Analytics
-- Analytics contain platform-specific detection logic and represent the - implementation details of a detection strategy. -
-Analytics: {{ parsed.total_count }}
-| ID | -Platform | -
-
- Domain
-
-
-
-
-
- |
- Detection Strategy | -Description | -
|---|---|---|---|---|
| - {{ row.id | upper }} - | -{{ row.platforms|join(", ") }} | -
- {% for domain in row.domains %}
- {{ domain }} - {% endfor %} - |
-
- {% set dets = row.detection_strategy %}
- {% for det in dets %}
- {{ det.id | upper }}
- - {% endfor %} - |
- - {% if row.deprecated %} - ****Deprecation Warning**** - {% endif %} - {{ clean_output.stixToHTML(row.description) }} - | -
Analytics
++ Analytics contain platform-specific detection logic and represent the + implementation details of a detection strategy. +
+Analytics: {{ parsed.total_count }}
+| ID | +Platform | +
+
+ Domain
+
+
-
-
+
+
+
|
+ Detection Strategy | +Description | +
|---|---|---|---|---|
| + {{ row.id | upper }} + | +{{ row.platforms|join(", ") }} | +
+ {% for domain in row.domains %}
+ {{ domain }} + {% endfor %} + |
+
+ {% set dets = row.detection_strategy %}
+ {% for det in dets %}
+ {{ det.id | upper }}
+ + {% endfor %} + |
+ + {% if row.deprecated %} + ****Deprecation Warning**** + {% endif %} + {{ clean_output.stixToHTML(row.description) }} + | +
{{ parsed.name }}
- - {% if parsed.deprecated %} - {% if parsed.descr %} - {{ deprecated.deprecated(clean_output.stixToHTML(parsed.descr, firstParagraphOnly=True)) }} - {% else %} - {{ deprecated.deprecated("This asset has been deprecated.") }} - {% endif %} - {% else %} -Related Assets
-| Name | -Sectors | -Description | -
|---|---|---|
| {{ related_asset.name }} | -{{ related_asset.sectors }} | -- {{ clean_output.stixToHTML(related_asset.descr, parsed.citations) }} - | -
{{ parsed.name }}
- {% if parsed.technique_table_data %} - {{ navigator.layer_links(parsed.attack_id, "assets", parsed.layers) }} - {{ techniques_used.techniques_used(parsed.technique_table_data, "Techniques", true, "", parsed.citations) }} - {% endif %} - - {{ citations.reference_section(parsed.citations) }} - {% endif %} + {% if parsed.deprecated %} + {% if parsed.descr %} + {{ deprecated.deprecated(clean_output.stixToHTML(parsed.descr, firstParagraphOnly=True)) }} + {% else %} + {{ deprecated.deprecated("This asset has been deprecated.") }} + {% endif %} + {% else %} +Related Assets
+| Name | +Sectors | +Description | +
|---|---|---|
| {{ related_asset.name }} | +{{ related_asset.sectors }} | ++ {{ clean_output.stixToHTML(related_asset.descr, parsed.citations) }} + | +
Assets
-- Assets represent the devices and systems commonly found within Industrial Control System environments. Each asset object includes a mapping of technique relationships that represent the adversary actions that may target the device based on its capability and function. -
-- Often, these devices have different names or sector specific terms as you look across the industry. To track these differences more accurately, we use the “Related Assets” field which associates these terms based on similar functions, architectural location, and exposure to similar adversary techniques. Each related asset includes a name, optional sector identifier, and a description to provide nuance to the asset page definition. -
-- Although originally represented under the platform field in ATT&CK, Assets are distinctly separate from platforms. Platforms generally describe the operating system or application (i.e., Microsoft Windows) while Assets represent the device which includes considerations for hardware, software, architecture, systems, and intended function. Assets may leverage platforms to describe a device’s commonly observed operating system. -
-Assets: {{ parsed.assets_list_len }}
-| ID | -Name | -Domain | -Description | -
|---|---|---|---|
| - {{ row.id | upper }} - | -- {{ row.name }} - | -
- {% for dom in row.domains %}
- {{dom}}
- - {% endfor %} - |
- - {% if row.deprecated %} - ****Deprecation Warning**** - {% endif %} - {{ clean_output.stixToHTML(row.descr) }} - | -
Assets
++ Assets represent the devices and systems commonly found within Industrial Control System environments. Each + asset object includes a mapping of technique relationships that represent the adversary actions that may + target the device based on its capability and function. +
++ Often, these devices have different names or sector specific terms as you look across the industry. To track + these differences more accurately, we use the “Related Assets” field which associates these terms based on + similar functions, architectural location, and exposure to similar adversary techniques. Each related asset + includes a name, optional sector identifier, and a description to provide nuance to the asset page + definition. +
++ Although originally represented under the platform field in ATT&CK, Assets are distinctly separate from + platforms. Platforms generally describe the operating system or application (i.e., Microsoft Windows) while + Assets represent the device which includes considerations for hardware, software, architecture, systems, and + intended function. Assets may leverage platforms to describe a device’s commonly observed operating system. +
+Assets: {{ parsed.assets_list_len }}
+| ID | +Name | +Domain | +Description | +
|---|---|---|---|
| + {{ row.id | upper }} + | ++ {{ row.name }} + | +
+ {% for dom in row.domains %}
+ {{dom}}
+ + {% endfor %} + |
+ + {% if row.deprecated %} + ****Deprecation Warning**** + {% endif %} + {{ clean_output.stixToHTML(row.descr) }} + | +
Benefactors Program
-- MITRE ATT&CK® is a globally-accessible, community-driven knowledge base of adversary tactics and techniques based on real-world observations. - The ATT&CK framework is used as a blueprint for the development of specific threat models and methodologies across the - private sector, government, and the cybersecurity product and service community. - Benefactors sustain and advance ATT&CK through their financial contributions, - ensuring that it adapts along with evolving cyber threats and changing environments. -
-Benefactors
-- Become an ATT&CK Benefactor! - Benefactors help propel the evolution of ATT&CK through financial contributions. - Donations directly support framework progression, pioneering research into underrepresented domains and emerging threats, and community engagement. - To show our thanks, ATT&CK benefactors are also the recipient of many benefits, including public recognition as a benefactor of MITRE ATT&CK - as well as briefings with the ATT&CK leadership team. -
-- You can find additional information and opportunities with the benefactor program at the program link below. - You are welcome to email us with any questions or concerns. -
- - - - - - -ATT&CK Benefactors
- Thanks to the following companies who have supported ATT&CK! --
Advocates
-Friends
--
Supporters
-Benefactors Program
++ MITRE ATT&CK® is a globally-accessible, community-driven knowledge base of adversary tactics and techniques based + on real-world observations. + The ATT&CK framework is used as a blueprint for the development of specific threat models and methodologies across + the + private sector, government, and the cybersecurity product and service community. + Benefactors sustain and advance ATT&CK through their financial contributions, + ensuring that it adapts along with evolving cyber threats and changing environments. +
+Benefactors
++ Become an ATT&CK Benefactor! + Benefactors help propel the evolution of ATT&CK through financial contributions. + Donations directly support framework progression, pioneering research into underrepresented domains and emerging + threats, and community engagement. + To show our thanks, ATT&CK benefactors are also the recipient of many benefits, including public recognition as a + benefactor of MITRE ATT&CK + as well as briefings with the ATT&CK leadership team. +
++ You can find additional information and opportunities with the benefactor program at the program link below. + You are welcome to email us with any questions or concerns. +
+ + + + + + +ATT&CK Benefactors
+ Thanks to the following companies who have supported ATT&CK! ++
Advocates
+Friends
++
Supporters
+Supporters
-{% endblock %} +{% endblock %} \ No newline at end of file diff --git a/modules/blog/blog_config.py b/modules/blog/blog_config.py index b26974ea252..40cddf33c3e 100644 --- a/modules/blog/blog_config.py +++ b/modules/blog/blog_config.py @@ -1,2 +1,2 @@ module_name = "Blog" -priority = 10 +priority = 11 diff --git a/modules/campaigns/templates/campaign.html b/modules/campaigns/templates/campaign.html index 874baadaa8f..9ae1d40a405 100644 --- a/modules/campaigns/templates/campaign.html +++ b/modules/campaigns/templates/campaign.html @@ -1,10 +1,10 @@ {% extends "general/two-column.html" %} {% set parsed = page.data | from_json %} {% if parsed.aliases_list %} - {% set alias_string = parsed.aliases_list|join(", ") %} - {% set title = parsed.name + ", " + alias_string + ", Campaign " + parsed.attack_id + " | MITRE ATT&CK®" -%} +{% set alias_string = parsed.aliases_list|join(", ") %} +{% set title = parsed.name + ", " + alias_string + ", Campaign " + parsed.attack_id + " | MITRE ATT&CK®" -%} {% else %} - {% set title = parsed.name + ", Campaign " + parsed.attack_id + " | MITRE ATT&CK®" -%} +{% set title = parsed.name + ", Campaign " + parsed.attack_id + " | MITRE ATT&CK®" -%} {% endif %} {% set active_page = "campaigns" -%} @@ -19,11 +19,11 @@ {% import 'macros/notes.html' as notes %} {% block head %} - {{ super () }} - {% if parsed.deprecated %} - - {% endif %} -{% endblock %} +{{ super () }} +{% if parsed.deprecated %} + +{% endif %} +{% endblock %} {% block innerleft %} @@ -34,239 +34,244 @@ {% block innerright %} {{ super () }} - - -{{ parsed.name }}
+ +{{ parsed.name }}
- {% if parsed.deprecated %} - {% if parsed.descr %} - {{ deprecated.deprecated(clean_output.stixToHTML(parsed.descr, firstParagraphOnly=True)) }} - {% else %} - {{ deprecated.deprecated("This campaign has been deprecated.") }} - {% endif %} - {% else %} -Associated Campaign Descriptions
-| Name | -Description | -
|---|---|
| - {{ alias.name }} - | -- {{ clean_output.stixToHTML(alias.descr, parsed.citations) }} - | -
Groups
-| ID | -Name | -Description | -
|---|---|---|
| - {{group.id}} - | -- {{group.name}} - | -- {% if group.desc %} - {{clean_output.stixToHTML(group.desc, parsed.citations)}} - {% endif %} - | -
Associated Campaign Descriptions
+| Name | +Description | +
|---|---|
| + {{ alias.name }} + | ++ {{ clean_output.stixToHTML(alias.descr, parsed.citations) }} + | +
Groups
+| ID | +Name | +Description | +
|---|---|---|
| + {{group.id}} + | ++ {{group.name}} + | ++ {% if group.desc %} + {{clean_output.stixToHTML(group.desc, parsed.citations)}} + {% endif %} + | +
Software
-| ID | -Name | -Description | -
|---|---|---|
| - {{software.id}} - | -- {{software.name}} - | -- {% if software.desc %} - {{clean_output.stixToHTML(software.desc, parsed.citations)}} - {% endif %} - | -
Software
+| ID | +Name | +Description | +
|---|---|---|
| + {{software.id}} + | ++ {{software.name}} + | ++ {% if software.desc %} + {{clean_output.stixToHTML(software.desc, parsed.citations)}} + {% endif %} + | +
Campaigns
-- The security community tracks intrusion activity using various analytic methodologies and terms, such as operations, intrusion sets, and campaigns. - Some intrusion activity may be referenced by a variety of names due to different organizations tracking similar activity, often from different vantage points; - conversely other times reported activity is not given a designated name. -
-- Malicious cyber activity may be attributed to a threat group, or referenced as unattributed activity. - Alternatively, complex cyber operations may involve multiple affiliated or unaffiliated groups, with each playing a unique role - (ie. initial access, data exfiltration, etc). -
-- For the purposes of the Campaigns page, the MITRE ATT&CK team uses the term Campaign to describe any grouping of intrusion activity - conducted over a specific period of time with common targets and objectives. - Unnamed intrusion activity is cited using a unique ATT&CK identifier, otherwise the team will use the activity name as noted in public reporting. - For named Campaigns, the team makes a best effort to track overlapping names, which are designated as “Associated Campaigns” on each page, - as we believe these overlaps are useful for analysts. - Campaign entries will also be attributed to ATT&CK Group and Software pages, when possible, based on public reporting; - unattributed activity will simply reference “threat actors” in the procedure example. -
-- Campaigns are mapped to publicly reporting techniques and original references are included. - The information provided does not represent all possible techniques used in a Campaign but rather a subset that is available through open source reporting. -
+{{ super () }} + + +Campaigns
++ The security community tracks intrusion activity using various analytic methodologies and terms, such as + operations, intrusion sets, and campaigns. + Some intrusion activity may be referenced by a variety of names due to different organizations tracking + similar activity, often from different vantage points; + conversely other times reported activity is not given a designated name. +
++ Malicious cyber activity may be attributed to a threat group, or referenced as unattributed activity. + Alternatively, complex cyber operations may involve multiple affiliated or unaffiliated groups, with each + playing a unique role + (ie. initial access, data exfiltration, etc). +
++ For the purposes of the Campaigns page, the MITRE ATT&CK team uses the term Campaign to describe any + grouping of intrusion activity + conducted over a specific period of time with common targets and objectives. + Unnamed intrusion activity is cited using a unique ATT&CK identifier, otherwise the team will use the + activity name as noted in public reporting. + For named Campaigns, the team makes a best effort to track overlapping names, which are designated as + “Associated Campaigns” on each page, + as we believe these overlaps are useful for analysts. + Campaign entries will also be attributed to ATT&CK Group and Software pages, when possible, based on public + reporting; + unattributed activity will simply reference “threat actors” in the procedure example. +
++ Campaigns are mapped to publicly reporting techniques and original references are included. + The information provided does not represent all possible techniques used in a Campaign but rather a subset + that is available through open source reporting. +
-Campaigns: {{ parsed.campaigns_list_len }}
-| ID | -Name | - - - -Description | -
|---|---|---|
| - {{ row.id | upper }} - | -- {{ row.name }} - | - - - -- {% if row.deprecated %} - ****Deprecation Warning**** - {% endif %} - {{ clean_output.stixToHTML(row.descr) }} - | -
Campaigns: {{ parsed.campaigns_list_len }}
+| ID | +Name | + + + +Description | +
|---|---|---|
| + {{ row.id | upper }} + | ++ {{ row.name }} + | + + + ++ {% if row.deprecated %} + ****Deprecation Warning**** + {% endif %} + {{ clean_output.stixToHTML(row.descr) }} + | +
Contribute
++ ATT&CK is in a constant state of development and is based on behavior that has been observed in real-world + malicious intrusions/attacks ("in the wild"). We do not add hypothetical techniques, lab-only proofs of + concept, or behaviors that have only been used in red team exercises without evidence of use by real adversaries. + If you have information about adversary behavior that is not yet represented in ATT&CK, we would like to hear from you! +
++ We're especially looking for contributions in the areas below. Please note that we are not able to add every suggested + technique, sub-technique, Group, Campaign, or piece of Software to ATT&CK. We prioritize contributions that improve + coverage of commonly used adversary behaviors and that are supported by clear, public references. If you have other + information you think may be useful, please ask us a question below. +
++ Due to the high volume of contributions, we may not be able to respond to every submission individually, + and we cannot guarantee that a contribution will be added to ATT&CK. We recommend you read our + philosophy paper + to understand our approach to maintaining ATT&CK so that we get the right details up front. + Content updates happen roughly every 6 months. +
++ Before sending a contribution, please search ATT&CK for existing techniques, sub-techniques, Groups, or Software that + may already describe your example. In your message, let us know which ATT&CK entries you checked and why you think your + information is new or different. Many contributions are used to strengthen existing entries rather than create new ones. + If your example is already covered by an existing technique or does not meet the criteria above, + we will not create a new technique or sub-technique for it. +
++
What we're looking for
+ ++ Please include: +
-
+
- a brief description of the behavior +
- references or other evidence showing where real adversaries used it +
- which existing ATT&CK technique(s) or sub-technique(s) it is closest to +
- a short explanation of how this behavior is different from what ATT&CK already describes +
+ To understand the process of how the MITRE team develops techniques, refer to the video below.", + buttons=[ + {"label": "See an example", "url": "#techniques-modal", "card_modal": "techniques-modal"}, + {"label": "Video", "url": "https://youtu.be/v24a5IOwObc?si=TuG_-WrknY4r7pkC"} + ], + fa_icon=None, invert_icon=True, header_background=True, footer_description=None, header_subtitle=None)}} + + {{contact_card.render("Threat Intelligence", "", + "We map selected Group and Software examples on our site and appreciate referenced information about how + Groups and Software use ATT&CK techniques. Please be aware that we cannot add every Group, campaign, or + piece of Software that is reported publicly. We prioritize items that have clear, publicly available reporting + and broad relevance to the community. +
+ Please share: +
-
+
- the technique or sub-technique ID and name +
- the Group or Software name +
- a brief description of how the technique is implemented +
- at least one publicly available reference +
Contributors
++ The following individuals or organizations have contributed information + regarding the existence of a technique, details on how to detect and/or mitigate + use of a technique, or threat intelligence on adversary use: +
+-
+ {% for row in col %}
+
- + {{row}} + + {% endfor %} +
+ Thanks to those who have contributed to ATT&CK! +
+- {{ parsed.name }} -
+ - {% if parsed.deprecated %} - {% if parsed.description %} - {{ deprecated.deprecated(clean_output.stixToHTML(parsed.description, firstParagraphOnly=True)) }} - {% else %} - {{ deprecated.deprecated("This data component has been deprecated.") }} - {% endif %} - {% else %} -Log Sources
-| Name | -Channel | -
|---|---|
| {{ log_source.name }} | -{{ log_source.channel }} | -
Detection Strategy
- {{detection_strategies_table_datacomponents.detection_strategies_table_datacomponents(parsed.detectionstrategies)}} - {% endif %} ++ {{ parsed.name }} +
- {{ citations.reference_section(parsed.citations) }} - {% endif %} + {% if parsed.deprecated %} + {% if parsed.description %} + {{ deprecated.deprecated(clean_output.stixToHTML(parsed.description, firstParagraphOnly=True)) }} + {% else %} + {{ deprecated.deprecated("This data component has been deprecated.") }} + {% endif %} + {% else %} +Log Sources
+| Name | +Channel | +
|---|---|
| {{ log_source.name }} | +{{ log_source.channel }} | +
Detection Strategy
+ {{detection_strategies_table_datacomponents.detection_strategies_table_datacomponents(parsed.detectionstrategies)}} + {% endif %} + + {{ citations.reference_section(parsed.citations) }} + {% endif %} +Data Components
-- Data Components identify the specific properties/values relevant to detecting a given ATT&CK technique or sub-technique. -
-Data Components: {{ parsed.total_count }}
-| ID | -Name | -
-
- Domain
-
-
-
-
-
- |
- Description | -
|---|---|---|---|
| - {{ row.id | upper }} - | -- {% if row.deprecated %} - ****Deprecation Warning**** - {% endif %} - {{ row.name }} - | -
- {% for domain in row.domains %}
- {{ domain }}
- - {% endfor %} - |
- - {{clean_output.stixToHTML(row.description, firstParagraphOnly=True)}} - | -
Data Components
++ Data Components identify the specific properties/values relevant to detecting a given ATT&CK technique or + sub-technique. +
+Data Components: {{ parsed.total_count }} +
+| ID | +Name | +
+
+ Domain
+
+
-
-
+
+
+
|
+ Description | +
|---|---|---|---|
| + {{ row.id | upper }} + | ++ {% if row.deprecated %} + ****Deprecation Warning**** + {% endif %} + {{ row.name }} + | +
+ {% for domain in row.domains %}
+ {{ domain }}
+ + {% endfor %} + |
+ + {{clean_output.stixToHTML(row.description, firstParagraphOnly=True)}} + | +
- {{parsed.name}} -
- {% if parsed.deprecated %} - {% if parsed.descr %} - {{ deprecated.deprecated(clean_output.stixToHTML(parsed.descr, firstParagraphOnly=True)) }} - {% else %} - {{ deprecated.deprecated("This data source has been deprecated.") }} - {% endif %} - {% else %} -+ {{parsed.name}} +
+ {% if parsed.deprecated %} + {% if parsed.descr %} + {{ deprecated.deprecated(clean_output.stixToHTML(parsed.descr, firstParagraphOnly=True)) }} + {% else %} + {{ deprecated.deprecated("This data source has been deprecated.") }} + {% endif %} + {% else %} +Data Sources
-Data sources represent the various subjects/topics of information that can be collected by sensors/logs. Data sources also include data components, which identify specific properties/values of a data source relevant to detecting a given ATT&CK technique or sub-technique.
- -| ID - - - | -Name - - - | -
-
- Domain
-
-
-
-
-
- |
- Description | -
|---|---|---|---|
| - {{row.id|upper}} - | -- {{row.name}} - | -
- {% for dom in row.domains %}
- {{dom}}
- - {% endfor %} - |
- - {% if row.deprecated %} - ****Deprecation Warning**** - {% endif %} - {{clean_output.stixToHTML(row.descr)}} - | -
Data Sources
+Data sources represent the various subjects/topics of information that can be collected by sensors/logs. + Data sources also include data components, which identify specific properties/values of a data source + relevant to detecting a given ATT&CK technique or sub-technique.
+ +| ID + + + | +Name + + + | +
+
+ Domain
+
+
-
+
+
+
- |
+ Description | +
|---|---|---|---|
| + {{row.id|upper}} + | ++ {{row.name}} + | +
+ {% for dom in row.domains %}
+ {{dom}}
+ + {% endfor %} + |
+ + {% if row.deprecated %} + ****Deprecation Warning**** + {% endif %} + {{clean_output.stixToHTML(row.descr)}} + | +
Detection Strategies
-- Detection strategies define high-level approaches for detecting specific - adversary techniques. They serve as containers that organize multiple - platform-specific analytics into cohesive detection methodologies. -
-Detection Strategies: {{ parsed.total_count }}
-| ID | -Name | -
-
- Domain
-
-
-
-
-
- |
-
|---|---|---|
| - {{ row.id | upper }} - | -- {% if row.deprecated %} - ****Deprecation Warning**** - {% endif %} - {{ row.name }} - | -
- {% for dom in row.domains %}
- {{dom}}
- - {% endfor %} - |
-
Detection Strategies
++ Detection strategies define high-level approaches for detecting specific + adversary techniques. They serve as containers that organize multiple + platform-specific analytics into cohesive detection methodologies. +
+Detection Strategies: {{ parsed.total_count + }}
+| ID | +Name | +
+
+ Domain
+
+
-
-
+
+
+
|
+
|---|---|---|
| + {{ row.id | upper }} + | ++ {% if row.deprecated %} + ****Deprecation Warning**** + {% endif %} + {{ row.name }} + | +
+ {% for dom in row.domains %}
+ {{dom}}
+ + {% endfor %} + |
+
- {{ parsed.name }} -
+- Technique Detected: - - {{parsed.technique_detected.name}} | {{parsed.technique_detected.attack_id}} - -
- {% if parsed.technique_detected.detects %} -+ {{ parsed.name }} +
- {% if parsed.analytics %} -Analytics
- -{{ analytic.id }}
-+ Technique Detected: + + {{parsed.technique_detected.name}} | {{parsed.technique_detected.attack_id}} + +
+ {% if parsed.technique_detected.detects %} +Log Sources
-| Data Component | -Name | -Channel | -
|---|---|---|
| - - {{ datacomponent.name }} ({{ datacomponent_id }}) - - | - {% endif %} -{{ log_source.name }} | -{{ log_source.channel }} | -
Analytics
+ +{{ analytic.id }}
+Mutable Elements
-| Field | -Description | -
|---|---|
| {{ elem.field }} | -{{ elem.description }} | -
Log Sources
+| Data Component | +Name | +Channel | +
|---|---|---|
| + + {{ datacomponent.name }} ({{ datacomponent_id }}) + + | + {% endif %} +{{ log_source.name }} | +{{ log_source.channel }} | +
Mutable Elements
+| Field | +Description | +
|---|---|
| {{ elem.field }} | +{{ elem.description }} | +
- {{ parsed.name }} -
+ ++ {{ parsed.name }} +
- {% if parsed.deprecated %} - {% if parsed.descr %} - {{ deprecated.deprecated(clean_output.stixToHTML(parsed.descr, firstParagraphOnly=True)) }} - {% else %} - {{ deprecated.deprecated("This group has been deprecated.") }} - {% endif %} - {% else %} -Associated Group Descriptions
-| Name | -Description | -
|---|---|
| - {{ alias.name }} - | -- {{ clean_output.stixToHTML(alias.descr, parsed.citations) }} - | -
Campaigns
-| ID | -Name | -First Seen | -Last Seen | -References | -Techniques | -
|---|---|---|---|---|---|
| - {{campaign.id}} - | -- {{campaign.name}} - | -{{campaign.first_seen}}{{ clean_output.stixToHTML(campaign.first_seen_citation, parsed.citations, convert=False) }} | -{{campaign.last_seen}}{{ clean_output.stixToHTML(campaign.last_seen_citation, parsed.citations, convert=False) }} | -- {% if campaign.desc %} - {{clean_output.stixToHTML(campaign.desc, parsed.citations)}} - {% endif %} - | -- {% for technique in campaign.techniques %} - {% if technique.parent_id %} - {{ technique.name }}: {{technique.sub_name}}{% if not loop.last %}, {% endif %} - {% else %} - {{ technique.name }}{% if not loop.last %}, {% endif %} - {% endif %} - {% endfor %} - | -
Associated Group Descriptions
+| Name | +Description | +
|---|---|
| + {{ alias.name }} + | ++ {{ clean_output.stixToHTML(alias.descr, parsed.citations) }} + | +
Campaigns
+| ID | +Name | +First Seen | +Last Seen | +References | +Techniques | +
|---|---|---|---|---|---|
| + {{campaign.id}} + | ++ {{campaign.name}} + | +{{campaign.first_seen}}{{ + clean_output.stixToHTML(campaign.first_seen_citation, parsed.citations, convert=False) }} | +{{campaign.last_seen}}{{ + clean_output.stixToHTML(campaign.last_seen_citation, parsed.citations, convert=False) }} | ++ {% if campaign.desc %} + {{clean_output.stixToHTML(campaign.desc, parsed.citations)}} + {% endif %} + | ++ {% for technique in campaign.techniques %} + {% if technique.parent_id %} + {{ technique.name }}: {{technique.sub_name}}{% if not + loop.last %}, {% endif %} + {% else %} + {{ technique.name }}{% if not loop.last %}, {% endif %} + {% endif %} + {% endfor %} + | +
Software
-| ID | -Name | - {% if parsed.add_software_ref == True %} -References | - {% endif %} -Techniques | -
|---|---|---|---|
| - {{ software.id }} - | -- {{ software.name }} - | - {% if parsed.add_software_ref == True %} -- {{ clean_output.stixToHTML(software.descr, parsed.citations, firstParagraphOnly=True) }} - | - {% endif %} -- {% for technique in software.techniques %} - {% if technique.parent_id %} - {{ technique.name }}: {{technique.sub_name}}{% if not loop.last %}, {% endif %} - {% else %} - {{ technique.name }}{% if not loop.last %}, {% endif %} - {% endif %} - {% endfor %} - | -
Software
+| ID | +Name | + {% if parsed.add_software_ref == True %} +References | + {% endif %} +Techniques | +
|---|---|---|---|
| + {{ software.id }} + | ++ {{ software.name }} + | + {% if parsed.add_software_ref == True %} ++ {{ clean_output.stixToHTML(software.descr, parsed.citations, firstParagraphOnly=True) }} + | + {% endif %} ++ {% for technique in software.techniques %} + {% if technique.parent_id %} + {{ technique.name }}: {{technique.sub_name}}{% if not + loop.last %}, {% endif %} + {% else %} + {{ technique.name }}{% if not loop.last %}, {% endif %} + {% endif %} + {% endfor %} + | +
Groups
-- Groups are activity clusters that are tracked by a common name in the security community. - Analysts track these clusters using various analytic methodologies and terms such as threat groups, activity groups, and threat actors. - Some groups have multiple names associated with similar activities due to various organizations tracking similar activities by different names. - Organizations' group definitions may partially overlap with groups designated by other organizations and may disagree on specific activity. -
-- For the purposes of the Group pages, the MITRE ATT&CK team uses the term Group to refer to any of the above designations for an adversary activity cluster. - The team makes a best effort to track overlaps between names based on publicly reported associations, - which are designated as “Associated Groups” on each page (formerly labeled “Aliases”), because we believe these overlaps are useful for analyst awareness. - We do not represent these names as exact overlaps and encourage analysts to do additional research. -
-- Groups are mapped to publicly reported technique use and original references are included. - The information provided does not represent all possible technique use by Groups, but rather a subset that is available solely through open source reporting. - Groups are also mapped to reported Software used and attributed Campaigns, and related techniques for each are tracked separately on their respective pages. -
+{{ super () }} + + +Groups
++ Groups are activity clusters that are tracked by a common name in the security community. + Analysts track these clusters using various analytic methodologies and terms such as threat groups, activity + groups, and threat actors. + Some groups have multiple names associated with similar activities due to various organizations tracking + similar activities by different names. + Organizations' group definitions may partially overlap with groups designated by other organizations and may + disagree on specific activity. +
++ For the purposes of the Group pages, the MITRE ATT&CK team uses the term Group to refer to any of the above + designations for an adversary activity cluster. + The team makes a best effort to track overlaps between names based on publicly reported associations, + which are designated as “Associated Groups” on each page (formerly labeled “Aliases”), because we believe + these overlaps are useful for analyst awareness. + We do not represent these names as exact overlaps and encourage analysts to do additional research. +
++ Groups are mapped to publicly reported technique use and original references are included. + The information provided does not represent all possible technique use by Groups, but rather a subset that + is available solely through open source reporting. + Groups are also mapped to reported Software used and attributed Campaigns, and related techniques for each + are tracked separately on their respective pages. +
-Groups: {{ parsed.groups_list_len }}
-| ID | -Name | -Associated Groups | -Description | -
|---|---|---|---|
| - {{ row.id | upper }} - | -- {{ row.name }} - | -- {{ row.aliases_list|join(", ") }} - | -- {% if row.deprecated %} - ****Deprecation Warning**** - {% endif %} - {{ clean_output.stixToHTML(row.descr) }} - | -
Groups: {{ parsed.groups_list_len }}
+| ID | +Name | +Associated Groups | +Description | +
|---|---|---|---|
| + {{ row.id | upper }} + | ++ {{ row.name }} + | ++ {{ row.aliases_list|join(", ") }} + | ++ {% if row.deprecated %} + ****Deprecation Warning**** + {% endif %} + {{ clean_output.stixToHTML(row.descr) }} + | +
{{parsed.name}}
+ {% if parsed.descr %} + {{deprecated.deprecated(clean_output.stixToHTML(parsed.descr, firstParagraphOnly=True))}} + {% else %} + {{deprecated.deprecated("This matrix has been deprecated.")}} + {% endif %} +{{parsed.name}}
- {% if parsed.descr %} - {{deprecated.deprecated(clean_output.stixToHTML(parsed.descr, firstParagraphOnly=True))}} - {% else %} - {{deprecated.deprecated("This matrix has been deprecated.")}} - {% endif %} -{{parsed.name}} {{matrix_plural}}
+ {% else %} + {% set matrix_plural = "Matrices" if (parsed.matrices | length > 1) else "Matrix" %} +{{parsed.name}} {{matrix_plural}}
-- {{parsed.descr}} - {% if parsed.platforms | length > 1 %} - The {{matrix_plural}} contains information for the following platforms: {% for platform in parsed.platforms %}{%if loop.index != 1 %}, {% endif %}{{platform.name}}{% endfor %}. - {% elif parsed.platforms | length == 1 %} - The {{matrix_plural}} contains information for the {{parsed.platforms[0].name}} platform. - {% endif %} - {% if parsed.matrices | length == 1 %} - {% if parsed.notes[0] %} - {{ notes.notes_section(parsed.notes[0]) }} - {% endif %} - {% endif %} -
-+ {{parsed.descr}} + {% if parsed.platforms | length > 1 %} + The {{matrix_plural}} contains information for the following platforms: {% for platform in parsed.platforms + %}{%if loop.index != 1 %}, {% endif %}{{platform.name}}{% endfor %}. + {% elif parsed.platforms | length == 1 %} + The {{matrix_plural}} contains information for the {{parsed.platforms[0].name}} platform. + {% endif %} + {% if parsed.matrices | length == 1 %} + {% if parsed.notes[0] %} + {{ notes.notes_section(parsed.notes[0]) }} + {% endif %} + {% endif %} +
+- {{parsed.name}} -
- - {% if parsed.deprecated %} - {% if parsed.descr %} - {{deprecated.deprecated(clean_output.stixToHTML(parsed.descr, firstParagraphOnly=True))}} - {% else %} - {{deprecated.deprecated("This mitigation has been deprecated.")}} - {% endif %} - {% else %} -+ {{parsed.name}} +
- {{ citations.reference_section(parsed.citations) }} - {% endif %} + {% if parsed.deprecated %} + {% if parsed.descr %} + {{deprecated.deprecated(clean_output.stixToHTML(parsed.descr, firstParagraphOnly=True))}} + {% else %} + {{deprecated.deprecated("This mitigation has been deprecated.")}} + {% endif %} + {% else %} +- {% if parsed.domain == "mobile" %} - Mobile Mitigations - {% elif parsed.domain == "enterprise" %} - Enterprise Mitigations - {% elif parsed.domain == "ics" %} - ICS Mitigations - {% endif %} -
+{{ super () }} + ++ {% if parsed.domain == "mobile" %} + Mobile Mitigations + {% elif parsed.domain == "enterprise" %} + Enterprise Mitigations + {% elif parsed.domain == "ics" %} + ICS Mitigations + {% endif %} +
-- Mitigations represent security concepts and classes of technologies that can be used to prevent a technique or sub-technique from being successfully executed. -
-Mitigations: {{parsed.mitigation_list_len}}
-| ID | -Name | -Description | -
|---|---|---|
| - {{row.id}} - | -- {{row.name}} - | -- {{clean_output.stixToHTML(row.descr, firstParagraphOnly=True)}} - | -
+ Mitigations represent security concepts and classes of technologies that can be used to prevent a + technique or sub-technique from being successfully executed. +
Mitigations: {{parsed.mitigation_list_len}}
+| ID | +Name | +Description | +
|---|---|---|
| + {{row.id}} + | ++ {{row.name}} + | ++ {{clean_output.stixToHTML(row.descr, firstParagraphOnly=True)}} + | +
ATT&CK Data & Tools
--
-
- - Tools to Use with ATT&CK - -
- - Accessing ATT&CK Data - -
- - ATT&CK in Excel - -
ATT&CK Data & Tools
+-
+
- + Tools to Use with ATT&CK + +
- + Accessing ATT&CK Data + +
- + ATT&CK in Excel + +
Tools to Use with ATT&CK
+ +Tools to Use with ATT&CK
++ The following tools allow users to explore, access, visualize, and query ATT&CK in different ways. +
+
+ ATT&CK Navigator
- The following tools allow users to explore, access, visualize, and query ATT&CK in different ways. + The ATT&CK Navigator is a web-based tool for annotating and exploring ATT&CK matrices. It + can be used to visualize defensive coverage, red/blue team planning, the frequency of + detected techniques, and more.
-
- ATT&CK Navigator
-- The ATT&CK Navigator is a web-based tool for annotating and exploring ATT&CK matrices. It can be used to visualize defensive coverage, red/blue team planning, the frequency of detected techniques, and more. -
-
- ATT&CK Workbench
-- The ATT&CK Workbench is an application allowing users to explore, create, annotate, and share extensions of - the ATT&CK knowledge base. -
-
- Python Utilities
-- ATT&CK provides a variety of Python tools for accessing, querying, and processing the ATT&CK dataset. - These scripts can be useful utilities or serve as examples for how to work with ATT&CK programmatically. -
-
+ ATT&CK Workbench
++ The ATT&CK Workbench is an application allowing users to explore, create, annotate, and + share extensions of + the ATT&CK knowledge base. +
+
+ Python Utilities
++ ATT&CK provides a variety of Python tools for accessing, querying, and processing the ATT&CK + dataset. + These scripts can be useful utilities or serve as examples for how to work with ATT&CK + programmatically. +
+Accessing ATT&CK Data
+ +Accessing ATT&CK Data
- -ATT&CK in STIX
-- Structured Threat Information Expression (STIX™) is a language and serialization format used to - exchange cyber threat intelligence (CTI). The ATT&CK dataset is available in STIX 2.0 and STIX 2.1. - Other presentations of this dataset, including the ATT&CK Navigator and this website, are built from - the STIX data. -
-- STIX is a machine-readable format providing access to the ATT&CK knowledge base. It is the most granular - representation of the ATT&CK data, and all other representations are derived from the STIX dataset. -
-- The ATT&CK STIX representation is most easily manipulated in Python using the - stix2 library. - However, because STIX is represented in JSON, other programming languages can easily interact with - the raw content. -
-- Consider using ATT&CK in STIX if you: -
--
-
- Have automated workflows that need to ingest ATT&CK data. -
- Are a proficient Python user seeking to save time with automation or want to perform advanced queries. -
- Want your workflows to keep up-to-date with the evolving knowledge base. -
- Want to extend the ATT&CK dataset with custom content, and use this custom content with ATT&CK tools. -
- ATT&CK in STIX
++ Structured Threat Information Expression (STIX™) is a language and serialization format + used to + exchange cyber threat intelligence (CTI). The ATT&CK dataset is available in STIX 2.0 and STIX + 2.1. + Other presentations of this dataset, including the ATT&CK Navigator and this website, are built + from + the STIX data. +
++ STIX is a machine-readable format providing access to the ATT&CK knowledge base. It is the most + granular + representation of the ATT&CK data, and all other representations are derived from the STIX + dataset. +
++ The ATT&CK STIX representation is most easily manipulated in Python using the + stix2 library. + However, because STIX is represented in JSON, other programming languages can easily interact + with + the raw content. +
++ Consider using ATT&CK in STIX if you: +
+-
+
- Have automated workflows that need to ingest ATT&CK data. +
- Are a proficient Python user seeking to save time with automation or want to perform + advanced queries. +
- Want your workflows to keep up-to-date with the evolving knowledge base. +
- Want to extend the ATT&CK dataset with custom content, and use this custom content with + ATT&CK tools. +
+ ATT&CK in STIX 2.1
+TAXII 2.1
-- The ATT&CK STIX data can also be accessed via the official ATT&CK TAXII™ server. - Trusted Automated Exchange of Intelligence Information (TAXII) is an application protocol for - exchanging CTI over HTTPS. The ATT&CK TAXII server provides API access to the ATT&CK - STIX knowledge base. -
-ATT&CK Data Model
-- The ATT&CK Data Model provides a standardized way to represent ATT&CK data using Zod - schemas. It enables developers to parse, validate, and utilize the ATT&CK knowledge base - efficiently in various formats. -
-ATT&CK in STIX 2.0
+TAXII 2.1
++ The ATT&CK STIX data can also be accessed via the official ATT&CK TAXII™ + server. + Trusted Automated Exchange of Intelligence Information (TAXII) is an application protocol + for + exchanging CTI over HTTPS. The ATT&CK TAXII server provides API access to the ATT&CK + STIX knowledge base. +
+ATT&CK in Excel
-- These spreadsheets are built from the STIX dataset and provide a more human-accessible view into the - knowledge base while also supporting rudimentary querying/filtering capabilities. -
-- The Excel representation of the ATT&CK dataset below includes both master spreadsheets, containing all - object types, and individual spreadsheets for each object type. The individual type spreadsheets break - out relationships (e.g procedure examples connecting groups to techniques) into separate sheets by - relationship type, while the master spreadsheet includes all relationship types in a single sheet. -
-- A citations sheet can be used to look up the in-text citations which appear in some fields. For domains - that include multiple matrices, such as Mobile ATT&CK, each matrix gets its own named sheet. Unlike the - STIX dataset, objects that have been revoked or deprecated are not included in the spreadsheets. -
-- Consider using ATT&CK in Excel if you: -
--
-
- Want to quickly sort, filter and query the dataset in a familiar UI. -
- Want to explore the contents of the dataset without having to navigate around the ATT&CK website. -
- Are not comfortable enough in Python or other programming languages to work with the STIX representation. -
- ATT&CK Data Model
++ The ATT&CK Data Model provides a standardized way to represent ATT&CK data using Zod + schemas. It enables developers to parse, validate, and utilize the ATT&CK knowledge base + efficiently in various formats. +
+ATT&CK Excel Files by Version
--
- {% set versions = parsed.excel_files_by_version.keys()|list %}
- {% set visible_count = 3 %}
- {% if versions|length <= visible_count %}
- {% for version in versions %}
- {% if loop.first %}
-
- {% else %}
-
- {% endif %}
- {% endfor %}
- {% else %}
- {% for version in versions[:visible_count] %}
- {% if loop.first %}
-
- {% else %}
-
- {% endif %}
- {% endfor %}
-
-
-
-
+
+ + ++
ATT&CK in Excel
++- - Older versions - - -+++ These spreadsheets are built from the STIX dataset and provide a more human-accessible view into + the + knowledge base while also supporting rudimentary querying/filtering capabilities. +
++ The Excel representation of the ATT&CK dataset below includes both master spreadsheets, + containing all + object types, and individual spreadsheets for each object type. The individual type spreadsheets + break + out relationships (e.g procedure examples connecting groups to techniques) into separate sheets + by + relationship type, while the master spreadsheet includes all relationship types in a single + sheet. +
++ A citations sheet can be used to look up the in-text citations which appear in some fields. For + domains + that include multiple matrices, such as Mobile ATT&CK, each matrix gets its own named sheet. + Unlike the + STIX dataset, objects that have been revoked or deprecated are not included in the spreadsheets. +
++++ Consider using ATT&CK in Excel if you: +
+-
+
- Want to quickly sort, filter and query the dataset in a familiar UI. +
- Want to explore the contents of the dataset without having to navigate around the ATT&CK + website. +
- Are not comfortable enough in Python or other programming languages to work with the + STIX representation. +
++
+
- {% endif %}
-
ATT&CK Excel Files by Version
+ ++ This folder within the pip module contains an additional module for converting ATT&CK STIX data + to Excel spreadsheets. It also provides a means to access ATT&CK data as Pandas DataFrames for + data analysis. +
+ATT&CK Excel Files by Version
diff --git a/modules/resources/templates/attackcon-overview.html b/modules/resources/templates/attackcon-overview.html
index d585421fd25..fc8f1397337 100644
--- a/modules/resources/templates/attackcon-overview.html
+++ b/modules/resources/templates/attackcon-overview.html
@@ -11,136 +11,139 @@
{% block innerright %}
{{ super () }}
- {% set conID = "-".join(con.date.split(' ')) %}
-
- {{ con.title }}
+ {% set conID = "-".join(con.date.split(' ')) %}
+
+ {{ con.title }}
- {% set ifSponsor = "sponsors_img_list" in con %}
- {% if "banner_img" in con %}
-
- 
-
- {% endif %}
+ {% set ifSponsor = "sponsors_img_list" in con %}
+ {% if "banner_img" in con %}
+
+
+
+ {% endif %}
- {% if "description" in con %}
-
- {{con.description}}
-
- {% endif %}
- {% if "blogpost" in con %}
- Click here to read our blog post about {{con.title}}! 
- {% endif %}
-
- {% if "banner_img" in con %}
-
-
-
- Presentations
-
- {% for presentation in con.presentations %}
- {% set isPanel = "moderator" in presentation %}
-
-
-
-
-
- {{ presentation.title }}
-
-
-
-
- {% if not isPanel %}
- {% for presenterGroup in presentation.presenters %}{% if loop.index > 1 %}; {% endif
- %}{{ " and ".join(presenterGroup.names)}}{% if "organization" in presenterGroup %},
- {{presenterGroup.organization}}{% endif %}{% endfor %}
- {% else %}
- Moderated by {{presentation.moderator.name}}, {{presentation.moderator.organization}}
- {% endif %}
-
-
-
- {% if not isPanel %}
- {{presentation.description}}
- {% else %}
- Panelists:
-
- {% for panelist in presentation.panelists %}
- -
- {{panelist}}
-
- {% endfor %}
-
- {{presentation.moderator.name}} moderates a panel that discusses:
-
- {% for topic in presentation.topics %}
- -
- {{topic}}
-
- {% endfor %}
-
- {% endif %}
-
-
-
-
-
-
- {% endfor %}
-
-
- {% if "sponsors_img_list" in con %}
-
- Sponsors
-
- {% for sponsor_img in con.sponsors_img_list %}
-
- 
-
- {% endfor %}
-
+ {% if "description" in con %}
+
+ {{con.description}}
+
+ {% endif %}
+ {% if "blogpost" in con %}
+ Click here to read our blog post about
+ {{con.title}}!
+
+ {% endif %}
+
+ {% if "banner_img" in con %}
+
+
+
+ Presentations
+
+ {% for presentation in con.presentations %}
+ {% set isPanel = "moderator" in presentation %}
+
+
+
+
+
+ {{ presentation.title }}
+
+
+
+ {% if not isPanel %}
+ {% for presenterGroup in presentation.presenters %}{% if loop.index > 1 %}; {% endif
+ %}{{ " and ".join(presenterGroup.names)}}{% if "organization" in presenterGroup %},
+ {{presenterGroup.organization}}{% endif %}{% endfor %}
+ {% else %}
+ Moderated by {{presentation.moderator.name}}, {{presentation.moderator.organization}}
{% endif %}
+
+
+
+ {% if not isPanel %}
+ {{presentation.description}}
+ {% else %}
+ Panelists:
+
+ {% for panelist in presentation.panelists %}
+ -
+ {{panelist}}
+
+ {% endfor %}
+
+ {{presentation.moderator.name}} moderates a panel that discusses:
+
+ {% for topic in presentation.topics %}
+ -
+ {{topic}}
+
+ {% endfor %}
+
+ {% endif %}
+
+
+
+
+
+
+ {% endfor %}
+
+
+ {% if "sponsors_img_list" in con %}
+
+ Sponsors
+
+ {% for sponsor_img in con.sponsors_img_list %}
+
+
+ {% endfor %}
+
{% endif %}
+
+ {% endif %}
+
{% endblock %}
diff --git a/modules/resources/templates/attackcon.html b/modules/resources/templates/attackcon.html
index 7d19742c4b7..66c37733bc8 100644
--- a/modules/resources/templates/attackcon.html
+++ b/modules/resources/templates/attackcon.html
@@ -10,67 +10,68 @@
{% block innerright %}
ATT&CKcon
-
-
- At MITRE ATT&CK's annual conference, cybersecurity leaders and practitioners of all levels are
- invited to strengthen capabilities and engage with others in the community through multiple days of programming,
- featuring knowledgeable speakers, engaging content, and meaningful collaboration, all designed to help
- leverage the ATT&CK framework.
- Browse the archive of presentations below.
-
-
- Learn about future ATT&CKcons by keeping up with us at Engage with ATT&CK
-
-
- {{contact_card.render(
- "ATT&CKcon 6.0",
- "/resources/attackcon/october-2025/",
- "October 14th - 15th, 2025
McLean, VA",
- invert_icon=True)}}
- {{contact_card.render(
- "ATT&CKcon 5.0",
- "/resources/attackcon/october-2024/",
- "October 22nd - 23rd, 2024
McLean, VA", invert_icon=True)}}
- {{contact_card.render(
- "ATT&CKcon 4.0",
- "/resources/attackcon/october-2023/",
- "October 24th - 25th, 2023
McLean, VA",
- invert_icon=True)}}
-
+
+
+ At MITRE ATT&CK's annual conference, cybersecurity leaders and practitioners of all levels are
+ invited to strengthen capabilities and engage with others in the community through multiple days of programming,
+ featuring knowledgeable speakers, engaging content, and meaningful collaboration, all designed to help
+ leverage the ATT&CK framework.
+ Browse the archive of presentations below.
+
+
+ Learn about future ATT&CKcons by keeping up with us at Engage with ATT&CK
+
+
+ {{contact_card.render(
+ "ATT&CKcon 6.0",
+ "/resources/attackcon/october-2025/",
+ "October 14th - 15th, 2025
McLean, VA",
+ invert_icon=True)}}
+ {{contact_card.render(
+ "ATT&CKcon 5.0",
+ "/resources/attackcon/october-2024/",
+ "October 22nd - 23rd, 2024
McLean, VA", invert_icon=True)}}
+ {{contact_card.render(
+ "ATT&CKcon 4.0",
+ "/resources/attackcon/october-2023/",
+ "October 24th - 25th, 2023
McLean, VA",
+ invert_icon=True)}}
+
-
- {{contact_card.render(
- "ATT&CKcon 3.0",
- "/resources/attackcon/march-2022/",
- "March 29th - 30th, 2022
McLean, VA",
- invert_icon=True)}}
- {{contact_card.render(
- "ATT&CKcon PowerHour",
- "/resources/attackcon/october-2020/",
- "October 2020 - January 2021
Virtual",
- invert_icon=True)}}
- {{contact_card.render("ATT&CKcon 2.0", "/resources/attackcon/october-2019/", "October 29th - 30th,
- 2019
McLean, VA",
- invert_icon=True)}}
-
-
- {{contact_card.render("ATT&CKcon 2018", "/resources/attackcon/october-2018/", "October 23rd - 24th,
- 2018
McLean, VA",
- invert_icon=True)}}
-
-
-
+
+ {{contact_card.render(
+ "ATT&CKcon 3.0",
+ "/resources/attackcon/march-2022/",
+ "March 29th - 30th, 2022
McLean, VA",
+ invert_icon=True)}}
+ {{contact_card.render(
+ "ATT&CKcon PowerHour",
+ "/resources/attackcon/october-2020/",
+ "October 2020 - January 2021
Virtual",
+ invert_icon=True)}}
+ {{contact_card.render("ATT&CKcon 2.0", "/resources/attackcon/october-2019/", "October 29th - 30th,
+ 2019
McLean, VA",
+ invert_icon=True)}}
+
+
+ {{contact_card.render("ATT&CKcon 2018", "/resources/attackcon/october-2018/", "October 23rd - 24th,
+ 2018
McLean, VA",
+ invert_icon=True)}}
+
+
+
{% endblock %}
{% block scripts %} {{ super () }}
diff --git a/modules/resources/templates/contact.html b/modules/resources/templates/contact.html
index a878089176a..f20240d1ed3 100644
--- a/modules/resources/templates/contact.html
+++ b/modules/resources/templates/contact.html
@@ -10,44 +10,54 @@
{% block innerright %}
{{ super () }}
-
+
-
-
- Stay Informed
-
- We're creating a community of ATT&CK users who are passionate about ATT&CK and threat informed defense.
- Here's how you can find other community members, find out what they're doing with ATT&CK, and get involved.
-
-
- {{contact_card.render("X", "https://x.com/MITREattack", "Follow us @MITREattack to hear about news, latest updates, and what community members are doing with ATT&CK.", "fa-brands fa-x-twitter", invert_icon=True)}}
- {{contact_card.render("Medium", "https://medium.com/mitre-attack", "Check out our Medium blog for ATT&CK updates and information.", "fa-brands fa-medium", invert_icon=True)}}
- {{contact_card.render("Slack", "https://join.slack.com/t/mitreattack/shared_invite/zt-3fzdeugg1-RbzsXv6OHF9KX8C46joR9w", "Join the ATT&CK slack workspace! With over 3,000 members and 15 channels, find and start discussions with the community on all things ATT&CK.", "fa-brands fa-slack", invert_icon=True)}}
-
-
-
- Contact Us
-
- {{contact_card.render("Email", "mailto:attack@mitre.org", "For questions and comments about Enterprise or Mobile ATT&CK, please contact us at attack@mitre.org", "fa-solid fa-envelope", invert_icon=True)}}
- {{contact_card.render("GitHub", "https://github.com/mitre-attack/", "For feedback or issues on the ATT&CK Navigator or Website, please submit issues to the related git repository. ", "fa-brands fa-github", invert_icon=False,
- buttons=[
- {"label": "ATT&CK", "url": "https://github.com/mitre-attack"},
- {"label": "MITRE CTI", "url": "https://github.com/mitre/cti"}
- ])
- }}
- {{contact_card.render("Contribute", "/resources/engage-with-attack/contribute/", "We rely on the community to help us improve ATT&CK. For learning how to submit contributions to ATT&CK, read our contribute page to learn how to reach out and what we’re looking for. ")}}
-
-
+
+
+ Stay Informed
+
+ We're creating a community of ATT&CK users who are passionate about ATT&CK and threat informed defense.
+ Here's how you can find other community members, find out what they're doing with ATT&CK, and get involved.
+
+
+ {{contact_card.render("X", "https://x.com/MITREattack", "Follow us @MITREattack to hear about news, latest
+ updates, and what community members are doing with ATT&CK.", "fa-brands fa-x-twitter", invert_icon=True)}}
+ {{contact_card.render("Medium", "https://medium.com/mitre-attack", "Check out our Medium blog for ATT&CK updates
+ and information.", "fa-brands fa-medium", invert_icon=True)}}
+ {{contact_card.render("Slack",
+ "https://join.slack.com/t/mitreattack/shared_invite/zt-3fzdeugg1-RbzsXv6OHF9KX8C46joR9w", "Join the ATT&CK slack
+ workspace! With over 3,000 members and 15 channels, find and start discussions with the community on all things
+ ATT&CK.", "fa-brands fa-slack", invert_icon=True)}}
+
+
+ Contact Us
+
+ {{contact_card.render("Email", "mailto:attack@mitre.org", "For questions and comments about Enterprise or Mobile
+ ATT&CK, please contact us at attack@mitre.org", "fa-solid fa-envelope", invert_icon=True)}}
+ {{contact_card.render("GitHub", "https://github.com/mitre-attack/", "For feedback or issues on the ATT&CK
+ Navigator or Website, please submit issues to the related git repository. ", "fa-brands fa-github",
+ invert_icon=False,
+ buttons=[
+ {"label": "ATT&CK", "url": "https://github.com/mitre-attack"},
+ {"label": "MITRE CTI", "url": "https://github.com/mitre/cti"}
+ ])
+ }}
+ {{contact_card.render("Contribute", "/resources/engage-with-attack/contribute/", "We rely on the community to help
+ us improve ATT&CK. For learning how to submit contributions to ATT&CK, read our contribute page to learn how to
+ reach out and what we’re looking for. ")}}
+
+
+
{% endblock %}
{% block scripts %}
{{ super() }}
-{% endblock %}
+{% endblock %}
\ No newline at end of file
diff --git a/modules/resources/templates/contribute.html b/modules/resources/templates/contribute.html
deleted file mode 100644
index a4f74d184d5..00000000000
--- a/modules/resources/templates/contribute.html
+++ /dev/null
@@ -1,316 +0,0 @@
-{% extends "general/two-column.html" %}
-{% set active_page = "resources" -%}
-{% set title = "Contribute | MITRE ATT&CK®" -%}
-{% set parsed = page.data | from_json %}
-{% import 'macros/navigation.html' as navigation %}
-{% import 'macros/contact_card.html' as contact_card %}
-
-{% block innerleft %}
-
-{% endblock %}
-
-{% block innerright %}
-
-
-
-
- Contribute
-
- ATT&CK is in a constant state of development. We are always on the lookout for new information to help
- refine and extend what is covered. If you have additional techniques, know about variations on one already covered,
- have examples of techniques in use, or have other relevant information, then we would like to hear from you.
-
-
- We are looking for contributions in the following areas, but all contributions and feedback to ATT&CK are appreciated.
- If you have other information you think may be useful, please reach us at attack@mitre.org.
-
-
-
- Due to the high volume of contributions, it may take us about a week to get back to you. We recommend you read our
- philosophy paper to understand
- our approach to maintaining ATT&CK so that we get the right details up front. Content updates happen roughly every 6 months.
-
-
-
-
-
-
-
- What we're looking for
-
-
- {{contact_card.render("Sub-Techniques and Techniques", "",
- "Let us know what new variations of behaviors real adversaries are using in the wild! Please share
- a brief description of the behavior, any references or knowledge about how it works and was used,
- and how this behavior is not already captured in ATT&CK.
To understand the process of how
- the MITRE team develops techniques, refer to the video below.",
- buttons=[
- {"label": "See an example", "url": "#techniques-modal", "card_modal": "techniques-modal"},
- {"label": "Video", "url": "https://youtu.be/v24a5IOwObc?si=TuG_-WrknY4r7pkC"}
- ],
- fa_icon=None, invert_icon=True, header_background=True, footer_description=None, header_subtitle=None)}}
-
- {{contact_card.render("Threat Intelligence", "",
- "We map Group and Software examples on our site, and appreciate your help with referenced information about
- how Groups and Software samples use ATT&CK techniques. Please share the sub-technique or technique name,
- group or associated group name, a brief description of how the technique is implemented, and the publicly-available reference.",
- buttons=[
- {"label": "See an example", "url": "#threat-intel-modal", "card_modal": "threat-intel-modal"}
- ],
- fa_icon=None, invert_icon=True, header_background=True, footer_description=None, header_subtitle=None)}}
-
- {{contact_card.render("Website Content Errors", "",
- "If you find errors or typos on the site related to content, please let us know by
- submitting the url where you found the error and a short description. Examples include
- typos and syntax errors, improperly formatted web pages, and 404 errors when links are clicked.",
- buttons=[
- {"label": "See an example", "url": "#errors-modal", "card_modal": "errors-modal"}
- ],
- fa_icon=None, invert_icon=True, header_background=True, footer_description=None, header_subtitle=None)}}
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Contributors
-
- The following individuals or organizations have contributed information
- regarding the existence of a technique, details on how to detect and/or mitigate
- use of a technique, or threat intelligence on adversary use:
-
-
-
- {% for col in parsed.contributors %}
-
-
- {% for row in col %}
- -
- {{row}}
-
- {% endfor %}
-
-
- {% endfor %}
-
-
-
- Thanks to those who have contributed to ATT&CK!
-
-
-
-
-
-
-{% endblock %}
-{% block scripts %} {{ super () }}
-
-
-{% endblock %}
\ No newline at end of file
diff --git a/modules/resources/templates/learn-more-about-attack.html b/modules/resources/templates/learn-more-about-attack.html
index c6d5754be8c..7b8e81236be 100644
--- a/modules/resources/templates/learn-more-about-attack.html
+++ b/modules/resources/templates/learn-more-about-attack.html
@@ -10,9 +10,9 @@
{% block innerright %}
@@ -20,77 +20,87 @@
Learn More About ATT&CK
Featured MITRE Presentations
-
- The featured presentations highlight applications, new techniques, and current topics of interest to ATT&CK.
- All MITRE presentations were developed by members of the ATT&CK team at MITRE.
-
-
- {{contact_card.render("MITRE ATT&CK: The Play at Home Edition", "",
- "This presentation from Black Hat walks through the story of a fictional organization in order to explain how different teams can use ATT&CK as a powerful force to improve defenses.",
- buttons=[
- {"label": "View Presentation", "url": "http://i.blackhat.com/USA-19/Wednesday/us-19-Nickels-MITRE-ATTACK-The-Play-At-Home-Edition.pdf"}
- ],
- fa_icon=None, invert_icon=True, header_background=True, footer_description=None, header_subtitle="August 2019")}}
+
+ The featured presentations highlight applications, new techniques, and current topics of interest to ATT&CK.
+ All MITRE presentations were developed by members of the ATT&CK team at MITRE.
+
+
+ {{contact_card.render("MITRE ATT&CK: The Play at Home Edition", "",
+ "This presentation from Black Hat walks through the story of a fictional organization in order to explain how
+ different teams can use ATT&CK as a powerful force to improve defenses.",
+ buttons=[
+ {"label": "View Presentation", "url":
+ "http://i.blackhat.com/USA-19/Wednesday/us-19-Nickels-MITRE-ATTACK-The-Play-At-Home-Edition.pdf"}
+ ],
+ fa_icon=None, invert_icon=True, header_background=True, footer_description=None, header_subtitle="August
+ 2019")}}
- {{contact_card.render("Leveraging Campaigns to Untangle the Threat Group Ship of Theseus", "",
- "This presentation introduces ATT&CK's newer categorization of Campaigns - a method of classification that more easily enables the tracking of the abilities and sophistication over time, in addition to enabling stakeholders to better identify potential targets based on industry.",
- buttons=[
- {"label": "View Presentation", "url": "https://www.slideshare.net/AdamPennington4/leveraging-campaigns-to-untangle-the-threat-group-ship-of-theseus"}
- ],
- fa_icon=None, invert_icon=True, header_background=True, footer_description=None, header_subtitle="January 2023")}}
+ {{contact_card.render("Leveraging Campaigns to Untangle the Threat Group Ship of Theseus", "",
+ "This presentation introduces ATT&CK's newer categorization of Campaigns - a method of classification that more
+ easily enables the tracking of the abilities and sophistication over time, in addition to enabling stakeholders
+ to better identify potential targets based on industry.",
+ buttons=[
+ {"label": "View Presentation", "url":
+ "https://www.slideshare.net/AdamPennington4/leveraging-campaigns-to-untangle-the-threat-group-ship-of-theseus"}
+ ],
+ fa_icon=None, invert_icon=True, header_background=True, footer_description=None, header_subtitle="January
+ 2023")}}
- {{contact_card.render("Objective by the Sea: Drawing Out ATT&CK Techniques in the Wild", "",
- "This presentation provides a high-level explanation of the ATT&CK framework for MacOS and its components, then walks through the application of the ATT&CK framework to a real-world campaign using Pandas as a model. Emphasizes community-driven aspects of ATT&CK.",
- buttons=[
- {"label": "View Presentation", "url": "https://www.youtube.com/watch?v=pT8C9P3BiVw"}
- ],
- fa_icon=None, invert_icon=True, header_background=True, footer_description=None, header_subtitle="November 2022")}}
-
-
- Browse all MITRE presentations
+ {{contact_card.render("Objective by the Sea: Drawing Out ATT&CK Techniques in the Wild", "",
+ "This presentation provides a high-level explanation of the ATT&CK framework for MacOS and its components, then
+ walks through the application of the ATT&CK framework to a real-world campaign using Pandas as a model.
+ Emphasizes community-driven aspects of ATT&CK.",
+ buttons=[
+ {"label": "View Presentation", "url": "https://www.youtube.com/watch?v=pT8C9P3BiVw"}
+ ],
+ fa_icon=None, invert_icon=True, header_background=True, footer_description=None, header_subtitle="November
+ 2022")}}
-
- MITRE CTI Training
-
- Using MITRE ATT&CK for Cyber Threat Intelligence Training by Katie Nickels and Adam Pennington provides
- several modules to help you learn how to apply ATT&CK and improve your threat intelligence practices.
-
-
-
+
+ MITRE CTI Training
+
+ Using MITRE ATT&CK for Cyber Threat Intelligence Training by Katie Nickels and Adam Pennington provides
+ several modules to help you learn how to apply ATT&CK and improve your threat intelligence practices.
+
+
+
-
-
-
- Reading Materials
-
- These materials provide an in-depth look at why we created these ATT&CK domains, how we maintain and update
- them,
- and what the community commonly uses them for.
-
-
- {{contact_card.render("ATT&CK Design and Philosophy", "/docs/ATTACK_Design_and_Philosophy_March_2020.pdf",
- "This paper outlines the process MITRE
- used to create ATT&CK, and the
- philosophy that has developed for
- curating new content.",
- invert_icon=True)}}
- {{contact_card.render("ATT&CK for ICS extension", "/docs/ATTACK_for_ICS_Philosophy_March_2020.pdf",
- "For individuals already familiar with
- ATT&CK, this document can be viewed
- as an extension to the ATT&CK Design
- and Philosophy whitepaper above that
- highlights unique, as well as some
- common, aspects of the design and philosophy of ATT&CK for ICS. ",
- invert_icon=True)}}
-
+
+
+
+
+
+ Reading Materials
+
+ These materials provide an in-depth look at why we created these ATT&CK domains, how we maintain and update
+ them,
+ and what the community commonly uses them for.
+
+
+ {{contact_card.render("ATT&CK Design and Philosophy", "/docs/ATTACK_Design_and_Philosophy_March_2020.pdf",
+ "This paper outlines the process MITRE
+ used to create ATT&CK, and the
+ philosophy that has developed for
+ curating new content.",
+ invert_icon=True)}}
+ {{contact_card.render("ATT&CK for ICS extension", "/docs/ATTACK_for_ICS_Philosophy_March_2020.pdf",
+ "For individuals already familiar with
+ ATT&CK, this document can be viewed
+ as an extension to the ATT&CK Design
+ and Philosophy whitepaper above that
+ highlights unique, as well as some
+ common, aspects of the design and philosophy of ATT&CK for ICS. ",
+ invert_icon=True)}}
+
{% endblock %}
{% block scripts %} {{ super () }}
diff --git a/modules/resources/templates/legal-and-branding.html b/modules/resources/templates/legal-and-branding.html
index be6c276fa3c..6e5c06b784f 100644
--- a/modules/resources/templates/legal-and-branding.html
+++ b/modules/resources/templates/legal-and-branding.html
@@ -10,160 +10,177 @@
{% block innerright %}
-
-
-
- Legal & Branding
-
- ATT&CK is open and available to any person or organization for use at no charge. If you decide to use ATT&CK, then follow the Terms of Use and follow guidelines for referencing the use of ATT&CK in your work.
-
+
+
+
+ Legal & Branding
+
+ ATT&CK is open and available to any person or organization for use at no charge. If you decide to use
+ ATT&CK, then follow the Terms of Use and follow
+ guidelines for referencing the use of ATT&CK in your work.
+
- Referencing ATT&CK
-
- Both MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.
-
-
- Your first references in writing must include “MITRE” preceding “ATT&CK®” - but subsequently should just reference “ATT&CK” (no registered trademark symbol required).
-
-
- A headline should always reference MITRE ATT&CK®
-
-
-
-
- Example of a first reference of ATT&CK
- MITRE ATT&CK® is a curated knowledge base and model for cyber adversary behavior.
-
-
-
-
- Example of subsequent reference of ATT&CK
- ATT&CK is open and available to any person or organization for use at no charge.
-
-
-
+ Referencing ATT&CK
+
+ Both MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE
+ Corporation.
+
+
+ Your first references in writing must include “MITRE” preceding “ATT&CK®” - but
+ subsequently should just reference “ATT&CK” (no registered trademark symbol required).
+
+
+ A headline should always reference MITRE ATT&CK®
+
+
+
+
+ Example of a first reference of ATT&CK
+ MITRE ATT&CK® is a curated knowledge base and model for cyber adversary
+ behavior.
+
+
+
+
+ Example of subsequent reference of ATT&CK
+ ATT&CK is open and available to any person or organization for use at no charge.
+
+
+
- Dos and Don’ts of Referencing ATT&CK
-
-
-
- DO
-
-
-
-
-
-
-
- Reference “MITRE ATT&CK®” together in headlines and first references.
-
-
-
-
-
-
-
-
- Capitalize “ATT&CK” to distinguish it from the surrounding text.
-
-
-
-
-
-
- DO NOT
-
-
-
-
-
-
-
- Modify the trademark, such as through hyphenation or abbreviation (“ATT&CK’d!”, “Plan-of-ATT&CK”, “ATTK”).
-
-
-
-
-
-
-
-
- Display the ATT&CK trademark in any manner that implies an affiliation with, sponsorship, or endorsement by MITRE, or in a manner that can be reasonably interpreted to suggest third party content represents the views and opinions of MITRE or MITRE personnel, unless those third parties receive express permission from MITRE.
-
-
-
-
-
-
-
-
- Use ATT&CK in your product names, service names, trademarks, logos, or company names.
-
-
-
-
+ Dos and Don’ts of Referencing ATT&CK
+
+
+
+ DO
+
+
+
+
+
-
- Logos
-
-
-
+
+ Reference “MITRE ATT&CK®” together in headlines and first references.
-
- Brand Guide
-
- The brand guide provides further detail on the consistent implementation of the MITRE ATT&CK® brand identity, both visually and verbally, to both internal and external audiences, while respecting our legal trademark restrictions. If you have further questions, please reach out to as at attack@mitre.org.
-
-
-
-
-
- Additional Policies
-
- Terms of Use
-
- Privacy Policy
-
+
+
+
+
+
+
+
+ Capitalize “ATT&CK” to distinguish it from the surrounding text.
+
+
+
+
+
+
+ DO NOT
+
+
+
+
+
+
+
+ Modify the trademark, such as through hyphenation or abbreviation (“ATT&CK’d!”, “Plan-of-ATT&CK”,
+ “ATTK”).
+
+
+
+
+
+
+
+
+ Display the ATT&CK trademark in any manner that implies an affiliation with, sponsorship, or
+ endorsement by MITRE, or in a manner that can be reasonably interpreted to suggest third party content
+ represents the views and opinions of MITRE or MITRE personnel, unless those third parties receive
+ express permission from MITRE.
+
+
+
+
+
+
+
+
+ Use ATT&CK in your product names, service names, trademarks, logos, or company names.
+
+
+
+
+ Logos
+
+
+ Brand Guide
+
+ The brand guide provides further detail on the consistent implementation of the MITRE
+ ATT&CK® brand identity, both visually and verbally, to both internal and external
+ audiences, while respecting our legal trademark restrictions. If you have further questions, please reach out
+ to as at attack@mitre.org.
+
+
+
+
+
+ Additional Policies
+
+ Terms of Use
+
+ Privacy Policy
+
+
+
{% endblock %}
diff --git a/modules/resources/templates/presentation-archive.html b/modules/resources/templates/presentation-archive.html
index 7b40ed284d8..5c20a256337 100644
--- a/modules/resources/templates/presentation-archive.html
+++ b/modules/resources/templates/presentation-archive.html
@@ -11,113 +11,116 @@
{% block innerright %}
-
-
-
- Presentation Archive
-
-
-
- Date of Presentation
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Presentation Materials
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Browse our archive of presentations by MITRE’s ATT&CK team, covering various cybersecurity topics related to ATT&CK. Presented at different conferences, these talks offer valuable insights and expertise from our team members.
-
-
- Presentations
-
- {% for presentation in parsed.presentations %}
-
-
-
- {% endfor %}
+
+
+
+ Presentation Archive
+
+
+
+ Date of Presentation
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Presentation Materials
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Browse our archive of presentations by MITRE’s ATT&CK team, covering various cybersecurity topics
+ related to ATT&CK. Presented at different conferences, these talks offer valuable insights and expertise
+ from our team members.
+
+
+ Presentations
+
+ {% for presentation in parsed.presentations %}
+
+ {% endfor %}
+
+
{% endblock %}
diff --git a/modules/resources/templates/previous-versions.html b/modules/resources/templates/previous-versions.html
index 66eb8314c81..a059cf58415 100644
--- a/modules/resources/templates/previous-versions.html
+++ b/modules/resources/templates/previous-versions.html
@@ -6,32 +6,36 @@
{% block content %}
{{ super () }}
-
+
-
-
- Previous Versions
-
- We preserve previous versions of the website each time we do a major ATT&CK content update. Click below to see a previous version of the site or the updates that occurred with that particular major release.
-
-
- {% for version in parsed.versions %}
- {% if version.retired %}
- - {{version.date_start}} - {{version.date_end}}. This version has been removed from the site. You can still download this version's source data or browse the raw HTML.
- {% else %}
- - {{version.date_start}} - {{version.date_end}} (Updates)
- {% endif %}
- {% endfor %}
-
-
+
+
+ Previous Versions
+
+ We preserve previous versions of the website each time we do a major ATT&CK content update. Click below to see a
+ previous version of the site or the updates that occurred with that particular major release.
+
+
+ {% for version in parsed.versions %}
+ {% if version.retired %}
+ - {{version.date_start}} - {{version.date_end}}. This version has been removed from the site. You can still
+ download this version's source data or browse the raw HTML.
+ {% else %}
+ - {{version.date_start}} - {{version.date_end}} (Updates)
+ {% endif %}
+ {% endfor %}
+
+
{% endblock %}
- {% block scripts %}
- {{ super() }}
+{% block scripts %}
+{{ super() }}
{% endblock %}
\ No newline at end of file
diff --git a/modules/resources/templates/resources.html b/modules/resources/templates/resources.html
index 3e15e67b438..643b547325b 100644
--- a/modules/resources/templates/resources.html
+++ b/modules/resources/templates/resources.html
@@ -12,265 +12,351 @@
-
-
-
- Get Started
-
-
- Jump to Section
-
- -
- What is ATT&CK?
-
- -
- How can I use ATT&CK?
-
- -
- How should I not use ATT&CK?
-
- -
- ATT&CK Navigator
-
- -
- Community
-
-
-
-
-
-
-
- What is ATT&CK?
-
- ATT&CK is knowledge base of adversarial techniques based on real-world observations. ATT&CK focuses on how adversaries interact with systems during an operation, reflecting the various phases of an adversary’s attack lifecycle and the platforms they are known to target.
-
-
- Read the ATT&CK 101 Blog post for more information on the basics of ATT&CK and check the short video below.
-
-
-
-
-
- Key Concepts
-
-
- ATT&CK is a model that attempts to systematically categorize adversary behavior. The main components of the model are:
-
- -
- Tactics, represents “why” or the reason an adversary is performing an action
-
- -
- Techniques, represents “how” adversaries achieve tactical goals by performing an action
-
- -
- Sub-techniques, a more specific or lower-level description of adversarial behavior
-
- -
- Procedures, specific implementation or in-the-wild use the adversary uses for techniques or sub-techniques
-
-
-
-
- ATT&CK is organized in a series of technology domains, the ecosystem an adversary operates within. Currently, there are three technology domains:
-
- -
- Enterprise, representing traditional enterprise networks and cloud technologies
-
- -
- Mobile for mobile communication devices
-
- -
- ICS for industrial control systems
-
-
- Within each domain are platforms, which may be an operating system or application (e.g. Microsoft Windows). Techniques and sub-techniques can apply to multiple platforms.
-
-
-
- For more information on the principles behind ATT&CK, its creation, and its ongoing maintenance, read the ATT&CK Philosophy Paper.
- For additional information focused on ATT&CK for ICS, including the unique elements and commonalities with ATT&CK, read the ATT&CK for ICS Extension.
-
+
+
+
+ Get Started
+
+
+ Jump to Section
+
+ -
+ What is ATT&CK?
+
+ -
+ How can I use ATT&CK?
+
+ -
+ How should I not use ATT&CK?
+
+ -
+ ATT&CK Navigator
+
+ -
+ Community
+
+
+
+
+
+
+
+ What is ATT&CK?
+
+ ATT&CK is knowledge base of adversarial techniques based on real-world observations. ATT&CK
+ focuses on how adversaries interact with systems during an operation, reflecting the various phases of an
+ adversary’s attack lifecycle and the platforms they are known to target.
+
+
+ Read the ATT&CK 101 Blog post for
+ more information on the basics of ATT&CK and check the short video below.
+
+
+
+
+
+ Key Concepts
+
+
+ ATT&CK is a model that attempts to systematically categorize adversary behavior. The main components of
+ the model are:
+
+ -
+ Tactics, represents “why” or the reason an
+ adversary is performing an action
+
+ -
+ Techniques, represents “how” adversaries
+ achieve tactical goals by performing an action
+
+ -
+ Sub-techniques, a more specific or lower-level description of adversarial behavior
+
+ -
+ Procedures, specific implementation or in-the-wild use the adversary uses for
+ techniques or sub-techniques
+
+
+
+
+ ATT&CK is organized in a series of technology domains, the ecosystem an adversary operates within.
+ Currently, there are three technology domains:
+
+ -
+ Enterprise, representing traditional enterprise
+ networks and cloud technologies
+
+ -
+ Mobile for mobile communication devices
+
+ -
+ ICS for industrial control systems
+
+
+ Within each domain are platforms, which may be an operating system or application (e.g.
+ Microsoft Windows). Techniques and sub-techniques can apply to multiple platforms.
+
+
+
+ For more information on the principles behind ATT&CK, its creation, and its ongoing maintenance, read
+ the ATT&CK Philosophy Paper.
+ For additional information focused on ATT&CK for ICS, including the unique elements and commonalities
+ with ATT&CK, read the ATT&CK for ICS
+ Extension.
+
-
-
-
-
-
Last updated April 2024
-
-
-
-
-
-
Last updated April 2024
-
+
+
+
+
+
Last updated April 2024
+
+
+
+
+
+
Last updated April 2024
+
-
-
-
-
-
-
- How can I use ATT&CK?
- The following four use cases are the most common way that users report applying ATT&CK to their work.
-
-
- {{contact_card.render("Detections and Analytics", "", "ATT&CK can help cyber defenders develop analytics that detect the techniques used by an adversary.
-
Getting Started with ATT&CK: Detection and Analytics Blog Post
- This blog post describes how you can get started using ATT&CK for detection and analytics at three different levels of sophistication. (June 2019)
-
Finding Cyber Threats with ATT&CK-Based Analytics
- Presents a methodology for using ATT&CK to build, test, and refine behavioral-based analytic detection capabilities. (June 2017)
-
ATT&CKing the Status Quo Presentation
- The latter part of this presentation provides an introduction to using ATT&CK to create analytics. Slides are also available. (August 2018)",
- fa_icon=None, invert_icon=True, buttons=None, header_background=True,footer_description="View more resources about Detections and Analytics")}}
- {{contact_card.render("Threat Intelligence ", "", "ATT&CK gives analysts a common language to structure, compare, and analyze threat intelligence.
-
Getting Started with ATT&CK: Threat Intelligence Blog Post
- This blog post describes how you can get started using ATT&CK for detection and analytics at three different levels of sophistication. (June 2019)
-
ATT&CKing Your Adversaries Presentation
- This presentation covers how to use ATT&CK to take cyber threat intelligence and operationalize it into behaviors that can drive relevant detections. (August 2019)
-
Blog posts on threat intelligence
- These blog posts explain the fundamentals of how to use ATT&CK for threat intelligence. (September 2018)",
- fa_icon=None, invert_icon=True, buttons=None, header_background=True,footer_description="View more resources about Threat Intelligence")}}
-
-
-
- {{contact_card.render("Adversary Emulation and Red Teaming", "", "ATT&CK provides a common language and framework that red teams can use to emulate specific threats and plan their operations.
-
Getting Started with ATT&CK: Adversary Emulation and Red Teaming Blog Post
- This blog post describes how you can get started using ATT&CK for adversary emulation and red teaming at three different levels of sophistication. (July 2019)
-
Do-It-Yourself ATT&CK Evaluations to Improve Your Security Posture Presentation
- This presentation explains how defenders can improve their security posture through the use of adversary emulation by performing their very own ATT&CK Evaluations. (June 2019)
-
APT ATT&CK - Threat-based Purple Teaming with ATT&CK Continued Presentation
- This presentation covers how to use ATT&CK to take cyber threat intelligence and operationalize it into behaviors that can drive relevant detections. (May 2019)",
- fa_icon=None, invert_icon=True, buttons=None, header_background=True,footer_description="View more resources about Adversary Emulation and Red Teaming")}}
- {{contact_card.render("Assessment and Engineering", "", "ATT&CK can be used to assess your organization’s capabilities and drive engineering decisions like what tools or logging you should implement.
-
Getting Started with ATT&CK: Assessments and Engineering Blog Post
- This blog post describes how you can get started using ATT&CK for assessments and engineering at three different levels of sophistication. (August 2019)
-
Lessons Learned Applying ATT&CK-Based SOC Assessments
- This keynote presentation discusses a process to gauge a SOC’s detective capabilities as they relate to ATT&CK, including MITRE’s practical experiences and lessons learned. (June 2019)
-
Finding Cyber Threats with ATT&CK-Based Analytics
- Presents a methodology for using ATT&CK to build, test, and refine behavioral-based analytic detection capabilities. (June 2017)",
- fa_icon=None, invert_icon=True, buttons=None, header_background=True,footer_description="View more resources about Assessment and Engineering")}}
-
-
-
- Learn more about the Use Cases through the Sp4rkcon Presentation: Putting MITRE ATT&CK into Action with What You Have, Where You Are and the Getting Started with ATT&CK eBook.
-
- For additional ATT&CK topics and to explore presentations and training:
-
-
-
-
-
-
-
-
-
-
-
-
- How should I not use ATT&CK?
- ATT&CK is just as much about the mindset and process of using it as much as it is the knowledge base itself. When it comes to information security, the threats we face, new technologies, and the adaptability of goal-based adversaries, we cannot consider filling out a checklist as “done”.
-
-
-
-
-
-
-
- Don’t try to achieve 100% coverage. Every organization faces its own unique cyber threat. Not every tactic or technique will apply to everyone. Prioritize ones that are most relevant to you and ensure you are prepared for them.
-
-
-
-
-
-
-
-
-
- Don’t shout “Bingo” when you have one technique. Just because you have identified a single way an adversary has done a technique, doesn’t mean it’s time to declare success and color a box green. Adversaries have multiple ways they can perform most techniques. Look for and understand other ways a technique may be accomplished.
-
-
-
-
-
-
-
-
-
- Don’t limit yourself to the matrix. Remember the ATT&CK matrix only documents observed real-world behaviors. Adversaries may have a series of other behaviors they use that have not been documented yet. To get a full picture of threats your organization faces, (1) Leverage your own intelligence sources, (2) create and document your own observed techniques, and (3) don’t limit yourselves to behaviors, a timely indicator can catch an adversary.
-
-
-
-
-
-
- ATT&CK Navigator
- Use it to visualize defensive coverage, red/blue team planning, the frequency of detected techniques, and more. For more information on how to use Navigator, ATT&CK Navigator Use Case for Threat Intelligence.
-
-
-
-
-
-
-
-
-
-
-
-
-
- Community
-
- Stay informed on the latest updates and engage with the ATT&CK Community through Medium, Slack, and Twitter.
-
-
-
-
-
-
-
+
+
+
+
+
+
+ How can I use ATT&CK?
+ The following four use cases are the most common way that users report applying ATT&CK to their work.
+
+
+ {{contact_card.render("Detections and Analytics", "", "ATT&CK can help cyber defenders develop
+ analytics that detect the techniques used by an adversary.
+
Getting
+ Started with ATT&CK: Detection and Analytics Blog Post
+ This blog post describes how you can get started using ATT&CK for detection and analytics at three
+ different levels of sophistication. (June 2019)
+
Finding
+ Cyber Threats with ATT&CK-Based Analytics
+ Presents a methodology for using ATT&CK to build, test, and refine behavioral-based analytic detection
+ capabilities. (June 2017)
+
ATT&CKing the Status Quo Presentation
+
+ The latter part of this presentation provides an introduction to using ATT&CK to create analytics. Slides
+ are also available. (August 2018)",
+ fa_icon=None, invert_icon=True, buttons=None, header_background=True,footer_description="View more resources about Detections and
+ Analytics")}}
+ {{contact_card.render("Threat Intelligence ", "", "ATT&CK gives analysts a common language to
+ structure, compare, and analyze threat intelligence.
+
Getting
+ Started with ATT&CK: Threat Intelligence Blog Post
+ This blog post describes how you can get started using ATT&CK for detection and analytics at three
+ different levels of sophistication. (June 2019)
+
ATT&CKing
+ Your Adversaries Presentation
+ This presentation covers how to use ATT&CK to take cyber threat intelligence and operationalize it into
+ behaviors that can drive relevant detections. (August 2019)
+
Blog
+ posts on threat intelligence
+ These blog posts explain the fundamentals of how to use ATT&CK for threat intelligence. (September 2018)",
+ fa_icon=None, invert_icon=True, buttons=None, header_background=True,footer_description="View more resources about Threat
+ Intelligence")}}
+
+
+
+ {{contact_card.render("Adversary Emulation and Red Teaming", "", "ATT&CK provides a common
+ language and framework that red teams can use to emulate specific threats and plan their
+ operations.
+
Getting
+ Started with ATT&CK: Adversary Emulation and Red Teaming Blog Post
+ This blog post describes how you can get started using ATT&CK for adversary emulation and red teaming at
+ three different levels of sophistication. (July 2019)
+
Do-It-Yourself
+ ATT&CK Evaluations to Improve Your Security Posture Presentation
+ This presentation explains how defenders can improve their security posture through the use of adversary
+ emulation by performing their very own ATT&CK Evaluations. (June 2019)
+
APT
+ ATT&CK - Threat-based Purple Teaming with ATT&CK Continued Presentation
+ This presentation covers how to use ATT&CK to take cyber threat intelligence and operationalize it into
+ behaviors that can drive relevant detections. (May 2019)",
+ fa_icon=None, invert_icon=True, buttons=None, header_background=True,footer_description="View more resources about Adversary
+ Emulation and Red Teaming")}}
+ {{contact_card.render("Assessment and Engineering", "", "ATT&CK can be used to assess your
+ organization’s capabilities and drive engineering decisions like what tools or logging you should
+ implement.
+
Getting
+ Started with ATT&CK: Assessments and Engineering Blog Post
+ This blog post describes how you can get started using ATT&CK for assessments and engineering at three
+ different levels of sophistication. (August 2019)
+
Lessons Learned Applying ATT&CK-Based
+ SOC Assessments
+ This keynote presentation discusses a process to gauge a SOC’s detective capabilities as they relate to
+ ATT&CK, including MITRE’s practical experiences and lessons learned. (June 2019)
+
Finding
+ Cyber Threats with ATT&CK-Based Analytics
+ Presents a methodology for using ATT&CK to build, test, and refine behavioral-based analytic detection
+ capabilities. (June 2017)",
+ fa_icon=None, invert_icon=True, buttons=None, header_background=True,footer_description="View more resources about Assessment and
+ Engineering")}}
+
+
+
+ Learn more about the Use Cases through the Sp4rkcon
+ Presentation: Putting MITRE ATT&CK into Action with What You Have, Where You Are and the Getting
+ Started with ATT&CK eBook.
+
+ For additional ATT&CK topics and to explore presentations and training:
+
+
+
+
+
+
+
+
+
+
+
+
+ How should I not use ATT&CK?
+ ATT&CK is just as much about the mindset and process of using it as much as it is the knowledge base
+ itself. When it comes to information security, the threats we face, new technologies, and the adaptability
+ of goal-based adversaries, we cannot consider filling out a checklist as “done”.
+
+
+
+
+
+
+
+ Don’t try to achieve 100% coverage. Every organization faces its own unique cyber threat. Not every
+ tactic or technique will apply to everyone. Prioritize ones that are most relevant to you and ensure you
+ are prepared for them.
+
+
+
+
+
+
+
+
+
+ Don’t shout “Bingo” when you have one technique. Just because you have identified a single way an
+ adversary has done a technique, doesn’t mean it’s time to declare success and color a box green.
+ Adversaries have multiple ways they can perform most techniques. Look for and understand other ways a
+ technique may be accomplished.
+
+
+
+
+
+
+
+
+
+ Don’t limit yourself to the matrix. Remember the ATT&CK matrix only documents observed real-world
+ behaviors. Adversaries may have a series of other behaviors they use that have not been documented yet.
+ To get a full picture of threats your organization faces, (1) Leverage your own intelligence sources,
+ (2) create and document your own observed techniques, and (3) don’t limit yourselves to behaviors, a
+ timely indicator can catch an adversary.
+
+
+
+
+
+ ATT&CK Navigator
+ Use it to visualize defensive coverage, red/blue team planning, the frequency of detected techniques, and
+ more. For more information on how to use Navigator, ATT&CK Navigator Use Case for Threat
+ Intelligence.
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Community
+
+ Stay informed on the latest updates and engage with the ATT&CK Community through Medium, Slack, and
+ Twitter.
+
+
+
+
+
+
+
+
{% endblock %}
diff --git a/modules/resources/templates/training-access-tokens.html b/modules/resources/templates/training-access-tokens.html
index 70450fdc33f..ebcf86db98e 100644
--- a/modules/resources/templates/training-access-tokens.html
+++ b/modules/resources/templates/training-access-tokens.html
@@ -79,9 +79,11 @@ Modules
- {% if "playlist" in training and training.playlist and "is_youtube" in training and training.is_youtube %}
+ {% if "playlist" in training and training.playlist and "is_youtube" in training and training.is_youtube
+ %}
+ src="https://www.youtube.com/embed/{{ training.first_video_id }}?list={{ training.playlist_id }}"
+ allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture">
{{ training.description }}
diff --git a/modules/resources/templates/training-adversary-emulation.html b/modules/resources/templates/training-adversary-emulation.html
index e4c508325f8..f59d9c7d969 100644
--- a/modules/resources/templates/training-adversary-emulation.html
+++ b/modules/resources/templates/training-adversary-emulation.html
@@ -79,9 +79,11 @@ Modules
- {% if "playlist" in training and training.playlist and "is_youtube" in training and training.is_youtube %}
+ {% if "playlist" in training and training.playlist and "is_youtube" in training and training.is_youtube
+ %}
+ src="https://www.youtube.com/embed/{{ training.first_video_id }}?list={{ training.playlist_id }}"
+ allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture">
{{ training.description }}
diff --git a/modules/resources/templates/training-attack-fundamentals.html b/modules/resources/templates/training-attack-fundamentals.html
index d137b0c3118..0853fe77e8b 100644
--- a/modules/resources/templates/training-attack-fundamentals.html
+++ b/modules/resources/templates/training-attack-fundamentals.html
@@ -79,9 +79,11 @@ Modules
- {% if "playlist" in training and training.playlist and "is_youtube" in training and training.is_youtube %}
+ {% if "playlist" in training and training.playlist and "is_youtube" in training and training.is_youtube
+ %}
+ src="https://www.youtube.com/embed/{{ training.first_video_id }}?list={{ training.playlist_id }}"
+ allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture">
{{ training.description }}
diff --git a/modules/resources/templates/training-cti.html b/modules/resources/templates/training-cti.html
index 54eb033e21f..038f581ef43 100644
--- a/modules/resources/templates/training-cti.html
+++ b/modules/resources/templates/training-cti.html
@@ -11,11 +11,11 @@
{% block innerright %}
@@ -57,14 +57,24 @@ CTI Training
The training contains five modules that consist of videos and exercises that are linked below.
This training was designed to be completed in approximately 4 hours, and may be completed solo or as a team.
- We recommend you view the video for each module, and when prompted, pause the video to access the exercise documents linked below and complete the exercises, then proceed with viewing the video to go over the exercise.
- A copy of all slides from the training are here.
+ We recommend you view the video for each module, and when prompted, pause the video to access the exercise
+ documents linked below and complete the exercises, then proceed with viewing the video to go over the
+ exercise.
+ A copy of all slides from the training are here.
- Note:This training assumes an existing knowledge of ATT&CK and its primary concepts. We recommend reviewing the content from our ATT&CK Fundamentals Training before taking this training.
+ Note:This training assumes an existing knowledge of ATT&CK
+ and its primary concepts. We recommend reviewing the content from our ATT&CK
+ Fundamentals Training before taking this training.
- Note: The exercises in this training are based on a previous version of ATT&CK. We suggest using ATT&CK v8 and ATT&CK Navigator with ATT&CK v8 if you want exercise results to exactly match the training.
+ Note: The exercises in this training are based on a
+ previous version of ATT&CK. We suggest using ATT&CK
+ v8 and ATT&CK
+ Navigator with ATT&CK v8 if you want exercise results to exactly match the training.
Modules
@@ -109,7 +119,9 @@ Modules
-
- Note: This exercise is based on a previous version of ATT&CK. We recommend using {{ exercise.software.version }} if you want to match the training.
+ Note: This exercise is based on a previous
+ version of ATT&CK. We recommend using {{
+ exercise.software.version }} if you want to match the training.
diff --git a/modules/resources/templates/training-detection-engineering.html b/modules/resources/templates/training-detection-engineering.html
index 0ade89c232f..0708bd0fee1 100644
--- a/modules/resources/templates/training-detection-engineering.html
+++ b/modules/resources/templates/training-detection-engineering.html
@@ -79,9 +79,11 @@ Modules
- {% if "playlist" in training and training.playlist and "is_youtube" in training and training.is_youtube %}
+ {% if "playlist" in training and training.playlist and "is_youtube" in training and training.is_youtube
+ %}
+ src="https://www.youtube.com/embed/{{ training.first_video_id }}?list={{ training.playlist_id }}"
+ allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture">
{{ training.description }}
diff --git a/modules/resources/templates/training-purple-teaming-fundamentals.html b/modules/resources/templates/training-purple-teaming-fundamentals.html
index 75130762bfe..2a7935072b2 100644
--- a/modules/resources/templates/training-purple-teaming-fundamentals.html
+++ b/modules/resources/templates/training-purple-teaming-fundamentals.html
@@ -79,9 +79,11 @@ Modules
- {% if "playlist" in training and training.playlist and "is_youtube" in training and training.is_youtube %}
+ {% if "playlist" in training and training.playlist and "is_youtube" in training and training.is_youtube
+ %}
+ src="https://www.youtube.com/embed/{{ training.first_video_id }}?list={{ training.playlist_id }}"
+ allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture">
{{ training.description }}
diff --git a/modules/resources/templates/training-soc-assessments.html b/modules/resources/templates/training-soc-assessments.html
index f82ab6184c7..0be01b08e02 100644
--- a/modules/resources/templates/training-soc-assessments.html
+++ b/modules/resources/templates/training-soc-assessments.html
@@ -79,9 +79,11 @@ Modules
- {% if "playlist" in training and training.playlist and "is_youtube" in training and training.is_youtube %}
+ {% if "playlist" in training and training.playlist and "is_youtube" in training and training.is_youtube
+ %}
+ src="https://www.youtube.com/embed/{{ training.first_video_id }}?list={{ training.playlist_id }}"
+ allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture">
{{ training.description }}
diff --git a/modules/resources/templates/training-threat-hunting.html b/modules/resources/templates/training-threat-hunting.html
index 212568cf2e7..dbaa7801297 100644
--- a/modules/resources/templates/training-threat-hunting.html
+++ b/modules/resources/templates/training-threat-hunting.html
@@ -79,9 +79,11 @@ Modules
- {% if "playlist" in training and training.playlist and "is_youtube" in training and training.is_youtube %}
+ {% if "playlist" in training and training.playlist and "is_youtube" in training and training.is_youtube
+ %}
+ src="https://www.youtube.com/embed/{{ training.first_video_id }}?list={{ training.playlist_id }}"
+ allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture">
{{ training.description }}
diff --git a/modules/resources/templates/training.html b/modules/resources/templates/training.html
index 60e46f4deb2..4f92ac90839 100644
--- a/modules/resources/templates/training.html
+++ b/modules/resources/templates/training.html
@@ -10,42 +10,44 @@
{% block innerright %}
-
- ATT&CK Training
-
- -
- ATT&CK Cyber Threat Intelligence: This training by the ATT&CK team will help you learn how to apply ATT&CK and improve your threat intelligence practices.
-
- -
- Purple Teaming Fundamentals
-
- -
- ATT&CK Fundamentals
-
- -
- ATT&CK Adversary Emulation
-
- -
- ATT&CK Access Tokens Technical Primer
-
- -
- ATT&CK Based SOC Assessments
-
- -
- TTP-Based Threat Hunting and Detection Engineering
-
- -
- ATT&CK Detection Engineering
-
-
-
+
+ ATT&CK Training
+
+ -
+ ATT&CK Cyber Threat Intelligence: This training
+ by the ATT&CK team will help you learn how to apply ATT&CK and improve your threat intelligence practices.
+
+ -
+ Purple Teaming Fundamentals
+
+ -
+ ATT&CK Fundamentals
+
+ -
+ ATT&CK Adversary Emulation
+
+ -
+ ATT&CK Access Tokens Technical Primer
+
+ -
+ ATT&CK Based SOC Assessments
+
+ -
+ TTP-Based Threat Hunting and Detection
+ Engineering
+
+ -
+ ATT&CK Detection Engineering
+
+
+
{% endblock %}
diff --git a/modules/resources/templates/update-post.html b/modules/resources/templates/update-post.html
index 4a74327879e..d05570c2a6a 100644
--- a/modules/resources/templates/update-post.html
+++ b/modules/resources/templates/update-post.html
@@ -9,16 +9,16 @@
{% block innerright %}
{{ super () }}
-
-
- {{ article.title }}
- {{ article.content }}
-
+
+
+ {{ article.title }}
+ {{ article.content }}
+
{% endblock %}
{% block scripts %}
{{ super() }}
diff --git a/modules/resources/templates/updates-index.html b/modules/resources/templates/updates-index.html
index 749f6d643a1..b8efc8ba72d 100644
--- a/modules/resources/templates/updates-index.html
+++ b/modules/resources/templates/updates-index.html
@@ -9,17 +9,18 @@
{% endblock %}
{% block innerright %}
{{ super () }}
-
- {% if articles %}
-
- {{ (articles|selectattr('template', 'equalto', 'resources/update-post')|first).title }}
- {{ (articles|selectattr('template', 'equalto', 'resources/update-post')|first).content }}
-
- {% endif %}
+
+{% if articles %}
+
+ {{ (articles|selectattr('template', 'equalto', 'resources/update-post')|first).title
+ }}
+ {{ (articles|selectattr('template', 'equalto', 'resources/update-post')|first).content }}
+
+{% endif %}
{% endblock %}
{% block scripts %}
diff --git a/modules/resources/templates/use-cases.html b/modules/resources/templates/use-cases.html
index 8ea2b381ae6..8b3eed76ffb 100644
--- a/modules/resources/templates/use-cases.html
+++ b/modules/resources/templates/use-cases.html
@@ -1,42 +1,42 @@
-{% extends "general/two-column.html" %}
+{% extends "general/two-column.html" %}
{% set active_page = "resources" -%}
-{% set title = "Get Started - " + page.title + " | MITRE ATT&CK®" -%}
+{% set title = "Get Started - " + page.title + " | MITRE ATT&CK®" -%}
{% set parsed = page.data | from_json %}
{% import 'macros/navigation.html' as navigation %}
{% block innerleft %}
- {{navigation.sidenav(RESOURCE_NAV, output_file)}}
+ {{navigation.sidenav(RESOURCE_NAV, output_file)}}
{% endblock %}
{% block innerright %}
-
- {{parsed.title}}
-
-
- {{parsed.description}}
-
- {% for res in parsed.resources %}
- {{res.title}}
-
- {{res.description}} {{res.date}}
-
- {% endfor %}
-
-
-
- Return to Get Started
+
+ {{parsed.title}}
+
+
+ {{parsed.description}}
+
+ {% for res in parsed.resources %}
+ {{res.title}}
+
+ {{res.description}} {{res.date}}
+
+ {% endfor %}
+
+
+ Return to Get Started
+
{% endblock %}
diff --git a/modules/software/templates/software-index.html b/modules/software/templates/software-index.html
index 0c43f5b1055..cd7c341da34 100644
--- a/modules/software/templates/software-index.html
+++ b/modules/software/templates/software-index.html
@@ -12,80 +12,89 @@
{% endblock %}
{% block innerright %}
- {{ super () }}
-
-
-
-
-
-
-
- Software
-
- Software is a generic term for custom or commercial code, operating system utilities, open-source software,
- or other tools used to conduct behavior modeled in ATT&CK.
- Some instances of software have multiple names associated with the same instance due to various organizations
- tracking the same set of software by different names.
- The team makes a best effort to track overlaps between names based on publicly reported associations, which are designated as
- “Associated Software” on each page (formerly labeled “Aliases”), because we believe these overlaps are useful for analyst awareness.
-
-
- Software entries include publicly reported technique use or capability to use a technique and may be mapped
- to Groups who have been reported to use that Software.
- The information provided does not represent all possible technique use by a piece of Software, but rather
- a subset that is available solely through open source reporting.
-
-
- - Tool - Commercial, open-source, built-in, or publicly available software that could be used by a defender, pen tester, red teamer, or an adversary. This category includes both software that generally is not found on an enterprise system as well as software generally available as part of an operating system that is already present in an environment. Examples include PsExec, Metasploit, Mimikatz, as well as Windows utilities such as Net, netstat, Tasklist, etc.
- - Malware - Commercial, custom closed source, or open source software intended to be used for malicious purposes by adversaries. Examples include PlugX, CHOPSTICK, etc.
-
+{{ super () }}
+
+
+
+
+
+
+
+
+ Software
+
+ Software is a generic term for custom or commercial code, operating system utilities, open-source software,
+ or other tools used to conduct behavior modeled in ATT&CK.
+ Some instances of software have multiple names associated with the same instance due to various
+ organizations
+ tracking the same set of software by different names.
+ The team makes a best effort to track overlaps between names based on publicly reported associations, which
+ are designated as
+ “Associated Software” on each page (formerly labeled “Aliases”), because we believe these overlaps are
+ useful for analyst awareness.
+
+
+ Software entries include publicly reported technique use or capability to use a technique and may be mapped
+ to Groups who have been reported to use that Software.
+ The information provided does not represent all possible technique use by a piece of Software, but rather
+ a subset that is available solely through open source reporting.
+
+
+ - Tool - Commercial, open-source, built-in, or publicly available software that could be used
+ by a defender, pen tester, red teamer, or an adversary. This category includes both software that
+ generally is not found on an enterprise system as well as software generally available as part of an
+ operating system that is already present in an environment. Examples include PsExec, Metasploit, Mimikatz,
+ as well as Windows utilities such as Net, netstat, Tasklist, etc.
+ - Malware - Commercial, custom closed source, or open source software intended to be used for
+ malicious purposes by adversaries. Examples include PlugX, CHOPSTICK, etc.
+
- Software: {{ parsed.software_list_len }}
-
-
-
-
- ID
- Name
- Associated Software
- Description
-
-
-
- {% for row in parsed.software_table %}
-
-
- {{row.id|upper}}
-
-
- {{row.name}}
-
-
- {{row.aliases_list|join(", ")}}
-
-
- {% if row.deprecated %}
- ****Deprecation Warning****
- {% endif %}
- {{clean_output.stixToHTML(row.descr)}}
-
-
- {% endfor %}
-
-
-
-
-
-
+ Software: {{ parsed.software_list_len }}
+
+
+
+
+ ID
+ Name
+ Associated Software
+ Description
+
+
+
+ {% for row in parsed.software_table %}
+
+
+ {{row.id|upper}}
+
+
+ {{row.name}}
+
+
+ {{row.aliases_list|join(", ")}}
+
+
+ {% if row.deprecated %}
+ ****Deprecation Warning****
+ {% endif %}
+ {{clean_output.stixToHTML(row.descr)}}
+
+
+ {% endfor %}
+
+
+
+
+
+
{% endblock %}
{% block scripts %}
- {{ super() }}
-
-
+{{ super() }}
+
+
{% endblock %}
\ No newline at end of file
diff --git a/modules/software/templates/software.html b/modules/software/templates/software.html
index 21555b6670c..86b28939cd8 100644
--- a/modules/software/templates/software.html
+++ b/modules/software/templates/software.html
@@ -13,11 +13,11 @@
{% import 'macros/notes.html' as notes %}
{% block head %}
- {{ super () }}
- {% if parsed.deprecated %}
-
- {% endif %}
-{% endblock %}
+{{ super () }}
+{% if parsed.deprecated %}
+
+{% endif %}
+{% endblock %}
{% block innerleft %}
@@ -26,228 +26,233 @@
{% endblock %}
{% block innerright %}
- {{ super () }}
-
-
-
-
-
-
-
- {{parsed.name}}
-
+{{ super () }}
+
+
+
+
+
+
+
+
+ {{parsed.name}}
+
- {% if parsed.deprecated %}
- {% if parsed.descr %}
- {{deprecated.deprecated(clean_output.stixToHTML(parsed.descr, firstParagraphOnly=True))}}
- {% else %}
- {{deprecated.deprecated("This software has been deprecated.")}}
- {% endif %}
- {% else %}
-
-
- {% if parsed.descr %}
-
- {{clean_output.stixToHTML(parsed.descr, parsed.citations)}}
-
- {% endif %}
- {% if parsed.notes %}
- {{ notes.notes_section(parsed.notes) }}
- {% endif %}
-
-
-
-
- {% if parsed.attack_id %}
-
-
-
- ID: {{parsed.attack_id}}
-
-
- {% endif %}
- {% if parsed.aliases_list %}
-
-
- ⓘ
-
-
- Associated Software: {{parsed.aliases_list|join(", ")}}
-
-
- {% endif %}
- {% if parsed.type %}
-
-
- ⓘ
-
-
- Type: {{parsed.type}}
-
-
- {% endif %}
- {% if parsed.platform_list %}
-
-
- ⓘ
-
-
- Platforms: {{parsed.platform_list|join(", ")}}
-
-
- {% endif %}
- {% if parsed.contributors_list %}
-
-
-
- Contributors: {{parsed.contributors_list|join("; ")}}
-
-
- {% endif %}
- {% if parsed.version %}
-
-
-
- Version: {{parsed.version}}
-
-
- {% endif %}
- {% if parsed.created %}
-
-
-
- Created: {{parsed.created}}
-
-
- {% endif %}
- {% if parsed.modified %}
-
-
-
- Last Modified: {{parsed.modified}}
-
-
- {% endif %}
-
-
- {% if parsed.versioning_feature %}
- {{ versioning.permalink_button(output_file, parsed.attack_id)}}
- {% endif %}
-
-
+ {% if parsed.deprecated %}
+ {% if parsed.descr %}
+ {{deprecated.deprecated(clean_output.stixToHTML(parsed.descr, firstParagraphOnly=True))}}
+ {% else %}
+ {{deprecated.deprecated("This software has been deprecated.")}}
+ {% endif %}
+ {% else %}
+
+
+ {% if parsed.descr %}
+
+ {{clean_output.stixToHTML(parsed.descr, parsed.citations)}}
+
+ {% endif %}
+ {% if parsed.notes %}
+ {{ notes.notes_section(parsed.notes) }}
+ {% endif %}
+
+
+
+
+ {% if parsed.attack_id %}
+
+
+
+ ID: {{parsed.attack_id}}
+
+
+ {% endif %}
+ {% if parsed.aliases_list %}
+
+
+ ⓘ
+
+
+ Associated Software: {{parsed.aliases_list|join(", ")}}
+
+
+ {% endif %}
+ {% if parsed.type %}
+
+
+ ⓘ
+
+
+ Type: {{parsed.type}}
+
+
+ {% endif %}
+ {% if parsed.platform_list %}
+
+
+ ⓘ
+
+
+ Platforms: {{parsed.platform_list|join(", ")}}
+
+
+ {% endif %}
+ {% if parsed.contributors_list %}
+
+
+
+ Contributors: {{parsed.contributors_list|join("; ")}}
+
+
+ {% endif %}
+ {% if parsed.version %}
+
+
+
+ Version: {{parsed.version}}
+
+
+ {% endif %}
+ {% if parsed.created %}
+
+
+
+ Created: {{parsed.created}}
+
+
+ {% endif %}
+ {% if parsed.modified %}
+
+
+
+ Last Modified: {{parsed.modified}}
+
+
+ {% endif %}
+
+
+ {% if parsed.versioning_feature %}
+ {{ versioning.permalink_button(output_file, parsed.attack_id)}}
+ {% endif %}
+
+
- {% if parsed.alias_descriptions %}
- Associated Software Descriptions
-
-
-
-
- Name
- Description
-
-
-
- {% for alias in parsed.alias_descriptions %}
-
-
- {{alias.name}}
-
-
- {{clean_output.stixToHTML(alias.descr, parsed.citations)}}
-
-
- {% endfor %}
-
-
-
- {% endif %}
+ {% if parsed.alias_descriptions %}
+ Associated Software Descriptions
+
+
+
+
+ Name
+ Description
+
+
+
+ {% for alias in parsed.alias_descriptions %}
+
+
+ {{alias.name}}
+
+
+ {{clean_output.stixToHTML(alias.descr, parsed.citations)}}
+
+
+ {% endfor %}
+
+
+
+ {% endif %}
- {% if parsed.technique_table_data %}
- {{navigator.layer_links(parsed.attack_id, "software", parsed.layers)}}
- {{techniques_used.techniques_used(parsed.technique_table_data, "Techniques Used", true, "Use", parsed.citations)}}
- {% endif %}
+ {% if parsed.technique_table_data %}
+ {{navigator.layer_links(parsed.attack_id, "software", parsed.layers)}}
+ {{techniques_used.techniques_used(parsed.technique_table_data, "Techniques Used", true, "Use",
+ parsed.citations)}}
+ {% endif %}
- {% if parsed.groups %}
- Groups That Use This Software
-
-
-
-
- ID
- Name
- References
-
-
-
- {% for group in parsed.groups %}
-
-
- {{group.id}}
-
-
- {{group.name}}
-
-
- {{clean_output.stixToHTML(group.descr, parsed.citations)}}
-
-
- {% endfor %}
-
-
-
- {% endif %}
+ {% if parsed.groups %}
+ Groups That Use This Software
+
+
+
+
+ ID
+ Name
+ References
+
+
+
+ {% for group in parsed.groups %}
+
+
+ {{group.id}}
+
+
+ {{group.name}}
+
+
+ {{clean_output.stixToHTML(group.descr, parsed.citations)}}
+
+
+ {% endfor %}
+
+
+
+ {% endif %}
- {% if parsed.campaign_data %}
- Campaigns
-
-
-
-
- ID
- Name
- Description
-
-
-
- {% for campaign in parsed.campaign_data %}
-
-
- {{campaign.id}}
-
-
- {{campaign.name}}
-
-
- {% if campaign.desc %}
- {{clean_output.stixToHTML(campaign.desc, parsed.citations)}}
- {% endif %}
-
-
- {% endfor %}
-
-
-
- {% endif %}
+ {% if parsed.campaign_data %}
+ Campaigns
+
+
+
+
+ ID
+ Name
+ Description
+
+
+
+ {% for campaign in parsed.campaign_data %}
+
+
+ {{campaign.id}}
+
+
+ {{campaign.name}}
+
+
+ {% if campaign.desc %}
+ {{clean_output.stixToHTML(campaign.desc, parsed.citations)}}
+ {% endif %}
+
+
+ {% endfor %}
+
+
+
+ {% endif %}
- {{ citations.reference_section(parsed.citations) }}
+ {{ citations.reference_section(parsed.citations) }}
- {% endif %}
-
-
-
+ {% endif %}
+
+
+
{% endblock %}
{% block scripts %}
- {{ super() }}
-
-
-
-
-
-{% endblock %}
+{{ super() }}
+
+
+
+
+
+{% endblock %}
\ No newline at end of file
diff --git a/modules/tactics/templates/tactic.html b/modules/tactics/templates/tactic.html
index fec15eaca49..f5850925889 100644
--- a/modules/tactics/templates/tactic.html
+++ b/modules/tactics/templates/tactic.html
@@ -1,4 +1,4 @@
-{% extends "general/two-column.html" -%}
+{% extends "general/two-column.html" -%}
{% import 'macros/navigation.html' as navigation %}
{% import 'macros/table_with_subtechniques.html' as technique_table %}
{% import 'macros/versioning.html' as versioning %}
@@ -8,20 +8,20 @@
{% set parsed = page.data | from_json %}
{% if parsed.domain == "mobile" %}
- {% set title = parsed.name + ", Tactic " + parsed.attack_id + " - Mobile | MITRE ATT&CK®" -%}
+{% set title = parsed.name + ", Tactic " + parsed.attack_id + " - Mobile | MITRE ATT&CK®" -%}
{% elif parsed.domain == "enterprise" %}
- {% set title = parsed.name + ", Tactic " + parsed.attack_id + " - Enterprise | MITRE ATT&CK®" -%}
-{% elif parsed.domain == "ics" %}
- {% set title = parsed.name + ", Tactic " + parsed.attack_id + " - ICS | MITRE ATT&CK®" -%}
+{% set title = parsed.name + ", Tactic " + parsed.attack_id + " - Enterprise | MITRE ATT&CK®" -%}
+{% elif parsed.domain == "ics" %}
+{% set title = parsed.name + ", Tactic " + parsed.attack_id + " - ICS | MITRE ATT&CK®" -%}
{% endif %}
{% set active_page = "tactics" -%}
{% block head %}
- {{ super () }}
- {% if parsed.deprecated %}
-
- {% endif %}
-{% endblock %}
+{{ super () }}
+{% if parsed.deprecated %}
+
+{% endif %}
+{% endblock %}
{% block innerleft %}
@@ -30,81 +30,83 @@
{% endblock %}
{% block innerright %}
- {{ super () }}
-
{{ con.title }}
+ {% set conID = "-".join(con.date.split(' ')) %} +{{ con.title }}
- {% set ifSponsor = "sponsors_img_list" in con %} - {% if "banner_img" in con %} -
-
-
+
+
{{con.description}}
-Click here to read our blog post about {{con.title}}!
- {% if "banner_img" in con %} -
Presentations
- - {% for presentation in con.presentations %} - {% set isPanel = "moderator" in presentation %} --
- {% for panelist in presentation.panelists %}
-
- - {{panelist}} - - {% endfor %} -
-
- {% for topic in presentation.topics %}
-
- - {{topic}} - - {% endfor %} -
Sponsors
-{{con.description}}
+Click here to read our blog post about
+ {{con.title}}!
+
+ {% if "banner_img" in con %} +
Presentations
+ + {% for presentation in con.presentations %} + {% set isPanel = "moderator" in presentation %} +-
+ {% for panelist in presentation.panelists %}
+
- + {{panelist}} + + {% endfor %} +
-
+ {% for topic in presentation.topics %}
+
- + {{topic}} + + {% endfor %} +
Sponsors
+ATT&CKcon
-- At MITRE ATT&CK's annual conference, cybersecurity leaders and practitioners of all levels are - invited to strengthen capabilities and engage with others in the community through multiple days of programming, - featuring knowledgeable speakers, engaging content, and meaningful collaboration, all designed to help - leverage the ATT&CK framework. - Browse the archive of presentations below. -
-- Learn about future ATT&CKcons by keeping up with us at Engage with ATT&CK -
-McLean, VA", - invert_icon=True)}} - {{contact_card.render( - "ATT&CKcon 5.0", - "/resources/attackcon/october-2024/", - "October 22nd - 23rd, 2024
McLean, VA", invert_icon=True)}} - {{contact_card.render( - "ATT&CKcon 4.0", - "/resources/attackcon/october-2023/", - "October 24th - 25th, 2023
McLean, VA", - invert_icon=True)}} -
+ At MITRE ATT&CK's annual conference, cybersecurity leaders and practitioners of all levels are + invited to strengthen capabilities and engage with others in the community through multiple days of programming, + featuring knowledgeable speakers, engaging content, and meaningful collaboration, all designed to help + leverage the ATT&CK framework. + Browse the archive of presentations below. +
++ Learn about future ATT&CKcons by keeping up with us at Engage with ATT&CK +
+McLean, VA", + invert_icon=True)}} + {{contact_card.render( + "ATT&CKcon 5.0", + "/resources/attackcon/october-2024/", + "October 22nd - 23rd, 2024
McLean, VA", invert_icon=True)}} + {{contact_card.render( + "ATT&CKcon 4.0", + "/resources/attackcon/october-2023/", + "October 24th - 25th, 2023
McLean, VA", + invert_icon=True)}} +
McLean, VA", - invert_icon=True)}} - {{contact_card.render( - "ATT&CKcon PowerHour", - "/resources/attackcon/october-2020/", - "October 2020 - January 2021
Virtual", - invert_icon=True)}} - {{contact_card.render("ATT&CKcon 2.0", "/resources/attackcon/october-2019/", "October 29th - 30th, - 2019
McLean, VA", - invert_icon=True)}} -
McLean, VA", - invert_icon=True)}} - - -
McLean, VA", + invert_icon=True)}} + {{contact_card.render( + "ATT&CKcon PowerHour", + "/resources/attackcon/october-2020/", + "October 2020 - January 2021
Virtual", + invert_icon=True)}} + {{contact_card.render("ATT&CKcon 2.0", "/resources/attackcon/october-2019/", "October 29th - 30th, + 2019
McLean, VA", + invert_icon=True)}} +
McLean, VA", + invert_icon=True)}} + +
Stay Informed
- - We're creating a community of ATT&CK users who are passionate about ATT&CK and threat informed defense. - Here's how you can find other community members, find out what they're doing with ATT&CK, and get involved. - -Contact Us
-Stay Informed
+ + We're creating a community of ATT&CK users who are passionate about ATT&CK and threat informed defense. + Here's how you can find other community members, find out what they're doing with ATT&CK, and get involved. + +Contact Us
+Contribute
-- ATT&CK is in a constant state of development. We are always on the lookout for new information to help - refine and extend what is covered. If you have additional techniques, know about variations on one already covered, - have examples of techniques in use, or have other relevant information, then we would like to hear from you. -
-- We are looking for contributions in the following areas, but all contributions and feedback to ATT&CK are appreciated. - If you have other information you think may be useful, please reach us at attack@mitre.org. -
- -- Due to the high volume of contributions, it may take us about a week to get back to you. We recommend you read our - philosophy paper to understand - our approach to maintaining ATT&CK so that we get the right details up front. Content updates happen roughly every 6 months. -
-- - - -
-What we're looking for
- -To understand the process of how - the MITRE team develops techniques, refer to the video below.", - buttons=[ - {"label": "See an example", "url": "#techniques-modal", "card_modal": "techniques-modal"}, - {"label": "Video", "url": "https://youtu.be/v24a5IOwObc?si=TuG_-WrknY4r7pkC"} - ], - fa_icon=None, invert_icon=True, header_background=True, footer_description=None, header_subtitle=None)}} - - {{contact_card.render("Threat Intelligence", "", - "We map Group and Software examples on our site, and appreciate your help with referenced information about - how Groups and Software samples use ATT&CK techniques. Please share the sub-technique or technique name, - group or associated group name, a brief description of how the technique is implemented, and the publicly-available reference.", - buttons=[ - {"label": "See an example", "url": "#threat-intel-modal", "card_modal": "threat-intel-modal"} - ], - fa_icon=None, invert_icon=True, header_background=True, footer_description=None, header_subtitle=None)}} - - {{contact_card.render("Website Content Errors", "", - "If you find errors or typos on the site related to content, please let us know by - submitting the url where you found the error and a short description. Examples include - typos and syntax errors, improperly formatted web pages, and 404 errors when links are clicked.", - buttons=[ - {"label": "See an example", "url": "#errors-modal", "card_modal": "errors-modal"} - ], - fa_icon=None, invert_icon=True, header_background=True, footer_description=None, header_subtitle=None)}} -
Contributors
-- The following individuals or organizations have contributed information - regarding the existence of a technique, details on how to detect and/or mitigate - use of a technique, or threat intelligence on adversary use: -
--
- {% for row in col %}
-
- - {{row}} - - {% endfor %} -
- Thanks to those who have contributed to ATT&CK! -
-Learn More About ATT&CK
Featured MITRE Presentations
-- The featured presentations highlight applications, new techniques, and current topics of interest to ATT&CK. - All MITRE presentations were developed by members of the ATT&CK team at MITRE. -
-+ The featured presentations highlight applications, new techniques, and current topics of interest to ATT&CK. + All MITRE presentations were developed by members of the ATT&CK team at MITRE. +
+- Browse all MITRE presentations + {{contact_card.render("Objective by the Sea: Drawing Out ATT&CK Techniques in the Wild", "", + "This presentation provides a high-level explanation of the ATT&CK framework for MacOS and its components, then + walks through the application of the ATT&CK framework to a real-world campaign using Pandas as a model. + Emphasizes community-driven aspects of ATT&CK.", + buttons=[ + {"label": "View Presentation", "url": "https://www.youtube.com/watch?v=pT8C9P3BiVw"} + ], + fa_icon=None, invert_icon=True, header_background=True, footer_description=None, header_subtitle="November + 2022")}}
MITRE CTI Training
-- Using MITRE ATT&CK for Cyber Threat Intelligence Training by Katie Nickels and Adam Pennington provides - several modules to help you learn how to apply ATT&CK and improve your threat intelligence practices. -
- -MITRE CTI Training
++ Using MITRE ATT&CK for Cyber Threat Intelligence Training by Katie Nickels and Adam Pennington provides + several modules to help you learn how to apply ATT&CK and improve your threat intelligence practices. +
+ + - -Reading Materials
-- These materials provide an in-depth look at why we created these ATT&CK domains, how we maintain and update - them, - and what the community commonly uses them for. -
-Reading Materials
++ These materials provide an in-depth look at why we created these ATT&CK domains, how we maintain and update + them, + and what the community commonly uses them for. +
+Legal & Branding
-- ATT&CK is open and available to any person or organization for use at no charge. If you decide to use ATT&CK, then follow the Terms of Use and follow guidelines for referencing the use of ATT&CK in your work. -
+Legal & Branding
++ ATT&CK is open and available to any person or organization for use at no charge. If you decide to use + ATT&CK, then follow the Terms of Use and follow + guidelines for referencing the use of ATT&CK in your work. +
-Referencing ATT&CK
-- Both MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. -
-- Your first references in writing must include “MITRE” preceding “ATT&CK®” - but subsequently should just reference “ATT&CK” (no registered trademark symbol required). -
-- A headline should always reference MITRE ATT&CK® -
-MITRE ATT&CK® is a curated knowledge base and model for cyber adversary behavior.
-ATT&CK is open and available to any person or organization for use at no charge.
-Referencing ATT&CK
++ Both MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE + Corporation. +
++ Your first references in writing must include “MITRE” preceding “ATT&CK®” - but + subsequently should just reference “ATT&CK” (no registered trademark symbol required). +
++ A headline should always reference MITRE ATT&CK® +
+MITRE ATT&CK® is a curated knowledge base and model for cyber adversary + behavior.
+ATT&CK is open and available to any person or organization for use at no charge.
+Dos and Don’ts of Referencing ATT&CK
-- DO -
--
- DO NOT -
--
-
Dos and Don’ts of Referencing ATT&CK
++ DO +
+Logos
-
-
- 
-
- 
-
- 
Brand Guide
-- The brand guide provides further detail on the consistent implementation of the MITRE ATT&CK® brand identity, both visually and verbally, to both internal and external audiences, while respecting our legal trademark restrictions. If you have further questions, please reach out to as at attack@mitre.org. -
- - - --
Additional Policies
-
- Terms of Use
-
- Privacy Policy
-
+
+ DO NOT +
++
+
Logos
+ + +Brand Guide
++ The brand guide provides further detail on the consistent implementation of the MITRE + ATT&CK® brand identity, both visually and verbally, to both internal and external + audiences, while respecting our legal trademark restrictions. If you have further questions, please reach out + to as at attack@mitre.org. +
+ + + ++
Additional Policies
+
+ Terms of Use
+
+ Privacy Policy
+
Presentation Archive
-- Browse our archive of presentations by MITRE’s ATT&CK team, covering various cybersecurity topics related to ATT&CK. Presented at different conferences, these talks offer valuable insights and expertise from our team members. -
- -Presentations
- - {% for presentation in parsed.presentations %} -Presentation Archive
++ Browse our archive of presentations by MITRE’s ATT&CK team, covering various cybersecurity topics + related to ATT&CK. Presented at different conferences, these talks offer valuable insights and expertise + from our team members. +
+ +Presentations
+ + {% for presentation in parsed.presentations %} + + {% endfor %}Previous Versions
-- We preserve previous versions of the website each time we do a major ATT&CK content update. Click below to see a previous version of the site or the updates that occurred with that particular major release. -
--
- {% for version in parsed.versions %}
- {% if version.retired %}
-
- {{version.date_start}} - {{version.date_end}}. This version has been removed from the site. You can still download this version's source data or browse the raw HTML. - {% else %} -
- {{version.date_start}} - {{version.date_end}} (Updates) - {% endif %} - {% endfor %} -
Previous Versions
++ We preserve previous versions of the website each time we do a major ATT&CK content update. Click below to see a + previous version of the site or the updates that occurred with that particular major release. +
+-
+ {% for version in parsed.versions %}
+ {% if version.retired %}
+
- {{version.date_start}} - {{version.date_end}}. This version has been removed from the site. You can still + download this version's source data or browse the raw HTML. + {% else %} +
- {{version.date_start}} - {{version.date_end}} (Updates) + {% endif %} + {% endfor %} +
Get Started
--
-
- - What is ATT&CK? - -
- - How can I use ATT&CK? - -
- - How should I not use ATT&CK? - -
- - ATT&CK Navigator - -
- - Community - -
What is ATT&CK?
-- ATT&CK is knowledge base of adversarial techniques based on real-world observations. ATT&CK focuses on how adversaries interact with systems during an operation, reflecting the various phases of an adversary’s attack lifecycle and the platforms they are known to target. -
-- Read the ATT&CK 101 Blog post for more information on the basics of ATT&CK and check the short video below. -
--
Key Concepts
--
-
- - Tactics, represents “why” or the reason an adversary is performing an action - -
- - Techniques, represents “how” adversaries achieve tactical goals by performing an action - -
- - Sub-techniques, a more specific or lower-level description of adversarial behavior - -
- - Procedures, specific implementation or in-the-wild use the adversary uses for techniques or sub-techniques - -
-
-
- - Enterprise, representing traditional enterprise networks and cloud technologies - -
- - Mobile for mobile communication devices - -
- - ICS for industrial control systems - -
- For more information on the principles behind ATT&CK, its creation, and its ongoing maintenance, read the ATT&CK Philosophy Paper. - For additional information focused on ATT&CK for ICS, including the unique elements and commonalities with ATT&CK, read the ATT&CK for ICS Extension. -
+Get Started
+-
+
- + What is ATT&CK? + +
- + How can I use ATT&CK? + +
- + How should I not use ATT&CK? + +
- + ATT&CK Navigator + +
- + Community + +
What is ATT&CK?
++ ATT&CK is knowledge base of adversarial techniques based on real-world observations. ATT&CK + focuses on how adversaries interact with systems during an operation, reflecting the various phases of an + adversary’s attack lifecycle and the platforms they are known to target. +
++ Read the ATT&CK 101 Blog post for + more information on the basics of ATT&CK and check the short video below. +
++
Key Concepts
+-
+
- + Tactics, represents “why” or the reason an + adversary is performing an action + +
- + Techniques, represents “how” adversaries + achieve tactical goals by performing an action + +
- + Sub-techniques, a more specific or lower-level description of adversarial behavior + +
- + Procedures, specific implementation or in-the-wild use the adversary uses for + techniques or sub-techniques + +
-
+
- + Enterprise, representing traditional enterprise + networks and cloud technologies + +
- + Mobile for mobile communication devices + +
- + ICS for industrial control systems + +
+ For more information on the principles behind ATT&CK, its creation, and its ongoing maintenance, read + the ATT&CK Philosophy Paper. + For additional information focused on ATT&CK for ICS, including the unique elements and commonalities + with ATT&CK, read the ATT&CK for ICS + Extension. +
-- - - -
- - - -
+ + + +
+ + + +
-
How can I use ATT&CK?
- The following four use cases are the most common way that users report applying ATT&CK to their work. - -Getting Started with ATT&CK: Detection and Analytics Blog Post
- This blog post describes how you can get started using ATT&CK for detection and analytics at three different levels of sophistication. (June 2019) -
Finding Cyber Threats with ATT&CK-Based Analytics
- Presents a methodology for using ATT&CK to build, test, and refine behavioral-based analytic detection capabilities. (June 2017) -
ATT&CKing the Status Quo Presentation
- The latter part of this presentation provides an introduction to using ATT&CK to create analytics. Slides are also available. (August 2018)", - fa_icon=None, invert_icon=True, buttons=None, header_background=True,footer_description="View more resources about Detections and Analytics")}} - {{contact_card.render("Threat Intelligence ", "", "ATT&CK gives analysts a common language to structure, compare, and analyze threat intelligence. -
Getting Started with ATT&CK: Threat Intelligence Blog Post
- This blog post describes how you can get started using ATT&CK for detection and analytics at three different levels of sophistication. (June 2019) -
ATT&CKing Your Adversaries Presentation
- This presentation covers how to use ATT&CK to take cyber threat intelligence and operationalize it into behaviors that can drive relevant detections. (August 2019) -
Blog posts on threat intelligence
- These blog posts explain the fundamentals of how to use ATT&CK for threat intelligence. (September 2018)", - fa_icon=None, invert_icon=True, buttons=None, header_background=True,footer_description="View more resources about Threat Intelligence")}} -
-
Getting Started with ATT&CK: Adversary Emulation and Red Teaming Blog Post
- This blog post describes how you can get started using ATT&CK for adversary emulation and red teaming at three different levels of sophistication. (July 2019) -
Do-It-Yourself ATT&CK Evaluations to Improve Your Security Posture Presentation
- This presentation explains how defenders can improve their security posture through the use of adversary emulation by performing their very own ATT&CK Evaluations. (June 2019) -
APT ATT&CK - Threat-based Purple Teaming with ATT&CK Continued Presentation
- This presentation covers how to use ATT&CK to take cyber threat intelligence and operationalize it into behaviors that can drive relevant detections. (May 2019)", - fa_icon=None, invert_icon=True, buttons=None, header_background=True,footer_description="View more resources about Adversary Emulation and Red Teaming")}} - {{contact_card.render("Assessment and Engineering", "", "ATT&CK can be used to assess your organization’s capabilities and drive engineering decisions like what tools or logging you should implement. -
Getting Started with ATT&CK: Assessments and Engineering Blog Post
- This blog post describes how you can get started using ATT&CK for assessments and engineering at three different levels of sophistication. (August 2019) -
Lessons Learned Applying ATT&CK-Based SOC Assessments
- This keynote presentation discusses a process to gauge a SOC’s detective capabilities as they relate to ATT&CK, including MITRE’s practical experiences and lessons learned. (June 2019) -
Finding Cyber Threats with ATT&CK-Based Analytics
- Presents a methodology for using ATT&CK to build, test, and refine behavioral-based analytic detection capabilities. (June 2017)", - fa_icon=None, invert_icon=True, buttons=None, header_background=True,footer_description="View more resources about Assessment and Engineering")}} -
-
- Learn more about the Use Cases through the Sp4rkcon Presentation: Putting MITRE ATT&CK into Action with What You Have, Where You Are and the Getting Started with ATT&CK eBook.
-
- For additional ATT&CK topics and to explore presentations and training:
-
-
-
-
-
-
-
How should I not use ATT&CK?
- ATT&CK is just as much about the mindset and process of using it as much as it is the knowledge base itself. When it comes to information security, the threats we face, new technologies, and the adaptability of goal-based adversaries, we cannot consider filling out a checklist as “done”. - -- -
ATT&CK Navigator
- Use it to visualize defensive coverage, red/blue team planning, the frequency of detected techniques, and more. For more information on how to use Navigator, ATT&CK Navigator Use Case for Threat Intelligence. --
- - - -
-
-
-
Community
- - Stay informed on the latest updates and engage with the ATT&CK Community through Medium, Slack, and Twitter. --
- - - -
+
How can I use ATT&CK?
+ The following four use cases are the most common way that users report applying ATT&CK to their work. + +Getting + Started with ATT&CK: Detection and Analytics Blog Post
+ This blog post describes how you can get started using ATT&CK for detection and analytics at three + different levels of sophistication. (June 2019) +
Finding + Cyber Threats with ATT&CK-Based Analytics
+ Presents a methodology for using ATT&CK to build, test, and refine behavioral-based analytic detection + capabilities. (June 2017) +
ATT&CKing the Status Quo Presentation +
+ The latter part of this presentation provides an introduction to using ATT&CK to create analytics. Slides + are also available. (August 2018)", + fa_icon=None, invert_icon=True, buttons=None, header_background=True,footer_description="View more resources about Detections and + Analytics")}} + {{contact_card.render("Threat Intelligence ", "", "ATT&CK gives analysts a common language to + structure, compare, and analyze threat intelligence. +
Getting + Started with ATT&CK: Threat Intelligence Blog Post
+ This blog post describes how you can get started using ATT&CK for detection and analytics at three + different levels of sophistication. (June 2019) +
ATT&CKing + Your Adversaries Presentation
+ This presentation covers how to use ATT&CK to take cyber threat intelligence and operationalize it into + behaviors that can drive relevant detections. (August 2019) +
Blog + posts on threat intelligence
+ These blog posts explain the fundamentals of how to use ATT&CK for threat intelligence. (September 2018)", + fa_icon=None, invert_icon=True, buttons=None, header_background=True,footer_description="View more resources about Threat + Intelligence")}} +
+
Getting + Started with ATT&CK: Adversary Emulation and Red Teaming Blog Post
+ This blog post describes how you can get started using ATT&CK for adversary emulation and red teaming at + three different levels of sophistication. (July 2019) +
Do-It-Yourself + ATT&CK Evaluations to Improve Your Security Posture Presentation
+ This presentation explains how defenders can improve their security posture through the use of adversary + emulation by performing their very own ATT&CK Evaluations. (June 2019) +
APT + ATT&CK - Threat-based Purple Teaming with ATT&CK Continued Presentation
+ This presentation covers how to use ATT&CK to take cyber threat intelligence and operationalize it into + behaviors that can drive relevant detections. (May 2019)", + fa_icon=None, invert_icon=True, buttons=None, header_background=True,footer_description="View more resources about Adversary + Emulation and Red Teaming")}} + {{contact_card.render("Assessment and Engineering", "", "ATT&CK can be used to assess your + organization’s capabilities and drive engineering decisions like what tools or logging you should + implement. +
Getting + Started with ATT&CK: Assessments and Engineering Blog Post
+ This blog post describes how you can get started using ATT&CK for assessments and engineering at three + different levels of sophistication. (August 2019) +
Lessons Learned Applying ATT&CK-Based + SOC Assessments
+ This keynote presentation discusses a process to gauge a SOC’s detective capabilities as they relate to + ATT&CK, including MITRE’s practical experiences and lessons learned. (June 2019) +
Finding + Cyber Threats with ATT&CK-Based Analytics
+ Presents a methodology for using ATT&CK to build, test, and refine behavioral-based analytic detection + capabilities. (June 2017)", + fa_icon=None, invert_icon=True, buttons=None, header_background=True,footer_description="View more resources about Assessment and + Engineering")}} +
+
+ Learn more about the Use Cases through the Sp4rkcon
+ Presentation: Putting MITRE ATT&CK into Action with What You Have, Where You Are and the Getting
+ Started with ATT&CK eBook.
+
+ For additional ATT&CK topics and to explore presentations and training:
+
+
+
+
+
+
+
How should I not use ATT&CK?
+ ATT&CK is just as much about the mindset and process of using it as much as it is the knowledge base + itself. When it comes to information security, the threats we face, new technologies, and the adaptability + of goal-based adversaries, we cannot consider filling out a checklist as “done”. + ++ +
ATT&CK Navigator
+ Use it to visualize defensive coverage, red/blue team planning, the frequency of detected techniques, and + more. For more information on how to use Navigator, ATT&CK Navigator Use Case for Threat + Intelligence. ++
+ + + +
+
+
+
Community
+ + Stay informed on the latest updates and engage with the ATT&CK Community through Medium, Slack, and + Twitter. ++
+ + + +
Modules
Modules
Modules
CTI Training
The training contains five modules that consist of videos and exercises that are linked below. This training was designed to be completed in approximately 4 hours, and may be completed solo or as a team. - We recommend you view the video for each module, and when prompted, pause the video to access the exercise documents linked below and complete the exercises, then proceed with viewing the video to go over the exercise. - A copy of all slides from the training are here. + We recommend you view the video for each module, and when prompted, pause the video to access the exercise + documents linked below and complete the exercises, then proceed with viewing the video to go over the + exercise. + A copy of all slides from the training are here.
- Note:This training assumes an existing knowledge of ATT&CK and its primary concepts. We recommend reviewing the content from our ATT&CK Fundamentals Training before taking this training. + Note:This training assumes an existing knowledge of ATT&CK + and its primary concepts. We recommend reviewing the content from our ATT&CK + Fundamentals Training before taking this training.
- Note: The exercises in this training are based on a previous version of ATT&CK. We suggest using ATT&CK v8 and ATT&CK Navigator with ATT&CK v8 if you want exercise results to exactly match the training. + Note: The exercises in this training are based on a + previous version of ATT&CK. We suggest using ATT&CK + v8 and ATT&CK + Navigator with ATT&CK v8 if you want exercise results to exactly match the training.
Modules
@@ -109,7 +119,9 @@Modules
-
- Note: This exercise is based on a previous version of ATT&CK. We recommend using {{ exercise.software.version }} if you want to match the training. + Note: This exercise is based on a previous + version of ATT&CK. We recommend using {{ + exercise.software.version }} if you want to match the training.
Modules
Modules
Modules
Modules
ATT&CK Training
--
-
- - ATT&CK Cyber Threat Intelligence: This training by the ATT&CK team will help you learn how to apply ATT&CK and improve your threat intelligence practices. - -
- - Purple Teaming Fundamentals - -
- - ATT&CK Fundamentals - -
- - ATT&CK Adversary Emulation - -
- - ATT&CK Access Tokens Technical Primer - -
- - ATT&CK Based SOC Assessments - -
- - TTP-Based Threat Hunting and Detection Engineering - -
- - ATT&CK Detection Engineering - -
ATT&CK Training
+-
+
- + ATT&CK Cyber Threat Intelligence: This training + by the ATT&CK team will help you learn how to apply ATT&CK and improve your threat intelligence practices. + +
- + Purple Teaming Fundamentals + +
- + ATT&CK Fundamentals + +
- + ATT&CK Adversary Emulation + +
- + ATT&CK Access Tokens Technical Primer + +
- + ATT&CK Based SOC Assessments + +
- + TTP-Based Threat Hunting and Detection + Engineering + +
- + ATT&CK Detection Engineering + +
{{ article.title }}
- {{ article.content }} -{{ article.title }}
+ {{ article.content }} +{{ (articles|selectattr('template', 'equalto', 'resources/update-post')|first).title }}
- {{ (articles|selectattr('template', 'equalto', 'resources/update-post')|first).content }} -{{ (articles|selectattr('template', 'equalto', 'resources/update-post')|first).title + }}
+ {{ (articles|selectattr('template', 'equalto', 'resources/update-post')|first).content }} +{{parsed.title}}
- -- {% for res in parsed.resources %} - {{res.title}} -
- {{res.description}} {{res.date}} -
- {% endfor %} -
-
- Return to Get Started +
{{parsed.title}}
+ ++ {% for res in parsed.resources %} + {{res.title}} +
+ {{res.description}} {{res.date}} +
+ {% endfor %}
+
+ Return to Get Started +
Software
-- Software is a generic term for custom or commercial code, operating system utilities, open-source software, - or other tools used to conduct behavior modeled in ATT&CK. - Some instances of software have multiple names associated with the same instance due to various organizations - tracking the same set of software by different names. - The team makes a best effort to track overlaps between names based on publicly reported associations, which are designated as - “Associated Software” on each page (formerly labeled “Aliases”), because we believe these overlaps are useful for analyst awareness. -
-- Software entries include publicly reported technique use or capability to use a technique and may be mapped - to Groups who have been reported to use that Software. - The information provided does not represent all possible technique use by a piece of Software, but rather - a subset that is available solely through open source reporting. -
--
-
- Tool - Commercial, open-source, built-in, or publicly available software that could be used by a defender, pen tester, red teamer, or an adversary. This category includes both software that generally is not found on an enterprise system as well as software generally available as part of an operating system that is already present in an environment. Examples include PsExec, Metasploit, Mimikatz, as well as Windows utilities such as Net, netstat, Tasklist, etc. -
- Malware - Commercial, custom closed source, or open source software intended to be used for malicious purposes by adversaries. Examples include PlugX, CHOPSTICK, etc. -
Software
++ Software is a generic term for custom or commercial code, operating system utilities, open-source software, + or other tools used to conduct behavior modeled in ATT&CK. + Some instances of software have multiple names associated with the same instance due to various + organizations + tracking the same set of software by different names. + The team makes a best effort to track overlaps between names based on publicly reported associations, which + are designated as + “Associated Software” on each page (formerly labeled “Aliases”), because we believe these overlaps are + useful for analyst awareness. +
++ Software entries include publicly reported technique use or capability to use a technique and may be mapped + to Groups who have been reported to use that Software. + The information provided does not represent all possible technique use by a piece of Software, but rather + a subset that is available solely through open source reporting. +
+-
+
- Tool - Commercial, open-source, built-in, or publicly available software that could be used + by a defender, pen tester, red teamer, or an adversary. This category includes both software that + generally is not found on an enterprise system as well as software generally available as part of an + operating system that is already present in an environment. Examples include PsExec, Metasploit, Mimikatz, + as well as Windows utilities such as Net, netstat, Tasklist, etc. +
- Malware - Commercial, custom closed source, or open source software intended to be used for + malicious purposes by adversaries. Examples include PlugX, CHOPSTICK, etc. +
Software: {{ parsed.software_list_len }}
-| ID | -Name | -Associated Software | -Description | -
|---|---|---|---|
| - {{row.id|upper}} - | -- {{row.name}} - | -- {{row.aliases_list|join(", ")}} - | -- {% if row.deprecated %} - ****Deprecation Warning**** - {% endif %} - {{clean_output.stixToHTML(row.descr)}} - | -
Software: {{ parsed.software_list_len }}
+| ID | +Name | +Associated Software | +Description | +
|---|---|---|---|
| + {{row.id|upper}} + | ++ {{row.name}} + | ++ {{row.aliases_list|join(", ")}} + | ++ {% if row.deprecated %} + ****Deprecation Warning**** + {% endif %} + {{clean_output.stixToHTML(row.descr)}} + | +
- {{parsed.name}} -
+{{ super () }} + ++ {{parsed.name}} +
- {% if parsed.deprecated %} - {% if parsed.descr %} - {{deprecated.deprecated(clean_output.stixToHTML(parsed.descr, firstParagraphOnly=True))}} - {% else %} - {{deprecated.deprecated("This software has been deprecated.")}} - {% endif %} - {% else %} -Associated Software Descriptions
-| Name | -Description | -
|---|---|
| - {{alias.name}} - | -- {{clean_output.stixToHTML(alias.descr, parsed.citations)}} - | -
Associated Software Descriptions
+| Name | +Description | +
|---|---|
| + {{alias.name}} + | ++ {{clean_output.stixToHTML(alias.descr, parsed.citations)}} + | +
Groups That Use This Software
-| ID | -Name | -References | -
|---|---|---|
| - {{group.id}} - | -- {{group.name}} - | -- {{clean_output.stixToHTML(group.descr, parsed.citations)}} - | -
Groups That Use This Software
+| ID | +Name | +References | +
|---|---|---|
| + {{group.id}} + | ++ {{group.name}} + | ++ {{clean_output.stixToHTML(group.descr, parsed.citations)}} + | +
Campaigns
-| ID | -Name | -Description | -
|---|---|---|
| - {{campaign.id}} - | -- {{campaign.name}} - | -- {% if campaign.desc %} - {{clean_output.stixToHTML(campaign.desc, parsed.citations)}} - {% endif %} - | -
Campaigns
+| ID | +Name | +Description | +
|---|---|---|
| + {{campaign.id}} + | ++ {{campaign.name}} + | ++ {% if campaign.desc %} + {{clean_output.stixToHTML(campaign.desc, parsed.citations)}} + {% endif %} + | +