@blamejs/exceptd-skills 0.12.26 → 0.12.28

package/data/_indexes/xref.json

@@ -45,6 +45,7 @@
       "webapp-security"
     ],
     "CWE-345": [
+      "idp-incident-response",
       "mcp-agent-trust"
     ],
     "CWE-352": [
@@ -96,12 +97,15 @@
     ],
     "CWE-269": [
       "attack-surface-pentest",
+      "cloud-iam-incident",
       "container-runtime-security",
       "identity-assurance",
+      "idp-incident-response",
       "webapp-security"
     ],
     "CWE-732": [
       "attack-surface-pentest",
+      "cloud-iam-incident",
       "cloud-security",
       "container-runtime-security",
       "identity-assurance",
@@ -149,9 +153,12 @@
     "CWE-287": [
       "age-gates-child-safety",
       "api-security",
+      "cloud-iam-incident",
       "cloud-security",
       "identity-assurance",
+      "idp-incident-response",
       "ot-ics-security",
+      "ransomware-response",
       "sector-energy",
       "sector-financial",
       "sector-healthcare",
@@ -165,9 +172,11 @@
       "sector-telecom"
     ],
     "CWE-798": [
+      "cloud-iam-incident",
       "cloud-security",
       "identity-assurance",
       "ot-ics-security",
+      "ransomware-response",
       "sector-energy",
       "sector-financial"
     ],
@@ -182,13 +191,22 @@
     ],
     "CWE-863": [
       "api-security",
+      "cloud-iam-incident",
       "identity-assurance",
+      "idp-incident-response",
       "sector-financial",
       "webapp-security"
     ],
     "CWE-1037": [
       "ot-ics-security",
       "sector-energy"
+    ],
+    "CWE-522": [
+      "cloud-iam-incident",
+      "idp-incident-response"
+    ],
+    "CWE-284": [
+      "idp-incident-response"
     ]
   },
   "d3fend_refs": {
@@ -217,23 +235,31 @@
     "D3-IOPR": [
       "ai-attack-surface",
       "ai-c2-detection",
+      "cloud-iam-incident",
       "defensive-countermeasure-mapping",
       "dlp-gap-analysis",
       "fuzz-testing-strategy",
+      "idp-incident-response",
       "rag-pipeline-security",
+      "ransomware-response",
       "sector-telecom"
     ],
     "D3-NTA": [
       "ai-attack-surface",
       "ai-c2-detection",
       "attack-surface-pentest",
+      "cloud-iam-incident",
       "defensive-countermeasure-mapping",
       "dlp-gap-analysis",
+      "idp-incident-response",
       "rag-pipeline-security",
+      "ransomware-response",
       "sector-telecom"
     ],
     "D3-CBAN": [
+      "cloud-iam-incident",
       "defensive-countermeasure-mapping",
+      "idp-incident-response",
       "mcp-agent-trust",
       "supply-chain-integrity"
     ],
@@ -243,7 +269,8 @@
       "defensive-countermeasure-mapping",
       "dlp-gap-analysis",
       "mcp-agent-trust",
-      "rag-pipeline-security"
+      "rag-pipeline-security",
+      "ransomware-response"
     ],
     "D3-EHB": [
       "defensive-countermeasure-mapping",
@@ -251,7 +278,9 @@
       "supply-chain-integrity"
     ],
     "D3-MFA": [
+      "cloud-iam-incident",
       "defensive-countermeasure-mapping",
+      "idp-incident-response",
       "mcp-agent-trust"
     ],
     "D3-CA": [
@@ -288,10 +317,14 @@
       "defensive-countermeasure-mapping"
     ],
     "D3-RPA": [
-      "defensive-countermeasure-mapping"
+      "defensive-countermeasure-mapping",
+      "ransomware-response"
     ],
     "D3-SCP": [
       "defensive-countermeasure-mapping"
+    ],
+    "D3-CAA": [
+      "cloud-iam-incident"
     ]
   },
   "framework_gaps": {
@@ -545,6 +578,72 @@
     ],
     "ITU-T-X.805": [
       "sector-telecom"
+    ],
+    "OFAC-SDN-Payment-Block": [
+      "ransomware-response"
+    ],
+    "Insurance-Carrier-24h-Notification": [
+      "ransomware-response"
+    ],
+    "EU-Sanctions-Reg-2014-833-Cyber": [
+      "ransomware-response"
+    ],
+    "Immutable-Backup-Recovery": [
+      "ransomware-response"
+    ],
+    "Decryptor-Availability-Pre-Decision": [
+      "ransomware-response"
+    ],
+    "PHI-Exfil-Before-Encrypt-Breach-Class": [
+      "ransomware-response"
+    ],
+    "FedRAMP-IL5-IAM-Federated": [
+      "cloud-iam-incident"
+    ],
+    "CISA-Snowflake-AA24-IdP-Cloud": [
+      "cloud-iam-incident"
+    ],
+    "NIST-800-53-AC-2-Cross-Account": [
+      "cloud-iam-incident"
+    ],
+    "ISO-27017-Cloud-IAM": [
+      "cloud-iam-incident"
+    ],
+    "SOC2-CC6-Access-Key-Leak-Public-Repo": [
+      "cloud-iam-incident"
+    ],
+    "AWS-Security-Hub-Coverage-Gap": [
+      "cloud-iam-incident"
+    ],
+    "UK-CAF-B2-Cloud-IAM": [
+      "cloud-iam-incident"
+    ],
+    "AU-ISM-1546-Cloud-Service-Account": [
+      "cloud-iam-incident"
+    ],
+    "NIST-800-53-IA-5-Federated": [
+      "idp-incident-response"
+    ],
+    "ISO-27001-2022-A.5.16-Federated": [
+      "idp-incident-response"
+    ],
+    "SOC2-CC6-OAuth-Consent": [
+      "idp-incident-response"
+    ],
+    "UK-CAF-B2-IdP-Tenant": [
+      "idp-incident-response"
+    ],
+    "AU-ISM-1559-IdP": [
+      "idp-incident-response"
+    ],
+    "NIS2-Art-21-Federated-Identity": [
+      "idp-incident-response"
+    ],
+    "DORA-Art-19-IdP-4h": [
+      "idp-incident-response"
+    ],
+    "OFAC-Sanctions-Threat-Actor-Negotiation": [
+      "idp-incident-response"
     ]
   },
   "atlas_refs": {
@@ -559,6 +658,7 @@
       "ai-attack-surface",
       "ai-risk-management",
       "attack-surface-pentest",
+      "cloud-iam-incident",
       "dlp-gap-analysis",
       "identity-assurance",
       "incident-response-playbook",
@@ -636,6 +736,7 @@
       "ai-attack-surface",
       "attack-surface-pentest",
       "mcp-agent-trust",
+      "ransomware-response",
       "webapp-security"
     ],
     "T1190": [
@@ -680,10 +781,12 @@
       "age-gates-child-safety",
       "api-security",
       "attack-surface-pentest",
+      "cloud-iam-incident",
       "cloud-security",
       "email-security-anti-phishing",
       "identity-assurance",
       "incident-response-playbook",
+      "ransomware-response",
       "sector-energy",
       "sector-financial",
       "sector-healthcare",
@@ -694,6 +797,7 @@
       "api-security",
       "dlp-gap-analysis",
       "incident-response-playbook",
+      "ransomware-response",
       "sector-financial",
       "sector-healthcare"
     ],
@@ -736,12 +840,14 @@
     ],
     "T1486": [
       "incident-response-playbook",
+      "ransomware-response",
       "sector-financial"
     ],
     "T1098": [
       "sector-telecom"
     ],
     "T1199": [
+      "idp-incident-response",
       "sector-telecom"
     ],
     "T1552": [
@@ -761,6 +867,29 @@
     ],
     "T1566.003": [
       "email-security-anti-phishing"
+    ],
+    "T1078.004": [
+      "cloud-iam-incident",
+      "idp-incident-response"
+    ],
+    "T1098.001": [
+      "cloud-iam-incident",
+      "idp-incident-response"
+    ],
+    "T1552.005": [
+      "cloud-iam-incident"
+    ],
+    "T1580": [
+      "cloud-iam-incident"
+    ],
+    "T1538": [
+      "cloud-iam-incident"
+    ],
+    "T1556.007": [
+      "idp-incident-response"
+    ],
+    "T1606.002": [
+      "idp-incident-response"
     ]
   },
   "rfc_refs": {
@@ -780,8 +909,10 @@
     ],
     "RFC-7519": [
       "api-security",
+      "cloud-iam-incident",
       "cloud-security",
       "identity-assurance",
+      "idp-incident-response",
       "mcp-agent-trust",
       "sector-financial",
       "sector-healthcare",
@@ -801,8 +932,10 @@
     ],
     "RFC-8725": [
       "api-security",
+      "cloud-iam-incident",
       "cloud-security",
       "identity-assurance",
+      "idp-incident-response",
       "mcp-agent-trust",
       "sector-financial",
       "webapp-security"
@@ -816,6 +949,7 @@
     "RFC-9421": [
       "ai-c2-detection",
       "api-security",
+      "idp-incident-response",
       "mcp-agent-trust",
       "sector-financial",
       "sector-healthcare"
@@ -862,6 +996,15 @@
     ],
     "RFC-9622": [
       "sector-telecom"
+    ],
+    "RFC-8693": [
+      "cloud-iam-incident"
+    ],
+    "RFC-9068": [
+      "cloud-iam-incident"
+    ],
+    "RFC-7591": [
+      "idp-incident-response"
     ]
   },
   "dlp_refs": {}

package/data/attack-techniques.json

@@ -64,7 +64,9 @@
     "tactic": "Stealth",
     "tactic_moved_from": "Defense Evasion",
     "tactic_id": "TA0005",
-    "detection_strategies": ["DS0009"]
+    "detection_strategies": [
+      "DS0009"
+    ]
   },
   "T1040": {
     "name": "Network Sniffing",
@@ -86,7 +88,10 @@
     "name": "Command and Scripting Interpreter",
     "version": "v19",
     "tactic": "Execution",
-    "detection_strategies": ["DS0009", "DS0017"]
+    "detection_strategies": [
+      "DS0009",
+      "DS0017"
+    ]
   },
   "T1059.001": {
     "name": "Command and Scripting Interpreter: PowerShell",
@@ -132,6 +137,15 @@
     "name": "Account Manipulation",
     "version": "v19"
   },
+  "T1098.001": {
+    "name": "Account Manipulation: Additional Cloud Credentials",
+    "version": "v19",
+    "tactic": "Persistence",
+    "detection_strategies": [
+      "DS0002",
+      "DS0028"
+    ]
+  },
   "T1102": {
     "name": "Web Service",
     "version": "v19"
@@ -192,7 +206,10 @@
     "name": "Data Encrypted for Impact",
     "version": "v19",
     "tactic": "Impact",
-    "detection_strategies": ["DS0007", "DS0011"]
+    "detection_strategies": [
+      "DS0007",
+      "DS0011"
+    ]
   },
   "T1505": {
     "name": "Server Software Component",
@@ -266,7 +283,9 @@
     "name": "Modify Authentication Process",
     "version": "v19",
     "tactic": "Credential Access",
-    "detection_strategies": ["DS0002"]
+    "detection_strategies": [
+      "DS0002"
+    ]
   },
   "T1557": {
     "name": "Adversary-in-the-Middle",
@@ -278,7 +297,10 @@
     "tactic": "Defense Impairment",
     "tactic_moved_from": "Defense Evasion",
     "tactic_id": "TA0112",
-    "detection_strategies": ["DS0017", "DS0022"]
+    "detection_strategies": [
+      "DS0017",
+      "DS0022"
+    ]
   },
   "T1562.006": {
     "name": "Impair Defenses: Indicator Blocking",
@@ -286,7 +308,9 @@
     "tactic": "Defense Impairment",
     "tactic_moved_from": "Defense Evasion",
     "tactic_id": "TA0112",
-    "detection_strategies": ["DS0017"]
+    "detection_strategies": [
+      "DS0017"
+    ]
   },
   "T1565": {
     "name": "Data Manipulation",
@@ -345,6 +369,15 @@
     "name": "Forge Web Credentials: Web Cookies",
     "version": "v19"
   },
+  "T1606.002": {
+    "name": "Forge Web Credentials: SAML Tokens",
+    "version": "v19",
+    "tactic": "Credential Access",
+    "detection_strategies": [
+      "DS0002",
+      "DS0026"
+    ]
+  },
   "T1610": {
     "name": "Deploy Container",
     "version": "v19"
@@ -353,7 +386,10 @@
     "name": "Escape to Host",
     "version": "v19",
     "tactic": "Privilege Escalation",
-    "detection_strategies": ["DS0009", "DS0029"]
+    "detection_strategies": [
+      "DS0009",
+      "DS0029"
+    ]
   },
   "T1613": {
     "name": "Container and Resource Discovery",
@@ -365,7 +401,9 @@
     "tactic": "Stealth",
     "tactic_id": "TA0005",
     "added_in": "v19",
-    "detection_strategies": ["DS0009"]
+    "detection_strategies": [
+      "DS0009"
+    ]
   },
   "T1480.003": {
     "name": "Execution Guardrails: Mutex Lock",
@@ -373,42 +411,58 @@
     "tactic": "Stealth",
     "tactic_id": "TA0005",
     "added_in": "v19",
-    "detection_strategies": ["DS0009"]
+    "detection_strategies": [
+      "DS0009"
+    ]
   },
   "T1059.013": {
     "name": "Command and Scripting Interpreter: Cloud API",
     "version": "v19",
     "tactic": "Execution",
     "added_in": "v18",
-    "detection_strategies": ["DS0017", "DS0025"]
+    "detection_strategies": [
+      "DS0017",
+      "DS0025"
+    ]
   },
   "T1556.007": {
     "name": "Modify Authentication Process: Hybrid Identity",
     "version": "v19",
     "tactic": "Credential Access",
     "added_in": "v18",
-    "detection_strategies": ["DS0002", "DS0028"]
+    "detection_strategies": [
+      "DS0002",
+      "DS0028"
+    ]
   },
   "T1486.004": {
     "name": "Data Encrypted for Impact: Data Theft Before Encryption",
     "version": "v19",
     "tactic": "Impact",
     "added_in": "v19",
-    "detection_strategies": ["DS0007", "DS0011", "DS0029"]
+    "detection_strategies": [
+      "DS0007",
+      "DS0011",
+      "DS0029"
+    ]
   },
   "T1682": {
     "name": "Query Public AI Services",
     "version": "v19",
     "tactic": "Reconnaissance",
     "added_in": "v19",
-    "detection_strategies": ["DS0029"]
+    "detection_strategies": [
+      "DS0029"
+    ]
   },
   "T1683": {
     "name": "Generate Content",
     "version": "v19",
     "tactic": "Resource Development",
     "added_in": "v19",
-    "detection_strategies": ["DS0029"]
+    "detection_strategies": [
+      "DS0029"
+    ]
   },
   "T1685": {
     "name": "Disable or Modify Tools",
@@ -416,7 +470,10 @@
     "tactic": "Defense Impairment",
     "tactic_id": "TA0112",
     "added_in": "v19",
-    "detection_strategies": ["DS0017", "DS0022"]
+    "detection_strategies": [
+      "DS0017",
+      "DS0022"
+    ]
   },
   "T1686": {
     "name": "Disable or Modify System Firewall",
@@ -424,7 +481,9 @@
     "tactic": "Defense Impairment",
     "tactic_id": "TA0112",
     "added_in": "v19",
-    "detection_strategies": ["DS0017"]
+    "detection_strategies": [
+      "DS0017"
+    ]
   },
   "T1687": {
     "name": "Exploitation for Defense Impairment",
@@ -432,7 +491,9 @@
     "tactic": "Defense Impairment",
     "tactic_id": "TA0112",
     "added_in": "v19",
-    "detection_strategies": ["DS0009"]
+    "detection_strategies": [
+      "DS0009"
+    ]
   },
   "T1689": {
     "name": "Downgrade Attack",
@@ -440,7 +501,9 @@
     "tactic": "Defense Impairment",
     "tactic_id": "TA0112",
     "added_in": "v19",
-    "detection_strategies": ["DS0029"]
+    "detection_strategies": [
+      "DS0029"
+    ]
   },
   "T1690": {
     "name": "Prevent Command History Logging",
@@ -448,6 +511,28 @@
     "tactic": "Defense Impairment",
     "tactic_id": "TA0112",
     "added_in": "v19",
-    "detection_strategies": ["DS0017"]
+    "detection_strategies": [
+      "DS0017"
+    ]
+  },
+  "T1580": {
+    "name": "Cloud Infrastructure Discovery",
+    "version": "v19"
+  },
+  "T1538": {
+    "name": "Cloud Service Dashboard",
+    "version": "v19"
+  },
+  "T1562.008": {
+    "name": "Impair Defenses: Disable or Modify Cloud Logs",
+    "version": "v19"
+  },
+  "T1136.003": {
+    "name": "Create Account: Cloud Account",
+    "version": "v19"
+  },
+  "T1098.003": {
+    "name": "Account Manipulation: Additional Cloud Roles",
+    "version": "v19"
   }
 }