Cti Versions Save

See release notes for the content changes here See a summary of STIX data model changes here Changelog for v14.0 - v14.1 Details (JSON)

See release notes for the content changes here See a summary of STIX data model changes here Changelog for v13.1 - v14.0 Details (JSON)

See release notes here Changelog for v13.0 - v13.1 Details (JSON)

See release notes for the content changes here See a summary of STIX data model changes here Changelog for v12.1 - v13.0 Details (JSON)

Techniques

Enterprise

Technique Changes

• Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay (v1.3→v1.4)
• Establish Accounts: Cloud Accounts (v1.0→v1.1)

Minor Technique Changes

• Multi-Factor Authentication Interception (v2.0→v2.0)
• Search Open Websites/Domains: Code Repositories (v1.0→v1.0)
• Stage Capabilities: SEO Poisoning (v1.0→v1.0)

Software

Enterprise

Minor Software Changes

• DCSrv (v1.0→v1.0)
• Heyoka Backdoor (v1.0→v1.0)
• MacMa (v1.0→v1.0)
• Mongall (v1.0→v1.0)
• PingPull (v1.0→v1.0)
• PsExec (v1.3→v1.3)
• PyDCrypt (v1.0→v1.0)
• WhisperGate (v1.0→v1.0)

Groups

Enterprise

Minor Group Changes

• Aoqin Dragon (v1.0→v1.0)
• EXOTIC LILY (v1.0→v1.0)
• Moses Staff (v1.0→v1.0)
• SideCopy (v1.0→v1.0)

Data Sources and/or Components

Enterprise

Data Source and/or Component Deprecations

• Container: Container Metadata (v1.0)
• Pod: Pod Metadata (v1.0)

Contributors to this release

• Manikantan Srinivasan, NEC Corporation India
• Phill Taylor, BT Security
• Vinayak Wadhwa, SAFE Security
• Will Jolliffe

See release notes for the content changes here See a summary of STIX data model changes here

This release promotes the Mobile sub-techniques from beta to stable. It also fixes a few minor STIX abnormalities for ICS Techniques.

Techniques

Minor Technique changes

• Account Manipulation: Additional Cloud Credentials
• Account Manipulation: Additional Cloud Roles
• Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
• Create or Modify System Process: Windows Service
• Credentials from Password Stores: Windows Credential Manager
• Data from Local System
• Impair Defenses: Downgrade Attack
• Ingress Tool Transfer
• Network Sniffing
• OS Credential Dumping: LSASS Memory
• Obfuscated Files or Information: HTML Smuggling
• System Binary Proxy Execution: MMC
• System Binary Proxy Execution: Verclsid
• System Network Configuration Discovery
• Use Alternate Authentication Material: Application Access Token
• User Execution: Malicious File

Software

Minor Software changes

• AdFind
• Backdoor.Oldrea
• Bad Rabbit
• BlackEnergy
• Conficker
• Duqu
• EKANS
• Flame
• Industroyer
• IronNetInjector
• KillDisk
• LockerGoga
• NotPetya
• Stuxnet
• WannaCry

Groups

Minor Group changes

• APT33
• Andariel
• Dragonfly
• Ke3chang
• Kimsuky
• Lazarus Group
• OilRig
• Sandworm Team
• TEMP.Veles

Data Sources and/or Components

Minor Data Source and/or Component changes

• Application Log
• Windows Registry

Contributors to this release

• Dragos Threat Intelligence
• Hiroki Nagahama, NEC Corporation
• Joe Slowik - Dragos
• Krishnan Subramanian, @krish203
• Manikantan Srinivasan, NEC Corporation India
• Vinay Pidathala
• Zur Ulianitzky, XM Cyber

Updates to the v11 beta release for Mobile ATT&CK with sub-techniques.

Learn more about it here

Techniques

Minor Technique changes

• Hide Artifacts: Suppress Application Icon

Software

Minor Software changes

• DroidJack

Groups

Minor Group changes

• Sandworm Team

Updates to the v11 beta release for Mobile ATT&CK with sub-techniques.

Learn more about it here

Mobile

Minor Technique changes

• Audio Capture
• Event Triggered Execution
• Exfiltration Over Alternative Protocol
• Out of Band Data
• Protected User Data: Call Log