About attack

This page is for anyone reading the LinkML schema’s elements: it says how they are named and what the model leaves out.

MITRE ATT&CK describes how adversaries behave. A tactic is a goal, such as initial access; a technique is a way to reach it, and a sub-technique a narrower way. Groups and campaigns use techniques and software, mitigations counter techniques, and detection strategies, carried out by analytics, detect them. ATT&CK keeps three domains, Enterprise, Mobile and Industrial Control Systems (ICS), each a matrix of tactics, and MITRE publishes each release of a domain as one STIX 2.1 bundle.

Element names are the schema’s own. Classes and enums carry the Attack prefix (AttackTechnique, AttackPlatform) so they can be imported beside other vocabularies, and each class extends the lmodel/stix class it builds on, whose names carry the Stix prefix.

The slots keep the keys MITRE’s data writes, so data validates unchanged. STIX’s own keys, such as name and kill_chain_phases, come from the stix modules. ATT&CK’s are x_mitre_*, with tactic_refs and the keys of the objects that log sources, mutable elements and related assets hold (channel, field, related_asset_sectors). The enum values keep MITRE’s spelling, such as Field Controller/RTU/PLC/IED and command-and-control. Every ATT&CK element is in the attack: namespace (https://w3id.org/lmodel/attack/).

The descriptions are this project’s own words. The examples and the extract under tests/data/ are ATT&CK objects, which MITRE’s licence lets anyone copy with its copyright designation and licence, as NOTICE gives them.

Where the data departs from the ADM

The schema follows the data MITRE publishes. In the v20.0 data:

Enterprise’s tactics TA0005 and TA0112 have short names the ADM lacks (stealth and defense-impairment);
three revoked techniques keep the platform Office 365;
fourteen revoked Mobile techniques have no kill chain phase;
26 retired techniques name their domain’s own source for their ATT&CK ID;
224 deprecated mitigations carry a technique’s ID;
one malware is revoked by a tool.

tests/test_upstream.py gives each departure’s reason. Across a bundle, the data also breaks three statements of the ADM’s documentation, and the same file lists each breach by ATT&CK ID:

16 retired Enterprise sub-techniques have no parent;
9 current sub-techniques name a platform their parent lacks;
7 log source references name a log and channel their data component does not list;
12 ICS log source references name an Enterprise data component, which the ICS bundle does not hold.

What is left out

ATT&CK releases other than v20.0, and its STIX 2.0 form;
the collection index, index.json;
Navigator layers and the other files MITRE publishes beside the bundles;
the cyber-observable objects, which come with the stix modules but which ATT&CK does not use.

About attack

Where the data departs from the ADM

What is left out

Reference