Possible incorrect mappings for CoinTicker / Umbreon / HiddenWasp and Launch Daemon examples

First of all, thank you for your work on ATT&CK and for maintaining this dataset for the community.

I'm a student just getting started in cybersecurity, and ATT&CK has helped me a lot while learning — so I wanted to report a few things I noticed in case they're useful.

Upon reviewing Enterprise software pages and their related technique mappings, I believe there are several inconsistencies between procedure example descriptions, software platforms, and the definitions of the linked techniques.

I also emailed attack@mitre.org with subject [Website Content Error].

Identified Issues

1. CoinTicker (S0369) incorrectly mapped to T1059.003 Windows Command Shell

   • URL: https://attack.mitre.org/software/S0369/
   • Software platforms: macOS
   • Current mapping: T1059.003 Windows Command Shell
   • Procedure text states that CoinTicker “executes a bash script to establish a reverse shell”
   • The same behavior is already mapped to T1059.004 Unix Shell on the same page

   This appears inconsistent: bash reverse-shell execution on macOS aligns with Unix Shell, not Windows Command Shell. The T1059.003 relationship looks like an erroneous or leftover mapping.

2. Additional non-Windows software mapped to T1059.003

   • Umbreon (S0221, Linux)
     https://attack.mitre.org/software/S0221/
     Mapped to T1059.003, while the procedure text describes SSH / reverse shell access.
   • HiddenWasp (S0394, Linux)
     https://attack.mitre.org/software/S0394/
     Mapped to T1059.003, while the procedure text describes scripted execution on a Linux host.

3. Non-macOS software mapped to macOS-only T1543.004 Launch Daemon

   • Technique URL: https://attack.mitre.org/techniques/T1543/004/
   • T1543.004 is defined specifically around macOS Launch Daemons (launchd / plist-based persistence)
   • COATHANGER (S1105; Linux, Network Devices)
     https://attack.mitre.org/software/S1105/
     Procedure text: “create a daemon for timed check-ins…”
   • REPTILE (S1219; Linux)
     https://attack.mitre.org/software/S1219/
     Procedure text: “daemonize a process”

   Generic Unix “daemonize” / create-a-daemon language does not appear to match the macOS-specific Launch Daemon sub-technique.

Suggested Remediation

• S0369: remove relationship to T1059.003; keep T1059.004
• S0221 / S0394: replace T1059.003 with T1059.004 (or remove if already covered elsewhere)
• S1105 / S1219: remove T1543.004; remap only if supporting evidence justifies a platform-appropriate persistence technique (e.g. T1543.002 where applicable)

Happy to provide additional context if useful. Thanks again.

Compare the CoinTicker, Umbreon, HiddenWasp, COATHANGER, and REPTILE software pages with the linked T1059.003, T1059.004, and T1543.004 technique definitions. Verify each relationship against the software platform and procedure text; done means the inconsistent mappings are removed or replaced only where the issue's evidence supports a platform-appropriate relationship.