Updates to the v11 beta release for Mobile ATT&CK with sub-techniques.

Learn more about it here

Techniques

Minor Technique changes

• Hide Artifacts: Suppress Application Icon

Software

Minor Software changes

• DroidJack

Groups

Minor Group changes

• Sandworm Team

Updates to the v11 beta release for Mobile ATT&CK with sub-techniques.

Learn more about it here

Mobile

Minor Technique changes

• Audio Capture
• Event Triggered Execution
• Exfiltration Over Alternative Protocol
• Out of Band Data
• Protected User Data: Call Log

Techniques

Enterprise

Technique changes

• Exploitation for Credential Access
• Exploitation for Defense Evasion
• Hardware Additions
• Obfuscated Files or Information: Indicator Removal from Tools
• Supply Chain Compromise
  • Compromise Hardware Supply Chain
  • Compromise Software Dependencies and Development Tools
  • Compromise Software Supply Chain

Minor Technique changes

• Access Token Manipulation
  • Parent PID Spoofing
• Account Manipulation: Device Registration
• Deobfuscate/Decode Files or Information
• Execution Guardrails
  • Environmental Keying
• Hide Artifacts: Resource Forking
• Hijack Execution Flow
  • DLL Side-Loading
  • Dylib Hijacking
  • Path Interception by PATH Environment Variable
  • Services Registry Permissions Weakness
• Indirect Command Execution
• Masquerading
  • Match Legitimate Name or Location
• Network Boundary Bridging
• Obfuscated Files or Information
  • HTML Smuggling
• Rootkit
• Subvert Trust Controls
  • Code Signing Policy Modification
  • Gatekeeper Bypass
  • Mark-of-the-Web Bypass
  • SIP and Trust Provider Hijacking
• Trusted Developer Utilities Proxy Execution
• Valid Accounts
• XSL Script Processing

Software

Enterprise

Minor Software changes

• Chrommme
• Gelsemium

Groups

Enterprise

Minor Group changes

• Kimsuky

Group deprecations

• Gelsemium

Data Sources and/or Components

Enterprise

Minor Data Source and/or Component changes

• Domain Name: Active DNS

Contributors to this release

• Dongwook Kim, KISA
• Mike Moran

This is the beta release for Mobile ATT&CK with sub-techniques. Learn more about it here

See release notes for the content changes here See a summary of STIX changes here

Techniques

Enterprise

Technique changes:

• Create or Modify System Process: Launch Agent

Minor Technique changes:

• Create or Modify System Process
• Reflective Code Loading

Mobile

Minor Technique changes:

• Install Insecure or Malicious Configuration

Software

Enterprise

Minor Software changes:

• BS2005
• Kobalos
• MarkiRAT

Software deprecations:

• TRITON

Mobile

Minor Software changes:

• Monokle

Groups

Enterprise

Minor Group changes:

• Ferocious Kitten
• Ke3chang
• Orangeworm
• Patchwork
• Transparent Tribe
• Winnti Group

Data Sources and/or Components

Enterprise

Minor Data Source and/or Component changes:

• Active Directory
• Cloud Service
• Cloud Storage
• Cluster
• Command
• Container
• Drive
• Driver
• File
• Firewall
• Firmware
• Group
• Image
• Kernel
• Logon Session
• Module
• Named Pipe
• Network Share
• Network Traffic
• Pod
• Process
• Scheduled Job
• Script
• Sensor Health
• Service
• Snapshot
• User Account
• Volume
• WMI

Contributors to this release

• Center for Threat-Informed Defense (CTID)
• Hiroki Nagahama, NEC Corporation
• Lior Ribak, SentinelOne
• Manikantan Srinivasan, NEC Corporation India
• Pooja Natarajan, NEC Corporation India

• See release notes for the content changes here
• See a summary of STIX changes here

• See release notes for the content changes here
• See a summary of STIX changes here

ATT&CK version 8.2 contains new reporting for the activity related to the SolarWinds supply chain injection.

New Techniques:

• Domain Policy Modification: Domain Trust Modification
• Domain Policy Modification: Group Policy Modification
• Forge Web Credentials
  • SAML Tokens
  • Web Cookies

Technique changes:

• Account Manipulation: Additional Cloud Credentials
• Domain Policy Modification

New Software:

• AdFind
• BloodHound
• Raindrop
• Sunburst
• Sunspot
• Teardrop

New Groups:

• UNC2452

Fixes

• Various fixes to the ics-attack STIX format (see #122)
• Fixed typo "stressor" to "stresser"
• Fixed type and version for S0154
• Fixed contributors for T1598, T1598.001, T1598.002, T1598.003, and S0514

Additions

• new reporting and procedure examples for G0102