Hugging Face's logo

chairulridjal
/
arcspan

Token Classification
Safetensors
English
privacy_filter
named-entity-recognition
cybersecurity
ner
threat-intelligence
ioc-extraction
Mixture of Experts
span-detection
Model card Files
xet
 Community
chairulridjal commited on
Commit
044fdcb
·
verified ·
1 Parent(s): 614488e

Remove unnecessary files (batch 99)

Browse files
Files changed (50) hide show
  1. data/raw/mitre-cti/ics-attack/relationship/relationship--c64f2ed2-f7a7-4333-b0d3-d687ffb7ad6b.json +0 -32
  2. data/raw/mitre-cti/ics-attack/relationship/relationship--c6520346-fe47-44ce-af75-d99004ac2977.json +0 -32
  3. data/raw/mitre-cti/ics-attack/relationship/relationship--c6562519-81c5-4eca-a815-f46ac0ed4bcc.json +0 -24
  4. data/raw/mitre-cti/ics-attack/relationship/relationship--c65e39eb-f6d1-4e3a-9070-b2fa7ea35b36.json +0 -25
  5. data/raw/mitre-cti/ics-attack/relationship/relationship--c67e3535-69a9-4234-8170-4ad6efc632b7.json +0 -31
  6. data/raw/mitre-cti/ics-attack/relationship/relationship--c69eab3c-861c-45f5-8858-a595fcc7e6f6.json +0 -31
  7. data/raw/mitre-cti/ics-attack/relationship/relationship--c6a05c20-02d4-42ce-ad5c-280c604e13d8.json +0 -25
  8. data/raw/mitre-cti/ics-attack/relationship/relationship--c785c026-4139-4c56-a6dd-cdd3ba75bab1.json +0 -32
  9. data/raw/mitre-cti/ics-attack/relationship/relationship--c78f497f-01c3-4efb-aa74-92b700b9c02b.json +0 -31
  10. data/raw/mitre-cti/ics-attack/relationship/relationship--c7aac6c9-da16-46e2-8cfa-dca07a0a7562.json +0 -46
  11. data/raw/mitre-cti/ics-attack/relationship/relationship--c80a479e-5e7b-449b-ace0-b5ced0d2d442.json +0 -24
  12. data/raw/mitre-cti/ics-attack/relationship/relationship--c8222300-6c5e-42d6-ae67-3595407b89fd.json +0 -25
  13. data/raw/mitre-cti/ics-attack/relationship/relationship--c84e39ab-30c1-40e3-95a8-fcbb271e913c.json +0 -37
  14. data/raw/mitre-cti/ics-attack/relationship/relationship--c8a40335-90d6-496a-b4f9-1cc93d3fffc6.json +0 -31
  15. data/raw/mitre-cti/ics-attack/relationship/relationship--c8dd2735-bd04-4413-847d-316b77c6de19.json +0 -25
  16. data/raw/mitre-cti/ics-attack/relationship/relationship--c8e78d6f-ac9d-4ad3-ae13-238f1eb4423a.json +0 -32
  17. data/raw/mitre-cti/ics-attack/relationship/relationship--c9065f74-556d-4728-8072-f96642e70316.json +0 -24
  18. data/raw/mitre-cti/ics-attack/relationship/relationship--c90cfddb-253b-41c8-9057-2abde6f8aa6d.json +0 -37
  19. data/raw/mitre-cti/ics-attack/relationship/relationship--c9395e2a-afaf-427c-bcb2-ae663d72c05c.json +0 -24
  20. data/raw/mitre-cti/ics-attack/relationship/relationship--c95850f4-4616-435c-b237-f1985833d40e.json +0 -25
  21. data/raw/mitre-cti/ics-attack/relationship/relationship--c95ce502-b63d-42c6-a9f2-5a3cb0922e27.json +0 -24
  22. data/raw/mitre-cti/ics-attack/relationship/relationship--c9fb4adb-8064-426a-838d-c93674fb380b.json +0 -25
  23. data/raw/mitre-cti/ics-attack/relationship/relationship--ca13a117-aae0-4802-878b-c09f4a04dd31.json +0 -25
  24. data/raw/mitre-cti/ics-attack/relationship/relationship--ca225ea0-e813-4205-98db-707b474ae24f.json +0 -25
  25. data/raw/mitre-cti/ics-attack/relationship/relationship--ca3c4d4b-cf53-4489-904f-8a220e421aeb.json +0 -32
  26. data/raw/mitre-cti/ics-attack/relationship/relationship--ca5c7ae7-5273-4888-bc50-183d6e200972.json +0 -24
  27. data/raw/mitre-cti/ics-attack/relationship/relationship--ca64a927-f050-41b3-80d3-93d22cdef26a.json +0 -24
  28. data/raw/mitre-cti/ics-attack/relationship/relationship--ca768c2a-0f14-471c-90a5-bce649e88d51.json +0 -24
  29. data/raw/mitre-cti/ics-attack/relationship/relationship--cad91f87-7cc7-4771-8c7b-1599793ed3c1.json +0 -37
  30. data/raw/mitre-cti/ics-attack/relationship/relationship--cb1037c1-4b83-4a79-ba12-00558bb6b42b.json +0 -31
  31. data/raw/mitre-cti/ics-attack/relationship/relationship--cb30d507-edc6-4197-947c-7b3a6e395c0d.json +0 -25
  32. data/raw/mitre-cti/ics-attack/relationship/relationship--cb38425c-646d-4bc8-bdea-e6cc630c3034.json +0 -32
  33. data/raw/mitre-cti/ics-attack/relationship/relationship--cb47a3bb-daec-4aa1-9a92-af2a61bb65cd.json +0 -25
  34. data/raw/mitre-cti/ics-attack/relationship/relationship--cb4d802e-df5b-4017-81dd-47f65fff23a3.json +0 -24
  35. data/raw/mitre-cti/ics-attack/relationship/relationship--cb6d67c0-33ba-4c49-ae70-d0e4f0f68794.json +0 -32
  36. data/raw/mitre-cti/ics-attack/relationship/relationship--cba8313b-c338-45f7-88ef-a514094882ac.json +0 -32
  37. data/raw/mitre-cti/ics-attack/relationship/relationship--cbc62104-d3df-499c-9630-b510e99f3acd.json +0 -24
  38. data/raw/mitre-cti/ics-attack/relationship/relationship--cbc65a60-3b40-4ecf-a10d-8ef1be72568d.json +0 -25
  39. data/raw/mitre-cti/ics-attack/relationship/relationship--cbee31a0-716c-4b10-83f0-aa889bfb4749.json +0 -25
  40. data/raw/mitre-cti/ics-attack/relationship/relationship--cc5c77ce-c5a3-4791-b80e-09d35282443a.json +0 -25
  41. data/raw/mitre-cti/ics-attack/relationship/relationship--cca191a1-3c50-4d4f-8f79-4247e58af610.json +0 -24
  42. data/raw/mitre-cti/ics-attack/relationship/relationship--ccae6e5d-8a9e-4bab-ae77-26a2bd722f67.json +0 -32
  43. data/raw/mitre-cti/ics-attack/relationship/relationship--ccbb44ad-2220-4260-99ce-9142c44fc797.json +0 -25
  44. data/raw/mitre-cti/ics-attack/relationship/relationship--ccc67bb3-acc3-4294-81b3-4a0d972f2dd7.json +0 -32
  45. data/raw/mitre-cti/ics-attack/relationship/relationship--ccef2177-65ca-4126-bcd9-dd6ffb4c5e06.json +0 -24
  46. data/raw/mitre-cti/ics-attack/relationship/relationship--cd297a7b-4b02-407e-a798-e36fef4cf3a1.json +0 -24
  47. data/raw/mitre-cti/ics-attack/relationship/relationship--cd54b7ba-c96c-49c8-90d2-15677efb8fe2.json +0 -25
  48. data/raw/mitre-cti/ics-attack/relationship/relationship--cd6f1ca4-aaec-451d-b855-55cdb0c3dde8.json +0 -37
  49. data/raw/mitre-cti/ics-attack/relationship/relationship--ce3aad7e-1e15-40c7-916b-e25a647e9986.json +0 -25
  50. data/raw/mitre-cti/ics-attack/relationship/relationship--ce5833db-4cd2-4034-ac97-8a02b14e0095.json +0 -24
data/raw/mitre-cti/ics-attack/relationship/relationship--c64f2ed2-f7a7-4333-b0d3-d687ffb7ad6b.json DELETED
@@ -1,32 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--ba093b9c-a75d-4361-b1da-54489478b2bd",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--c64f2ed2-f7a7-4333-b0d3-d687ffb7ad6b",
9
- "created": "2020-09-21T17:59:24.739Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "external_references": [
13
- {
14
- "source_name": "Department of Homeland Security October 2009",
15
- "description": "Department of Homeland Security 2009, October Developing an Industrial Control Systems Cybersecurity Incident Response Capability Retrieved. 2020/09/17 ",
16
- "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/final-RP_ics_cybersecurity_incident_response_100609.pdf"
17
- }
18
- ],
19
- "object_marking_refs": [
20
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
21
- ],
22
- "modified": "2025-04-16T23:04:37.879Z",
23
- "description": "Take and store data backups from end user systems and critical servers. Ensure backup and storage systems are hardened and kept separate from the corporate network to prevent compromise. Maintain and exercise incident response plans (Citation: Department of Homeland Security October 2009), including the management of gold-copy back-up images and configurations for key systems to enable quick recovery and response from adversarial activities that impact control, view, or availability.\n",
24
- "relationship_type": "mitigates",
25
- "source_ref": "course-of-action--ad12819e-3211-4291-b360-069f280cff0a",
26
- "target_ref": "attack-pattern--4c2e1408-9d68-4187-8e6b-a77bc52700ec",
27
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
28
- "x_mitre_deprecated": false,
29
- "x_mitre_attack_spec_version": "3.2.0"
30
- }
31
- ]
32
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--c6520346-fe47-44ce-af75-d99004ac2977.json DELETED
@@ -1,32 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--001dde1f-1684-4c92-b6eb-bf7661688650",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--c6520346-fe47-44ce-af75-d99004ac2977",
9
- "created": "2017-12-14T16:46:06.044Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "external_references": [
13
- {
14
- "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
15
- "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
16
- "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
17
- }
18
- ],
19
- "object_marking_refs": [
20
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
21
- ],
22
- "modified": "2025-04-16T23:04:38.096Z",
23
- "description": "[Stuxnet](https://attack.mitre.org/software/S0603) can reprogram a PLC and change critical parameters in such a way that legitimate commands can be overridden or intercepted. In addition, Stuxnet can apply inappropriate command sequences or parameters to cause damage to property. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
24
- "relationship_type": "uses",
25
- "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
26
- "target_ref": "attack-pattern--1af9e3fd-2bcc-414d-adbd-fe3b95c02ca1",
27
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
28
- "x_mitre_deprecated": false,
29
- "x_mitre_attack_spec_version": "3.2.0"
30
- }
31
- ]
32
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--c6562519-81c5-4eca-a815-f46ac0ed4bcc.json DELETED
@@ -1,24 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--b4dafb2e-2d76-4987-8ff1-8c116c91e1fc",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--c6562519-81c5-4eca-a815-f46ac0ed4bcc",
9
- "created": "2020-09-21T17:59:24.739Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "object_marking_refs": [
12
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
13
- ],
14
- "modified": "2025-04-28T15:26:50.282Z",
15
- "description": "Utilize network allowlists to restrict unnecessary connections to network devices (e.g., comm servers, serial to ethernet converters) and services, especially in cases when devices have limits on the number of simultaneous sessions they support.\n",
16
- "relationship_type": "mitigates",
17
- "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
18
- "target_ref": "attack-pattern--008b8f56-6107-48be-aa9f-746f927dbb61",
19
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
20
- "x_mitre_deprecated": false,
21
- "x_mitre_attack_spec_version": "3.2.0"
22
- }
23
- ]
24
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--c65e39eb-f6d1-4e3a-9070-b2fa7ea35b36.json DELETED
@@ -1,25 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--9254c86d-a81a-4d80-a490-b24c34effb84",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--c65e39eb-f6d1-4e3a-9070-b2fa7ea35b36",
9
- "created": "2023-09-28T21:27:50.246Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "object_marking_refs": [
13
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
14
- ],
15
- "modified": "2025-04-16T23:04:38.535Z",
16
- "description": "",
17
- "relationship_type": "targets",
18
- "source_ref": "attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb",
19
- "target_ref": "x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499",
20
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
21
- "x_mitre_deprecated": false,
22
- "x_mitre_attack_spec_version": "3.2.0"
23
- }
24
- ]
25
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--c67e3535-69a9-4234-8170-4ad6efc632b7.json DELETED
@@ -1,31 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--5ad50f7d-c26e-42b4-98ef-ad35128fac15",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--c67e3535-69a9-4234-8170-4ad6efc632b7",
9
- "created": "2020-09-21T17:59:24.739Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "external_references": [
12
- {
13
- "source_name": "OWASP",
14
- "description": "OWASP Top 10 Web Application Security Risks Retrieved. 2020/09/25 ",
15
- "url": "https://owasp.org/www-project-top-ten/"
16
- }
17
- ],
18
- "object_marking_refs": [
19
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
20
- ],
21
- "modified": "2025-04-28T15:26:50.680Z",
22
- "description": "Implement continuous monitoring of vulnerability sources. Also, use automatic and manual code review tools. (Citation: OWASP)\n",
23
- "relationship_type": "mitigates",
24
- "source_ref": "course-of-action--de0bc375-50e1-4e26-a342-a8ff8c9d3037",
25
- "target_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
26
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
27
- "x_mitre_deprecated": false,
28
- "x_mitre_attack_spec_version": "3.2.0"
29
- }
30
- ]
31
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--c69eab3c-861c-45f5-8858-a595fcc7e6f6.json DELETED
@@ -1,31 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--a40143d9-cace-4d38-9a67-e72e09623f32",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--c69eab3c-861c-45f5-8858-a595fcc7e6f6",
9
- "created": "2020-09-21T17:59:24.739Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "external_references": [
12
- {
13
- "source_name": "Gardiner, J., Cova, M., Nagaraja, S February 2014",
14
- "description": "Gardiner, J., Cova, M., Nagaraja, S 2014, February Command & Control Understanding, Denying and Detecting Retrieved. 2016/04/20 ",
15
- "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf"
16
- }
17
- ],
18
- "object_marking_refs": [
19
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
20
- ],
21
- "modified": "2025-04-28T15:26:50.890Z",
22
- "description": "Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known tools and protocols like FTP can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: Gardiner, J., Cova, M., Nagaraja, S February 2014)\n",
23
- "relationship_type": "mitigates",
24
- "source_ref": "course-of-action--3172222b-4983-43f7-8983-753ded4f13bc",
25
- "target_ref": "attack-pattern--ead7bd34-186e-4c79-9a4d-b65bcce6ed9d",
26
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
27
- "x_mitre_deprecated": false,
28
- "x_mitre_attack_spec_version": "3.2.0"
29
- }
30
- ]
31
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--c6a05c20-02d4-42ce-ad5c-280c604e13d8.json DELETED
@@ -1,25 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--d7582a81-d1fd-4eef-b45a-4c551aab2f5e",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--c6a05c20-02d4-42ce-ad5c-280c604e13d8",
9
- "created": "2023-09-29T17:59:11.267Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "object_marking_refs": [
13
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
14
- ],
15
- "modified": "2025-04-16T23:04:39.381Z",
16
- "description": "",
17
- "relationship_type": "targets",
18
- "source_ref": "attack-pattern--8bb4538f-f16f-49f0-a431-70b5444c7349",
19
- "target_ref": "x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64",
20
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
21
- "x_mitre_deprecated": false,
22
- "x_mitre_attack_spec_version": "3.2.0"
23
- }
24
- ]
25
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--c785c026-4139-4c56-a6dd-cdd3ba75bab1.json DELETED
@@ -1,32 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--0d378c34-5ff1-4253-b0d8-2ff77be0ad8b",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--c785c026-4139-4c56-a6dd-cdd3ba75bab1",
9
- "created": "2018-10-17T00:14:20.652Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "external_references": [
13
- {
14
- "source_name": "Anton Cherepanov, ESET June 2017",
15
- "description": "Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ",
16
- "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
17
- }
18
- ],
19
- "object_marking_refs": [
20
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
21
- ],
22
- "modified": "2025-04-16T23:04:39.776Z",
23
- "description": "In [Industroyer](https://attack.mitre.org/software/S0604) the first COM port from the configuration file is used for the actual communication and the two other COM ports are just opened to prevent other processes accessing them. Thus, the IEC 101 payload component is able to take over and maintain control of the RTU device. (Citation: Anton Cherepanov, ESET June 2017)",
24
- "relationship_type": "uses",
25
- "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
26
- "target_ref": "attack-pattern--008b8f56-6107-48be-aa9f-746f927dbb61",
27
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
28
- "x_mitre_deprecated": false,
29
- "x_mitre_attack_spec_version": "3.2.0"
30
- }
31
- ]
32
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--c78f497f-01c3-4efb-aa74-92b700b9c02b.json DELETED
@@ -1,31 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--01a34db5-13b1-4c32-ad3e-5cd6cf706a23",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--c78f497f-01c3-4efb-aa74-92b700b9c02b",
9
- "created": "2020-09-21T17:59:24.739Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "external_references": [
12
- {
13
- "source_name": "National Institute of Standards and Technology April 2013",
14
- "description": "National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ",
15
- "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"
16
- }
17
- ],
18
- "object_marking_refs": [
19
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
20
- ],
21
- "modified": "2025-04-28T15:26:51.473Z",
22
- "description": "When at rest, project files should be encrypted to prevent unauthorized changes. (Citation: National Institute of Standards and Technology April 2013)\n",
23
- "relationship_type": "mitigates",
24
- "source_ref": "course-of-action--9f99fcfd-772e-4e63-9d39-e45612e546dc",
25
- "target_ref": "attack-pattern--e72425f8-9ae6-41d3-bfdb-e1b865e60722",
26
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
27
- "x_mitre_deprecated": false,
28
- "x_mitre_attack_spec_version": "3.2.0"
29
- }
30
- ]
31
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--c7aac6c9-da16-46e2-8cfa-dca07a0a7562.json DELETED
@@ -1,46 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--3901549c-1be2-4d12-b771-729125a8aad5",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--c7aac6c9-da16-46e2-8cfa-dca07a0a7562",
9
- "created": "2020-09-21T17:59:24.739Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "external_references": [
12
- {
13
- "source_name": "Karen Scarfone; Paul Hoffman September 2009",
14
- "description": "Karen Scarfone; Paul Hoffman 2009, September Guidelines on Firewalls and Firewall Policy Retrieved. 2020/09/25 ",
15
- "url": "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41r1.pdf"
16
- },
17
- {
18
- "source_name": "Keith Stouffer May 2015",
19
- "description": "Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ",
20
- "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"
21
- },
22
- {
23
- "source_name": "Department of Homeland Security September 2016",
24
- "description": "Department of Homeland Security 2016, September Retrieved. 2020/09/25 ",
25
- "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
26
- },
27
- {
28
- "source_name": "Dwight Anderson 2014",
29
- "description": "Dwight Anderson 2014 Protect Critical Infrastructure Systems With Whitelisting Retrieved. 2020/09/25 ",
30
- "url": "https://www.sans.org/reading-room/whitepapers/ICS/protect-critical-infrastructure-systems-whitelisting-35312"
31
- }
32
- ],
33
- "object_marking_refs": [
34
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
35
- ],
36
- "modified": "2025-04-28T15:26:51.849Z",
37
- "description": "Segment operational assets and their management devices based on their functional role within the process. Enabling more strict isolation to more critical control and operational information within the control environment. (Citation: Karen Scarfone; Paul Hoffman September 2009) (Citation: Keith Stouffer May 2015) (Citation: Department of Homeland Security September 2016) (Citation: Dwight Anderson 2014) \n",
38
- "relationship_type": "mitigates",
39
- "source_ref": "course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291",
40
- "target_ref": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
41
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
42
- "x_mitre_deprecated": false,
43
- "x_mitre_attack_spec_version": "3.2.0"
44
- }
45
- ]
46
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--c80a479e-5e7b-449b-ace0-b5ced0d2d442.json DELETED
@@ -1,24 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--60744292-b810-41c2-bac9-6fd8972e9cb2",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--c80a479e-5e7b-449b-ace0-b5ced0d2d442",
9
- "created": "2025-10-21T15:10:28.402Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "object_marking_refs": [
12
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
13
- ],
14
- "modified": "2025-10-21T15:10:28.402Z",
15
- "description": "",
16
- "relationship_type": "detects",
17
- "source_ref": "x-mitre-detection-strategy--60a55b7b-29a5-437e-83a7-edbe6f3c4415",
18
- "target_ref": "attack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364b",
19
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
20
- "x_mitre_deprecated": false,
21
- "x_mitre_attack_spec_version": "3.3.0"
22
- }
23
- ]
24
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--c8222300-6c5e-42d6-ae67-3595407b89fd.json DELETED
@@ -1,25 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--ec6cf96a-bb1f-4524-84df-ca213607299f",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--c8222300-6c5e-42d6-ae67-3595407b89fd",
9
- "created": "2024-04-09T20:54:39.801Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "object_marking_refs": [
13
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
14
- ],
15
- "modified": "2025-04-16T23:04:40.569Z",
16
- "description": "",
17
- "relationship_type": "targets",
18
- "source_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
19
- "target_ref": "x-mitre-asset--69d1b1ef-e918-4cfd-9a98-29debd04cb32",
20
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
21
- "x_mitre_deprecated": false,
22
- "x_mitre_attack_spec_version": "3.2.0"
23
- }
24
- ]
25
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--c84e39ab-30c1-40e3-95a8-fcbb271e913c.json DELETED
@@ -1,37 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--c912ab0c-4fc2-4c49-9766-09ffdf7cf999",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--c84e39ab-30c1-40e3-95a8-fcbb271e913c",
9
- "created": "2022-05-06T17:47:21.168Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "external_references": [
13
- {
14
- "source_name": "Carl Hurd March 2019",
15
- "description": "Carl Hurd 2019, March 26 VPNFilter Deep Dive Retrieved. 2019/03/28 ",
16
- "url": "https://www.youtube.com/watch?v=yuZazP22rpI"
17
- },
18
- {
19
- "source_name": "William Largent June 2018",
20
- "description": "William Largent 2018, June 06 VPNFilter Update - VPNFilter exploits endpoints, targets new devices Retrieved. 2019/03/28 ",
21
- "url": "https://blog.talosintelligence.com/2018/06/vpnfilter-update.html"
22
- }
23
- ],
24
- "object_marking_refs": [
25
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
26
- ],
27
- "modified": "2025-04-16T23:04:40.783Z",
28
- "description": "The [VPNFilter](https://attack.mitre.org/software/S1010)'s ssler module configures the device's iptables to redirect all traffic destined for port 80 to its local service listening on port 8888. Any outgoing web requests on port 80 are now intercepted by ssler and can be inspected by the ps module and manipulated before being sent to the legitimate HTTP service. (Citation: William Largent June 2018) (Citation: Carl Hurd March 2019)",
29
- "relationship_type": "uses",
30
- "source_ref": "malware--6108f800-10b8-4090-944e-be579f01263d",
31
- "target_ref": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
32
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
33
- "x_mitre_deprecated": false,
34
- "x_mitre_attack_spec_version": "3.2.0"
35
- }
36
- ]
37
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--c8a40335-90d6-496a-b4f9-1cc93d3fffc6.json DELETED
@@ -1,31 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--d727c8ad-33d9-44fe-932e-9cded8f9b3bf",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--c8a40335-90d6-496a-b4f9-1cc93d3fffc6",
9
- "created": "2021-04-12T17:00:17.249Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "external_references": [
12
- {
13
- "source_name": "Robert A. Martin January 2021",
14
- "description": "Robert A. Martin 2021, January TRUSTING OUR SUPPLY CHAINS: A COMPREHENSIVE DATA-DRIVEN APPROACH Retrieved. 2021/04/12 ",
15
- "url": "https://www.mitre.org/sites/default/files/publications/pr-20-01465-37-trusting-our-supply-chains-a-comprehensive-data-driven-approach.pdf"
16
- }
17
- ],
18
- "object_marking_refs": [
19
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
20
- ],
21
- "modified": "2025-04-28T15:26:52.250Z",
22
- "description": "A supply chain management program should include methods the assess the trustworthiness and technical maturity of a supplier, along with technical methods (e.g., code-signing, bill of materials) needed to validate the integrity of newly obtained devices and components. Develop procurement language that emphasizes the expectations for suppliers regarding the artifacts, audit records, and technical capabilities needed to validate the integrity of the devices supply chain. (Citation: Robert A. Martin January 2021)\n",
23
- "relationship_type": "mitigates",
24
- "source_ref": "course-of-action--ac8f3492-7fbb-4a0a-b0b4-b75ec676136c",
25
- "target_ref": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
26
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
27
- "x_mitre_deprecated": false,
28
- "x_mitre_attack_spec_version": "3.2.0"
29
- }
30
- ]
31
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--c8dd2735-bd04-4413-847d-316b77c6de19.json DELETED
@@ -1,25 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--97d05a74-37a6-49fc-8723-3ed080e4c104",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--c8dd2735-bd04-4413-847d-316b77c6de19",
9
- "created": "2020-09-21T17:59:24.739Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "object_marking_refs": [
13
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
14
- ],
15
- "modified": "2025-04-16T23:04:41.166Z",
16
- "description": "Network allowlists can be implemented through either host-based files or system host files to specify what external connections (e.g., IP address, MAC address, port, protocol) can be made from a device. Allowlist techniques that operate at the application layer (e.g., DNP3, Modbus, HTTP) are addressed in the [Filter Network Traffic](https://attack.mitre.org/mitigations/M0937) mitigation.",
17
- "relationship_type": "mitigates",
18
- "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
19
- "target_ref": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4",
20
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
21
- "x_mitre_deprecated": false,
22
- "x_mitre_attack_spec_version": "3.2.0"
23
- }
24
- ]
25
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--c8e78d6f-ac9d-4ad3-ae13-238f1eb4423a.json DELETED
@@ -1,32 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--443e8ebe-2d16-476c-8aba-688d3ba84a35",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--c8e78d6f-ac9d-4ad3-ae13-238f1eb4423a",
9
- "created": "2023-09-27T13:22:13.265Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "external_references": [
13
- {
14
- "source_name": "Booz Allen Hamilton",
15
- "description": "Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.",
16
- "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
17
- }
18
- ],
19
- "object_marking_refs": [
20
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
21
- ],
22
- "modified": "2025-04-16T22:46:37.915Z",
23
- "description": "(Citation: Booz Allen Hamilton)",
24
- "relationship_type": "uses",
25
- "source_ref": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
26
- "target_ref": "malware--54cc1d4f-5c53-4f0e-9ef5-11b4998e82e4",
27
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
28
- "x_mitre_deprecated": false,
29
- "x_mitre_attack_spec_version": "3.2.0"
30
- }
31
- ]
32
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--c9065f74-556d-4728-8072-f96642e70316.json DELETED
@@ -1,24 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--fcb3a967-4551-45ef-9ad3-ee6a08f7dc56",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--c9065f74-556d-4728-8072-f96642e70316",
9
- "created": "2021-04-12T18:59:24.739Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "object_marking_refs": [
12
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
13
- ],
14
- "modified": "2025-04-28T15:26:52.682Z",
15
- "description": "Access Management technologies can help enforce authentication on critical remote service, examples include, but are not limited to, device management services (e.g., telnet, SSH), data access servers (e.g., HTTP, Historians), and HMI sessions (e.g., RDP, VNC).\n",
16
- "relationship_type": "mitigates",
17
- "source_ref": "course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3",
18
- "target_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
19
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
20
- "x_mitre_deprecated": false,
21
- "x_mitre_attack_spec_version": "3.2.0"
22
- }
23
- ]
24
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--c90cfddb-253b-41c8-9057-2abde6f8aa6d.json DELETED
@@ -1,37 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--5d7d94da-e88d-43f9-90cb-71c9b9964779",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--c90cfddb-253b-41c8-9057-2abde6f8aa6d",
9
- "created": "2021-04-12T18:49:06.044Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "external_references": [
13
- {
14
- "source_name": "SecureWorks September 2019",
15
- "description": "SecureWorks 2019, September 24 REvil/Sodinokibi Ransomware Retrieved. 2021/04/12 ",
16
- "url": "https://www.secureworks.com/research/revil-sodinokibi-ransomware"
17
- },
18
- {
19
- "source_name": "Tom Fakterman August 2019",
20
- "description": "Tom Fakterman 2019, August 05 Sodinokibi: The Crown Prince of Ransomware Retrieved. 2021/04/12 ",
21
- "url": "https://www.cybereason.com/blog/the-sodinokibi-ransomware-attack"
22
- }
23
- ],
24
- "object_marking_refs": [
25
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
26
- ],
27
- "modified": "2025-04-16T23:04:41.652Z",
28
- "description": "[REvil](https://attack.mitre.org/software/S0496) sends HTTPS POST messages with randomly generated URLs to communicate with a remote server. (Citation: Tom Fakterman August 2019) (Citation: SecureWorks September 2019)",
29
- "relationship_type": "uses",
30
- "source_ref": "malware--ac61f1f9-7bb1-465e-9b8a-c2ce8e88baf5",
31
- "target_ref": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
32
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
33
- "x_mitre_deprecated": false,
34
- "x_mitre_attack_spec_version": "3.2.0"
35
- }
36
- ]
37
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--c9395e2a-afaf-427c-bcb2-ae663d72c05c.json DELETED
@@ -1,24 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--b70b3e50-a9bf-44f2-ad6b-220af3232fa4",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--c9395e2a-afaf-427c-bcb2-ae663d72c05c",
9
- "created": "2020-09-21T17:59:24.739Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "object_marking_refs": [
12
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
13
- ],
14
- "modified": "2025-04-28T15:26:52.997Z",
15
- "description": "Provide an alternative method for alarms to be reported in the event of a communication failure.\n",
16
- "relationship_type": "mitigates",
17
- "source_ref": "course-of-action--b11cad63-ef30-4eb8-af0d-6cc46eef3f3e",
18
- "target_ref": "attack-pattern--2900bbd8-308a-4274-b074-5b8bde8347bc",
19
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
20
- "x_mitre_deprecated": false,
21
- "x_mitre_attack_spec_version": "3.2.0"
22
- }
23
- ]
24
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--c95850f4-4616-435c-b237-f1985833d40e.json DELETED
@@ -1,25 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--827394a9-25f0-4424-938f-4ed2fccd8a08",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--c95850f4-4616-435c-b237-f1985833d40e",
9
- "created": "2023-09-29T16:29:39.918Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "object_marking_refs": [
13
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
14
- ],
15
- "modified": "2025-04-16T23:04:42.076Z",
16
- "description": "",
17
- "relationship_type": "targets",
18
- "source_ref": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
19
- "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
20
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
21
- "x_mitre_deprecated": false,
22
- "x_mitre_attack_spec_version": "3.2.0"
23
- }
24
- ]
25
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--c95ce502-b63d-42c6-a9f2-5a3cb0922e27.json DELETED
@@ -1,24 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--f0b78527-9262-4e50-ad0f-34634dfa15f5",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--c95ce502-b63d-42c6-a9f2-5a3cb0922e27",
9
- "created": "2025-10-21T15:10:28.402Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "object_marking_refs": [
12
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
13
- ],
14
- "modified": "2025-10-21T15:10:28.402Z",
15
- "description": "",
16
- "relationship_type": "detects",
17
- "source_ref": "x-mitre-detection-strategy--97914ffd-b189-415e-9309-e63e3be01b1e",
18
- "target_ref": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
19
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
20
- "x_mitre_deprecated": false,
21
- "x_mitre_attack_spec_version": "3.3.0"
22
- }
23
- ]
24
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--c9fb4adb-8064-426a-838d-c93674fb380b.json DELETED
@@ -1,25 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--3d831168-9c83-4cba-8b80-1a8cbef1f296",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--c9fb4adb-8064-426a-838d-c93674fb380b",
9
- "created": "2023-09-29T18:44:38.035Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "object_marking_refs": [
13
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
14
- ],
15
- "modified": "2025-04-16T23:04:42.312Z",
16
- "description": "",
17
- "relationship_type": "targets",
18
- "source_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
19
- "target_ref": "x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41",
20
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
21
- "x_mitre_deprecated": false,
22
- "x_mitre_attack_spec_version": "3.2.0"
23
- }
24
- ]
25
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--ca13a117-aae0-4802-878b-c09f4a04dd31.json DELETED
@@ -1,25 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--58dbc13a-f6a2-49db-be7d-ec95da813eb7",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--ca13a117-aae0-4802-878b-c09f4a04dd31",
9
- "created": "2023-09-28T20:06:50.018Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "object_marking_refs": [
13
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
14
- ],
15
- "modified": "2025-04-16T23:04:42.722Z",
16
- "description": "",
17
- "relationship_type": "targets",
18
- "source_ref": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
19
- "target_ref": "x-mitre-asset--1769c499-55e5-462f-bab2-c39b8cd5ae32",
20
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
21
- "x_mitre_deprecated": false,
22
- "x_mitre_attack_spec_version": "3.2.0"
23
- }
24
- ]
25
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--ca225ea0-e813-4205-98db-707b474ae24f.json DELETED
@@ -1,25 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--752368e4-7e8b-452c-be05-11765891db69",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--ca225ea0-e813-4205-98db-707b474ae24f",
9
- "created": "2024-04-09T20:49:44.575Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "object_marking_refs": [
13
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
14
- ],
15
- "modified": "2025-04-16T23:04:42.923Z",
16
- "description": "",
17
- "relationship_type": "targets",
18
- "source_ref": "attack-pattern--fa3aa267-da22-4bdd-961f-03223322a8d5",
19
- "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
20
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
21
- "x_mitre_deprecated": false,
22
- "x_mitre_attack_spec_version": "3.2.0"
23
- }
24
- ]
25
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--ca3c4d4b-cf53-4489-904f-8a220e421aeb.json DELETED
@@ -1,32 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--f807c95e-8c23-438f-9f4d-4467289bbe3a",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--ca3c4d4b-cf53-4489-904f-8a220e421aeb",
9
- "created": "2018-10-17T00:14:20.652Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "external_references": [
13
- {
14
- "source_name": "Anton Cherepanov, ESET June 2017",
15
- "description": "Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ",
16
- "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
17
- }
18
- ],
19
- "object_marking_refs": [
20
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
21
- ],
22
- "modified": "2025-04-16T23:04:43.126Z",
23
- "description": "[Industroyer](https://attack.mitre.org/software/S0604)'s OPC module can brute force values and will send out a 0x01 status which for the target systems equates to a Primary Variable Out of Limits misdirecting operators from understanding protective relay status. (Citation: Anton Cherepanov, ESET June 2017)",
24
- "relationship_type": "uses",
25
- "source_ref": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
26
- "target_ref": "attack-pattern--4c2e1408-9d68-4187-8e6b-a77bc52700ec",
27
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
28
- "x_mitre_deprecated": false,
29
- "x_mitre_attack_spec_version": "3.2.0"
30
- }
31
- ]
32
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--ca5c7ae7-5273-4888-bc50-183d6e200972.json DELETED
@@ -1,24 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--eb013a81-f555-4faf-92bb-0000fbc745a8",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--ca5c7ae7-5273-4888-bc50-183d6e200972",
9
- "created": "2020-09-21T17:59:24.739Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "object_marking_refs": [
12
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
13
- ],
14
- "modified": "2025-04-28T15:26:53.794Z",
15
- "description": "Built-in browser sandboxes and application isolation may be used to contain web-based malware.\n",
16
- "relationship_type": "mitigates",
17
- "source_ref": "course-of-action--059ba11e-e3dc-49aa-84ca-88197f40d4ea",
18
- "target_ref": "attack-pattern--7830cfcf-b268-4ac0-a69e-73c6affbae9a",
19
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
20
- "x_mitre_deprecated": false,
21
- "x_mitre_attack_spec_version": "3.2.0"
22
- }
23
- ]
24
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--ca64a927-f050-41b3-80d3-93d22cdef26a.json DELETED
@@ -1,24 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--2587240e-68f3-4b37-9b10-e8518c33079e",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--ca64a927-f050-41b3-80d3-93d22cdef26a",
9
- "created": "2020-09-21T17:59:24.739Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "object_marking_refs": [
12
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
13
- ],
14
- "modified": "2025-04-28T15:26:54.006Z",
15
- "description": "Ensure that unnecessary ports and services are closed to prevent risk of discovery and potential exploitation.\n",
16
- "relationship_type": "mitigates",
17
- "source_ref": "course-of-action--d0909119-2f71-4923-87db-b649881672d7",
18
- "target_ref": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
19
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
20
- "x_mitre_deprecated": false,
21
- "x_mitre_attack_spec_version": "3.2.0"
22
- }
23
- ]
24
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--ca768c2a-0f14-471c-90a5-bce649e88d51.json DELETED
@@ -1,24 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--83f4d5a6-8cac-4e94-b593-84b439115642",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--ca768c2a-0f14-471c-90a5-bce649e88d51",
9
- "created": "2020-09-21T17:59:24.739Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "object_marking_refs": [
12
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
13
- ],
14
- "modified": "2025-04-28T15:26:54.232Z",
15
- "description": "Application denylists can be used to block automation protocol functions used to initiate device shutdowns or restarts, such as DNP3's 0x0D function code, or vulnerabilities that can be used to trigger device shutdowns (e.g., CVE-2014-9195, CVE-2015-5374).\n",
16
- "relationship_type": "mitigates",
17
- "source_ref": "course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17",
18
- "target_ref": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
19
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
20
- "x_mitre_deprecated": false,
21
- "x_mitre_attack_spec_version": "3.2.0"
22
- }
23
- ]
24
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--cad91f87-7cc7-4771-8c7b-1599793ed3c1.json DELETED
@@ -1,37 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--1c808577-e0a4-4780-9472-040aa47791b9",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--cad91f87-7cc7-4771-8c7b-1599793ed3c1",
9
- "created": "2018-10-17T00:14:20.652Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "external_references": [
13
- {
14
- "source_name": "Carl Hurd March 2019",
15
- "description": "Carl Hurd 2019, March 26 VPNFilter Deep Dive Retrieved. 2019/03/28 ",
16
- "url": "https://www.youtube.com/watch?v=yuZazP22rpI"
17
- },
18
- {
19
- "source_name": "William Largent June 2018",
20
- "description": "William Largent 2018, June 06 VPNFilter Update - VPNFilter exploits endpoints, targets new devices Retrieved. 2019/03/28 ",
21
- "url": "https://blog.talosintelligence.com/2018/06/vpnfilter-update.html"
22
- }
23
- ],
24
- "object_marking_refs": [
25
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
26
- ],
27
- "modified": "2025-04-16T23:04:43.976Z",
28
- "description": "The [VPNFilter](https://attack.mitre.org/software/S1010) packet sniffer looks for basic authentication as well as monitors ICS traffic, and is specific to the TP-LINK R600-VPN. The malware uses a raw socket to look for connections to a pre-specified IP address, only looking at TCP packets that are 150 bytes or larger. Packets that are not on port 502, are scanned for BasicAuth, and that information is logged. This may have allowed credential harvesting from communications between devices accessing a modbus-enabled HMI. (Citation: William Largent June 2018) (Citation: Carl Hurd March 2019)",
29
- "relationship_type": "uses",
30
- "source_ref": "malware--6108f800-10b8-4090-944e-be579f01263d",
31
- "target_ref": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c",
32
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
33
- "x_mitre_deprecated": false,
34
- "x_mitre_attack_spec_version": "3.2.0"
35
- }
36
- ]
37
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--cb1037c1-4b83-4a79-ba12-00558bb6b42b.json DELETED
@@ -1,31 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--479590c4-35ec-4f40-9b45-1eb72167afd1",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--cb1037c1-4b83-4a79-ba12-00558bb6b42b",
9
- "created": "2021-10-04T20:52:20.304Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "external_references": [
12
- {
13
- "source_name": "ESET Lazarus KillDisk April 2018",
14
- "description": "K\u00e1lnai, P., Cherepanov A. (2018, April 03). Lazarus KillDisks Central American casino. Retrieved May 17, 2018.",
15
- "url": "https://www.welivesecurity.com/2018/04/03/lazarus-killdisk-central-american-casino/"
16
- }
17
- ],
18
- "object_marking_refs": [
19
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
20
- ],
21
- "modified": "2025-04-28T15:26:54.554Z",
22
- "description": "(Citation: ESET Lazarus KillDisk April 2018)",
23
- "relationship_type": "uses",
24
- "source_ref": "intrusion-set--00f67a77-86a4-4adf-be26-1a54fc713340",
25
- "target_ref": "malware--e221eb77-1502-4129-af1d-fe1ad55e7ec6",
26
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
27
- "x_mitre_deprecated": false,
28
- "x_mitre_attack_spec_version": "3.2.0"
29
- }
30
- ]
31
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--cb30d507-edc6-4197-947c-7b3a6e395c0d.json DELETED
@@ -1,25 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--1df2c076-4e94-4f1c-b39a-861b43cf8671",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--cb30d507-edc6-4197-947c-7b3a6e395c0d",
9
- "created": "2020-09-21T17:59:24.739Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "object_marking_refs": [
13
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
14
- ],
15
- "modified": "2025-04-16T23:04:44.309Z",
16
- "description": "Utilize code signatures to verify the integrity and authenticity of programs downloaded to the device.\n",
17
- "relationship_type": "mitigates",
18
- "source_ref": "course-of-action--71eb7dad-07eb-4bbc-9df0-ac57bf2fba4a",
19
- "target_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
20
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
21
- "x_mitre_deprecated": false,
22
- "x_mitre_attack_spec_version": "3.2.0"
23
- }
24
- ]
25
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--cb38425c-646d-4bc8-bdea-e6cc630c3034.json DELETED
@@ -1,32 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--e1fff4ac-2dcf-4fbb-874e-e6e8bec1a3f8",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--cb38425c-646d-4bc8-bdea-e6cc630c3034",
9
- "created": "2021-04-13T11:15:26.506Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "external_references": [
13
- {
14
- "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
15
- "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
16
- "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
17
- }
18
- ],
19
- "object_marking_refs": [
20
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
21
- ],
22
- "modified": "2025-04-16T23:04:44.524Z",
23
- "description": "[Stuxnet](https://attack.mitre.org/software/S0603) infects PLCs with different code depending on the characteristics of the target system. An infection sequence consists of code blocks and data blocks that will be downloaded to the PLC to alter its behavior. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
24
- "relationship_type": "uses",
25
- "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
26
- "target_ref": "attack-pattern--fc5fda7e-6b2c-4457-b036-759896a2efa2",
27
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
28
- "x_mitre_deprecated": false,
29
- "x_mitre_attack_spec_version": "3.2.0"
30
- }
31
- ]
32
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--cb47a3bb-daec-4aa1-9a92-af2a61bb65cd.json DELETED
@@ -1,25 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--0b8b267b-2df4-40da-978a-8a2be15c76ec",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--cb47a3bb-daec-4aa1-9a92-af2a61bb65cd",
9
- "created": "2023-09-28T21:14:29.099Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "object_marking_refs": [
13
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
14
- ],
15
- "modified": "2025-04-16T23:04:44.717Z",
16
- "description": "",
17
- "relationship_type": "targets",
18
- "source_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
19
- "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
20
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
21
- "x_mitre_deprecated": false,
22
- "x_mitre_attack_spec_version": "3.2.0"
23
- }
24
- ]
25
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--cb4d802e-df5b-4017-81dd-47f65fff23a3.json DELETED
@@ -1,24 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--eb2be617-d27a-4dc7-9937-97c2907e3397",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--cb4d802e-df5b-4017-81dd-47f65fff23a3",
9
- "created": "2020-09-21T17:59:24.739Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "object_marking_refs": [
12
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
13
- ],
14
- "modified": "2025-04-28T15:26:55.151Z",
15
- "description": "Encrypt any operational data with strong confidentiality requirements, including organizational trade-secrets, recipes, and other intellectual property (IP).\n",
16
- "relationship_type": "mitigates",
17
- "source_ref": "course-of-action--9f99fcfd-772e-4e63-9d39-e45612e546dc",
18
- "target_ref": "attack-pattern--b7e13ee8-182c-4f19-92a4-a88d7d855d54",
19
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
20
- "x_mitre_deprecated": false,
21
- "x_mitre_attack_spec_version": "3.2.0"
22
- }
23
- ]
24
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--cb6d67c0-33ba-4c49-ae70-d0e4f0f68794.json DELETED
@@ -1,32 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--9c184f5a-084f-4eb1-9df6-dc0ae0acdf06",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--cb6d67c0-33ba-4c49-ae70-d0e4f0f68794",
9
- "created": "2023-03-30T14:08:42.386Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "external_references": [
13
- {
14
- "source_name": "M. Rentschler and H. Heine",
15
- "description": "M. Rentschler and H. Heine The Parallel Redundancy Protocol for industrial IP networks Retrieved. 2020/09/25 ",
16
- "url": "https://ieeexplore.ieee.org/document/6505877"
17
- }
18
- ],
19
- "object_marking_refs": [
20
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
21
- ],
22
- "modified": "2025-04-16T23:04:45.138Z",
23
- "description": "Retain cold-standby or replacement hardware of similar models to ensure continued operations of critical functions if the primary system is compromised or unavailable. (Citation: M. Rentschler and H. Heine)",
24
- "relationship_type": "mitigates",
25
- "source_ref": "course-of-action--f0f5c87a-a58d-440a-b3b5-ca679d98c6dd",
26
- "target_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
27
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
28
- "x_mitre_deprecated": false,
29
- "x_mitre_attack_spec_version": "3.2.0"
30
- }
31
- ]
32
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--cba8313b-c338-45f7-88ef-a514094882ac.json DELETED
@@ -1,32 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--f9e980e3-1f3e-46c2-92ae-09d6e11de51b",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--cba8313b-c338-45f7-88ef-a514094882ac",
9
- "created": "2022-09-28T20:28:39.348Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "external_references": [
13
- {
14
- "source_name": "Wylie-22",
15
- "description": "Jimmy Wylie. (2022, August). Analyzing PIPEDREAM: Challenges in Testing an ICS Attack Toolkit. Defcon 30.",
16
- "url": "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"
17
- }
18
- ],
19
- "object_marking_refs": [
20
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
21
- ],
22
- "modified": "2025-04-16T23:04:45.380Z",
23
- "description": "[INCONTROLLER](https://attack.mitre.org/software/S1045) has the ability to exploit a vulnerable Asrock driver (AsrDrv103.sys) using CVE-2020-15368 to load its own unsigned driver on the system.(Citation: Wylie-22)",
24
- "relationship_type": "uses",
25
- "source_ref": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
26
- "target_ref": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
27
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
28
- "x_mitre_deprecated": false,
29
- "x_mitre_attack_spec_version": "3.2.0"
30
- }
31
- ]
32
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--cbc62104-d3df-499c-9630-b510e99f3acd.json DELETED
@@ -1,24 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--f40b0478-b436-4ccd-9f41-a7803a83fe0d",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--cbc62104-d3df-499c-9630-b510e99f3acd",
9
- "created": "2025-09-29T19:07:05.860Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "object_marking_refs": [
13
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
14
- ],
15
- "modified": "2025-09-29T19:07:05.860Z",
16
- "relationship_type": "targets",
17
- "source_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
18
- "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
19
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
20
- "x_mitre_deprecated": false,
21
- "x_mitre_attack_spec_version": "3.3.0"
22
- }
23
- ]
24
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--cbc65a60-3b40-4ecf-a10d-8ef1be72568d.json DELETED
@@ -1,25 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--f2e2aeed-e42a-4d18-ae29-aa2ec1a89b4c",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--cbc65a60-3b40-4ecf-a10d-8ef1be72568d",
9
- "created": "2024-04-09T20:54:26.301Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "object_marking_refs": [
13
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
14
- ],
15
- "modified": "2025-04-16T23:04:45.573Z",
16
- "description": "",
17
- "relationship_type": "targets",
18
- "source_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
19
- "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
20
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
21
- "x_mitre_deprecated": false,
22
- "x_mitre_attack_spec_version": "3.2.0"
23
- }
24
- ]
25
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--cbee31a0-716c-4b10-83f0-aa889bfb4749.json DELETED
@@ -1,25 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--0cd0a859-7b5f-4c05-b368-839dccda4648",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--cbee31a0-716c-4b10-83f0-aa889bfb4749",
9
- "created": "2023-10-20T17:05:25.595Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "object_marking_refs": [
13
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
14
- ],
15
- "modified": "2025-04-16T23:04:45.801Z",
16
- "description": "",
17
- "relationship_type": "targets",
18
- "source_ref": "attack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722",
19
- "target_ref": "x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990",
20
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
21
- "x_mitre_deprecated": false,
22
- "x_mitre_attack_spec_version": "3.2.0"
23
- }
24
- ]
25
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--cc5c77ce-c5a3-4791-b80e-09d35282443a.json DELETED
@@ -1,25 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--f3c5f243-c51a-42db-b4ee-436504868406",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--cc5c77ce-c5a3-4791-b80e-09d35282443a",
9
- "created": "2023-09-29T16:30:08.166Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "object_marking_refs": [
13
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
14
- ],
15
- "modified": "2025-04-16T23:04:46.007Z",
16
- "description": "",
17
- "relationship_type": "targets",
18
- "source_ref": "attack-pattern--b0628bfc-5376-4a38-9182-f324501cb4cf",
19
- "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
20
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
21
- "x_mitre_deprecated": false,
22
- "x_mitre_attack_spec_version": "3.2.0"
23
- }
24
- ]
25
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--cca191a1-3c50-4d4f-8f79-4247e58af610.json DELETED
@@ -1,24 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--162f186a-673f-44e1-b7ea-681be95ad22c",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--cca191a1-3c50-4d4f-8f79-4247e58af610",
9
- "created": "2020-09-21T17:59:24.739Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "object_marking_refs": [
12
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
13
- ],
14
- "modified": "2025-04-28T15:26:55.956Z",
15
- "description": "Use tools that restrict program execution via application control by attributes other than file name for common system and application utilities.\n",
16
- "relationship_type": "mitigates",
17
- "source_ref": "course-of-action--4fa717d9-cabe-47c8-8cdd-86e9e2e37f30",
18
- "target_ref": "attack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61",
19
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
20
- "x_mitre_deprecated": false,
21
- "x_mitre_attack_spec_version": "3.2.0"
22
- }
23
- ]
24
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--ccae6e5d-8a9e-4bab-ae77-26a2bd722f67.json DELETED
@@ -1,32 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--5c3e2cc7-f01a-4af9-ae05-3fb905496ae4",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--ccae6e5d-8a9e-4bab-ae77-26a2bd722f67",
9
- "created": "2021-04-13T11:15:26.506Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "external_references": [
13
- {
14
- "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
15
- "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.",
16
- "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
17
- }
18
- ],
19
- "object_marking_refs": [
20
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
21
- ],
22
- "modified": "2025-04-16T23:04:46.639Z",
23
- "description": "[Stuxnet](https://attack.mitre.org/software/S0603) infects OB1 so that its malicious code sequence is executed at the start of a cycle. It also infects OB35. OB35 acts as a watchdog, and on certain conditions, it can stop the execution of OB1. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
24
- "relationship_type": "uses",
25
- "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
26
- "target_ref": "attack-pattern--09a61657-46e1-439e-b3ed-3e4556a78243",
27
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
28
- "x_mitre_deprecated": false,
29
- "x_mitre_attack_spec_version": "3.2.0"
30
- }
31
- ]
32
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--ccbb44ad-2220-4260-99ce-9142c44fc797.json DELETED
@@ -1,25 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--b6f2c439-b308-432b-8544-fa3ca91074b9",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--ccbb44ad-2220-4260-99ce-9142c44fc797",
9
- "created": "2023-09-28T21:10:03.272Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "object_marking_refs": [
13
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
14
- ],
15
- "modified": "2025-04-16T23:04:46.864Z",
16
- "description": "",
17
- "relationship_type": "targets",
18
- "source_ref": "attack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4",
19
- "target_ref": "x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3",
20
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
21
- "x_mitre_deprecated": false,
22
- "x_mitre_attack_spec_version": "3.2.0"
23
- }
24
- ]
25
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--ccc67bb3-acc3-4294-81b3-4a0d972f2dd7.json DELETED
@@ -1,32 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--3afe221d-40d5-4429-8cea-f2bcdf6895db",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--ccc67bb3-acc3-4294-81b3-4a0d972f2dd7",
9
- "created": "2021-04-13T12:08:26.506Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "external_references": [
13
- {
14
- "source_name": "Jos Wetzels January 2018",
15
- "description": "Jos Wetzels 2018, January 16 Analyzing the TRITON industrial malware Retrieved. 2019/10/22 ",
16
- "url": "https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware"
17
- }
18
- ],
19
- "object_marking_refs": [
20
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
21
- ],
22
- "modified": "2025-04-16T23:04:47.078Z",
23
- "description": "[Triton](https://attack.mitre.org/software/S1009)'s injector, inject.bin, changes the function pointer of the 'get main processor diagnostic data' TriStation command to the address of imain.bin so that it is executed prior to the normal handler. (Citation: Jos Wetzels January 2018)",
24
- "relationship_type": "uses",
25
- "source_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
26
- "target_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
27
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
28
- "x_mitre_deprecated": false,
29
- "x_mitre_attack_spec_version": "3.2.0"
30
- }
31
- ]
32
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--ccef2177-65ca-4126-bcd9-dd6ffb4c5e06.json DELETED
@@ -1,24 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--fc11404d-cbf5-43b3-aae6-bfc800f9e330",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--ccef2177-65ca-4126-bcd9-dd6ffb4c5e06",
9
- "created": "2025-10-21T15:10:28.402Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "object_marking_refs": [
12
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
13
- ],
14
- "modified": "2025-10-21T15:10:28.402Z",
15
- "description": "",
16
- "relationship_type": "detects",
17
- "source_ref": "x-mitre-detection-strategy--9f3df5ac-caa0-4189-9b9b-dcf2f6bbdc54",
18
- "target_ref": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
19
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
20
- "x_mitre_deprecated": false,
21
- "x_mitre_attack_spec_version": "3.3.0"
22
- }
23
- ]
24
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--cd297a7b-4b02-407e-a798-e36fef4cf3a1.json DELETED
@@ -1,24 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--7cf3a45a-953a-4fec-9d12-59d3ca003f81",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--cd297a7b-4b02-407e-a798-e36fef4cf3a1",
9
- "created": "2020-09-21T17:59:24.739Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "object_marking_refs": [
12
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
13
- ],
14
- "modified": "2025-04-28T15:26:56.507Z",
15
- "description": "Implement network allowlists to minimize serial comm port access to only authorized hosts, such as comm servers and RTUs.\n",
16
- "relationship_type": "mitigates",
17
- "source_ref": "course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a",
18
- "target_ref": "attack-pattern--1c478716-71d9-46a4-9a53-fa5d576adb60",
19
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
20
- "x_mitre_deprecated": false,
21
- "x_mitre_attack_spec_version": "3.2.0"
22
- }
23
- ]
24
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--cd54b7ba-c96c-49c8-90d2-15677efb8fe2.json DELETED
@@ -1,25 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--28111682-b947-4755-8fe2-4b64f0c802d9",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--cd54b7ba-c96c-49c8-90d2-15677efb8fe2",
9
- "created": "2023-09-28T20:15:56.470Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "object_marking_refs": [
13
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
14
- ],
15
- "modified": "2025-04-16T23:04:47.514Z",
16
- "description": "",
17
- "relationship_type": "targets",
18
- "source_ref": "attack-pattern--3f1f4ccb-9be2-4ff8-8f69-dd972221169b",
19
- "target_ref": "x-mitre-asset--75f810ad-b678-4c57-b93b-fdc79bba0c04",
20
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
21
- "x_mitre_deprecated": false,
22
- "x_mitre_attack_spec_version": "3.2.0"
23
- }
24
- ]
25
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--cd6f1ca4-aaec-451d-b855-55cdb0c3dde8.json DELETED
@@ -1,37 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--316ef7a2-fac1-4d9f-97a0-241a008b8036",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--cd6f1ca4-aaec-451d-b855-55cdb0c3dde8",
9
- "created": "2024-03-28T14:27:34.578Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "external_references": [
13
- {
14
- "source_name": "Triton-EENews-2017",
15
- "description": "Blake Sobczak. (2019, March 7). The inside story of the world\u2019s most dangerous malware. Retrieved March 25, 2024.",
16
- "url": "https://www.eenews.net/articles/the-inside-story-of-the-worlds-most-dangerous-malware/"
17
- },
18
- {
19
- "source_name": "FireEye TRITON 2018",
20
- "description": "Miller, S. Reese, E. (2018, June 7). A Totally Tubular Treatise on TRITON and TriStation. Retrieved November 17, 2024.",
21
- "url": "https://web.archive.org/web/20200618231942/https://www.fireeye.com/blog/threat-research/2018/06/totally-tubular-treatise-on-triton-and-tristation.html"
22
- }
23
- ],
24
- "object_marking_refs": [
25
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
26
- ],
27
- "modified": "2025-04-16T23:04:47.756Z",
28
- "description": "In the [Triton Safety Instrumented System Attack](https://attack.mitre.org/campaigns/C0030), [TEMP.Veles](https://attack.mitre.org/groups/G0088) utilized remote desktop protocol (RDP) jump boxes, poorly configured OT firewalls (Citation: Triton-EENews-2017), along with other traditional malware backdoors, to move into the ICS environment.(Citation: FireEye TRITON 2018)(Citation: Triton-EENews-2017)",
29
- "relationship_type": "uses",
30
- "source_ref": "campaign--45a98f02-852f-49b2-94c0-c63207bebbbf",
31
- "target_ref": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
32
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
33
- "x_mitre_deprecated": false,
34
- "x_mitre_attack_spec_version": "3.2.0"
35
- }
36
- ]
37
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--ce3aad7e-1e15-40c7-916b-e25a647e9986.json DELETED
@@ -1,25 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--b9fce39b-49bc-4982-bf82-2f306982476b",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--ce3aad7e-1e15-40c7-916b-e25a647e9986",
9
- "created": "2023-09-29T16:31:36.462Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "object_marking_refs": [
13
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
14
- ],
15
- "modified": "2025-04-16T23:04:48.157Z",
16
- "description": "",
17
- "relationship_type": "targets",
18
- "source_ref": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
19
- "target_ref": "x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d",
20
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
21
- "x_mitre_deprecated": false,
22
- "x_mitre_attack_spec_version": "3.2.0"
23
- }
24
- ]
25
- }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
data/raw/mitre-cti/ics-attack/relationship/relationship--ce5833db-4cd2-4034-ac97-8a02b14e0095.json DELETED
@@ -1,24 +0,0 @@
1
- {
2
- "type": "bundle",
3
- "id": "bundle--ddc8f6a1-195a-4fcd-bc67-404a091405bd",
4
- "spec_version": "2.0",
5
- "objects": [
6
- {
7
- "type": "relationship",
8
- "id": "relationship--ce5833db-4cd2-4034-ac97-8a02b14e0095",
9
- "created": "2025-09-29T19:03:17.501Z",
10
- "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
11
- "revoked": false,
12
- "object_marking_refs": [
13
- "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
14
- ],
15
- "modified": "2025-09-29T19:03:17.501Z",
16
- "relationship_type": "targets",
17
- "source_ref": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f",
18
- "target_ref": "x-mitre-asset--459e4335-74e1-4136-b730-0f116f0d541d",
19
- "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
20
- "x_mitre_deprecated": false,
21
- "x_mitre_attack_spec_version": "3.3.0"
22
- }
23
- ]
24
- }