Inconsistent External References for MITRE ATT&CK ICS Techniques (12 affected entries)

Description

While reviewing the generated STIX data for MITRE ATT&CK ICS techniques, I noticed that most attack patterns correctly use the expected external reference format with source_name: "mitre-ics-attack".

However, 12 entries deviate from this convention and instead contain an external reference with:

{
  "external_references": [
    {
      "source_name": "mitre-attack",
      "url": "https://attack.mitre.org/techniques/T0816",
      "external_id": "T0816"
    }
  ]
}

This is inconsistent with the rest of the dataset and breaks consumers that rely on a stable source_name for MITRE ICS ATT&CK techniques.

Expected Behavior

All ICS techniques should reference MITRE ATT&CK ICS using:

{
  "source_name": "mitre-ics-attack"
}

12 Affected Techniques

Proposed Fix

Standardize the external reference by rewriting the affected objects to use:

{
  "source_name": "mitre-ics-attack"
}

If needed, merge or reconcile any mismatching MITRE ATT&CK references before normalization.

Impact

Systems or pipelines expecting consistent MITRE ICS reference identifiers may misinterpret or skip these techniques due to the unexpected source_name value.