovery
      4. T1518: Software Discovery
      5. T1584.004: Compromise Infrastructure: Server
that are not listed on the 76 techniques used by the group.

Resuming: the correspondence occurs in all campaigns on the website, but not in every campaign in the STIX file (enterprise-attack.json).

Is it worth listing all these inconsistencies, or are they not important?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with enterprise-attack.json and compare the cited Juicy Mix campaign techniques with the OilRig intrusion-set relationships, using the object IDs in the issue. Determine whether the mismatches are expected STIX modeling or inconsistent data; done means documenting the conclusion and, if they are errors, identifying the affected relationships.

Written by the indexing model from the issue text.

Assessment

Tech stack
json
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.