MITRE ATT&CK CDF

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

MITRE Enterprise ATT&CK

The MITRE Enterprise ATT&CK feed retrieves the content of the Enterprise ATT&CK collection. It retrieves a list of adversaries, intrusion set, course of actions, malware objects, attack partners and tools, along with their attributes.

Sample Response:

{
  "objects": [
    {
      "created": "2021-10-08T14:06:28.212Z",
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "description": "Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls..",
      "external_references": [
        {
          "external_id": "T1562.010",
          "source_name": "mitre-attack",
          "url": "https://attack.mitre.org/techniques/T1562/010"
        },
        {
          "description": "Falcon Complete Team. (2021, May 11). Response When Minutes Matter: Rising Up Against Ransomware. Retrieved October 8, 2021.",
          "source_name": "CrowdStrike BGH Ransomware 2021",
          "url": "https://www.crowdstrike.com/blog/how-falcon-complete-stopped-a-big-game-hunting-ransomware-attack/"
        }
      ],
      "id": "attack-pattern--824add00-99a1-4b15-9a2d-6c5683b7b497",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-evasion"
        }
      ],
      "modified": "2021-10-15T00:48:06.723Z",
      "name": "Downgrade Attack",
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "type": "attack-pattern",
      "x_mitre_data_sources": [
        "Command: Command Execution",
        "Process: Process Creation"
      ],
      "x_mitre_detection": "Monitor for commands or other activity that may be indicative of attempts to abuse older or deprecated technologies (ex: <code>powershell –v 2</code>). ",
      "x_mitre_is_subtechnique": true,
      "x_mitre_permissions_required": [
        "User"
      ],
      "x_mitre_platforms": [
        "Windows"
      ],
      "x_mitre_version": "1.0",
      "x_mitre_system_requirements": [
        "Some folders may require Administrator, SYSTEM or specific user depending on permission levels and access controls"
      ],
      "x_mitre_is_subtechnique:" true,
      "x_mitre_network_requirements": true
    }
  ]
}

ThreatQuotient provides the following default mapping for this feed:

MITRE Mobile ATT&CK

This feed retrieves the content of the Mobile ATT&CK collection. It retrieves a list of adversaries, intrusion set, course of actions, malware objects, attack partners and tools, along with their attributes.

Sample Response:

{
  "objects": [
    {
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "x_mitre_version": "1.1",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "url": "https://attack.mitre.org/groups/G0112",
          "external_id": "G0112"
        },
        {
          "source_name": "Bahamut",
          "description": "(Citation: SANS Windshift August 2018)"
        },
        {
          "url": "https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1554718868.pdf",
          "source_name": "SANS Windshift August 2018",
          "description": "Karim, T. (2018, August). TRAILS OF WINDSHIFT. Retrieved June 25, 2020."
        }
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "created": "2020-06-25T17:16:39.168Z",
      "id": "intrusion-set--afec6dc3-a18e-4b62-b1a4-5510e1a498d1",
      "aliases": ["Windshift", "Bahamut"],
      "modified": "2021-04-26T14:37:33.234Z",
      "type": "intrusion-set",
      "name": "Windshift",
      "description": "[Windshift](https://attack.mitre.org/groups/G0112) is a threat group that has been active since at least 2017..."
    }
  ]
}

ThreatQuotient provides the following default mapping for this feed:

MITRE ICS ATT&CK

The MITRE ICS ATT&CK feed retrieves the content of the ICS ATT&CK collection. It retrieves a list of adversaries, intrusion set, campaigns, course of actions, malware objects, attack patterns and tools, along with their attributes.

Sample Response:

{
  "objects": [
    {
      "modified": "2023-10-13T17:57:06.171Z",
      "name": "Loss of Safety",
      "description": "Adversaries may compromise safety system functions designed to maintain safe operation of a process when unacceptable or dangerous conditions occur. Safety systems are often composed of the same elements as control systems but have the sole purpose of ensuring the process fails in a predetermined safe manner. \n\nMany unsafe conditions in process control happen too quickly for a human operator to react to. Speed is critical in correcting these conditions to limit serious impacts such as Loss of Control and Property Damage. \n\nAdversaries may target and disable safety system functions as a prerequisite to subsequent attack execution or to allow for future unsafe conditionals to go unchecked. Detection of a Loss of Safety by operators can result in the shutdown of a process due to strict policies regarding safety systems. This can cause a Loss of Productivity and Revenue and may meet the technical goals of adversaries seeking to cause process disruptions.",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-ics-attack",
          "phase_name": "impact"
        }
      ],
      "x_mitre_attack_spec_version": "2.1.0",
      "x_mitre_deprecated": false,
      "x_mitre_detection": "",
      "x_mitre_domains": ["ics-attack"],
      "x_mitre_is_subtechnique": false,
      "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "x_mitre_platforms": ["None"],
      "x_mitre_version": "1.0",
      "type": "attack-pattern",
      "id": "attack-pattern--5fa00fdd-4a55-4191-94a0-564181d7fec2",
      "created": "2020-05-21T17:43:26.506Z",
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "revoked": false,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "url": "https://attack.mitre.org/techniques/T0880",
          "external_id": "T0880"
        }
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ]
    }
  ]
}

ThreatQuotient provides the following default mapping for this feed:

PDF Guides