@blamejs/exceptd-skills 0.18.19 → 0.18.21

package/data/atlas-ttps.json

@@ -1,14 +1,14 @@
 {
   "_meta": {
     "schema_version": "1.0.0",
-    "atlas_version": "2026.05",
-    "atlas_release_date": "2026-05-27",
+    "atlas_version": "2026.06",
+    "atlas_release_date": "2026-06-30",
     "secure_ai_v2_release_date": "2026-05-06",
     "secure_ai_v2_source": "https://ctid.mitre.org/blog/2026/05/06/secure-ai-v2-release",
-    "last_updated": "2026-06-10",
-    "last_threat_review": "2026-06-10",
+    "last_updated": "2026-07-03",
+    "last_threat_review": "2026-07-03",
     "source": "https://atlas.mitre.org",
-    "note": "AI-relevant ATLAS v2026.05 TTPs with framework_gap field. ATLAS content now follows a YYYY.MM calendar-versioning scheme; v2026.05 adds platform tags (Predictive AI, Generative AI, Agentic AI, Enterprise) to every technique, with no technique-ID removals or renames. framework_gap: no framework has a control that addresses this TTP. secure_ai_v2_layer flags entries included in the CTID Secure AI v2 layered set (May 2026); maturity reflects CTID's technique-maturity classification (low / moderate / high).",
+    "note": "AI-relevant ATLAS TTPs with framework_gap field, curated as a subset of the full ATLAS matrix and pinned to v2026.06. ATLAS content follows a YYYY.MM calendar-versioning scheme; the CalVer scheme and the per-technique platform tags (Predictive AI, Generative AI, Agentic AI, Enterprise) were introduced in v2026.05. The v2026.05 → v2026.06 audit (AGENTS.md Hard Rule #12) confirmed the release is additive with NO technique-ID removals or renames, so every AML.T* id curated in this file remains valid. Upstream v2026.06 additionally published three new techniques — AML.T0113 (Steal Web Session Cookie), AML.T0091.001 (Use Alternate Authentication Material: Web Session Cookie), and AML.T0114 (AI Service Web Interface) — refreshed AML.T0054 (LLM Jailbreak), and shipped new case studies (EchoLeak zero-click prompt injection, AI-in-the-Middle C2 relays, Semantic Kernel RCE); these newly-published techniques are not yet ingested into this curated subset and are tracked as future-curation candidates (the subset intentionally trails the full matrix, e.g. 170 curated of the full ATLAS technique set). framework_gap: no framework has a control that addresses this TTP. secure_ai_v2_layer flags entries included in the CTID Secure AI v2 layered set (May 2026); maturity reflects CTID's technique-maturity classification (low / moderate / high).",
     "tlp": "CLEAR",
     "source_confidence": {
       "scheme": "Admiralty (A-F + 1-6)",
@@ -21,7 +21,7 @@
       "rebuild_after_days": 365,
       "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
     },
-    "bulk_intake_note": " v0.13.18: +137 AML.* techniques from MITRE ATLAS STIX bundle (atlas-navigator-data dist/stix-atlas.json). Now tracking ATLAS v2026.05 (May 2026 release). Auto-imported entries flagged _auto_imported:true + _intake_method:v0.13.18-bulk-mitre-atlas-stix for downstream curation."
+    "bulk_intake_note": " v0.13.18: +137 AML.* techniques from MITRE ATLAS STIX bundle (atlas-navigator-data dist/stix-atlas.json). Now tracking ATLAS v2026.06 (June 2026 release). Auto-imported entries flagged _auto_imported:true + _intake_method:v0.13.18-bulk-mitre-atlas-stix for downstream curation."
   },
   "AML.T0001": {
     "id": "AML.T0001",
@@ -536,7 +536,7 @@
       "Multiple production AI assistant prompt injection incidents 2025-2026"
     ],
     "framework_gap": true,
-    "framework_gap_detail": "No framework has a control for prompt injection as an access control failure vector. The attack uses the AI service account's authorized permissions — from AC-2's perspective, the access is authorized. MITRE ATLAS v2026.05 documents the technique; no framework has implemented controls. OWASP LLM Top 10 documents the class; it is not incorporated in any compliance framework.",
+    "framework_gap_detail": "No framework has a control for prompt injection as an access control failure vector. The attack uses the AI service account's authorized permissions — from AC-2's perspective, the access is authorized. MITRE ATLAS v2026.06 documents the technique; no framework has implemented controls. OWASP LLM Top 10 documents the class; it is not incorporated in any compliance framework.",
     "controls_that_partially_help": [
       "NIST-800-53-AC-2",
       "ISO-27001-2022-A.8.28"

package/data/attack-techniques.json

@@ -278,9 +278,15 @@
       "CVE-2014-6278",
       "CVE-2016-10033",
       "CVE-2017-1000353",
+      "CVE-2017-3066",
+      "CVE-2019-9874",
+      "CVE-2019-9875",
       "CVE-2020-25078",
       "CVE-2020-25079",
+      "CVE-2021-20035",
       "CVE-2022-1471",
+      "CVE-2022-43769",
+      "CVE-2023-20118",
       "CVE-2023-33538",
       "CVE-2023-39780",
       "CVE-2023-43654",
@@ -297,6 +303,7 @@
       "CVE-2024-12366",
       "CVE-2024-12987",
       "CVE-2024-13059",
+      "CVE-2024-20953",
       "CVE-2024-21513",
       "CVE-2024-21575",
       "CVE-2024-21576",
@@ -306,6 +313,7 @@
       "CVE-2024-37052",
       "CVE-2024-37060",
       "CVE-2024-42479",
+      "CVE-2024-4885",
       "CVE-2024-4889",
       "CVE-2024-50050",
       "CVE-2024-5565",
@@ -318,18 +326,22 @@
       "CVE-2025-1094",
       "CVE-2025-11837",
       "CVE-2025-11953",
+      "CVE-2025-1316",
       "CVE-2025-1550",
       "CVE-2025-1753",
       "CVE-2025-1976",
       "CVE-2025-20281",
       "CVE-2025-20337",
+      "CVE-2025-21590",
       "CVE-2025-23254",
       "CVE-2025-24016",
+      "CVE-2025-24813",
       "CVE-2025-24893",
       "CVE-2025-26399",
       "CVE-2025-27520",
       "CVE-2025-29635",
       "CVE-2025-30165",
+      "CVE-2025-30406",
       "CVE-2025-32432",
       "CVE-2025-32433",
       "CVE-2025-32434",
@@ -418,6 +430,7 @@
       "CVE-2026-40933",
       "CVE-2026-42271",
       "CVE-2026-45247",
+      "CVE-2026-45659",
       "CVE-2026-45829",
       "CVE-2026-48172",
       "CVE-2026-5760",
@@ -534,6 +547,7 @@
     "cve_refs": [
       "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
       "CVE-2018-14634",
+      "CVE-2018-8639",
       "CVE-2020-17103-REREGRESSION-2026",
       "CVE-2021-22555",
       "CVE-2021-30952",
@@ -544,6 +558,9 @@
       "CVE-2023-41974",
       "CVE-2023-43000",
       "CVE-2024-0769",
+      "CVE-2024-49035",
+      "CVE-2024-50302",
+      "CVE-2024-53197",
       "CVE-2024-8068",
       "CVE-2025-10725",
       "CVE-2025-1976",
@@ -552,8 +569,10 @@
       "CVE-2025-22224",
       "CVE-2025-22225",
       "CVE-2025-24201",
+      "CVE-2025-24983",
       "CVE-2025-24990",
       "CVE-2025-27038",
+      "CVE-2025-29824",
       "CVE-2025-30400",
       "CVE-2025-31277",
       "CVE-2025-32463",
@@ -641,19 +660,27 @@
       "CVE-2019-6693",
       "CVE-2020-10148",
       "CVE-2020-24363",
+      "CVE-2021-20035",
       "CVE-2021-32030",
+      "CVE-2022-43939",
       "CVE-2023-27351",
       "CVE-2023-43791",
       "CVE-2023-50224",
       "CVE-2023-52163",
       "CVE-2024-12776",
       "CVE-2024-1709",
+      "CVE-2024-20439",
       "CVE-2024-27199",
+      "CVE-2024-49035",
       "CVE-2024-54085",
       "CVE-2024-57726",
       "CVE-2025-12480",
       "CVE-2025-1796",
       "CVE-2025-21085",
+      "CVE-2025-21590",
+      "CVE-2025-24472",
+      "CVE-2025-24989",
+      "CVE-2025-25181",
       "CVE-2025-2746",
       "CVE-2025-2747",
       "CVE-2025-31161",
@@ -691,6 +718,7 @@
       "CVE-2026-41947",
       "CVE-2026-41950",
       "CVE-2026-42897",
+      "CVE-2026-48558",
       "CVE-2026-50751",
       "CVE-2026-6973",
       "MAL-2026-NODE-IPC-STEALER",
@@ -1009,17 +1037,22 @@
       "CVE-2016-10033",
       "CVE-2016-7836",
       "CVE-2017-1000353",
+      "CVE-2017-12637",
+      "CVE-2017-3066",
       "CVE-2017-7921",
       "CVE-2018-4063",
       "CVE-2019-19006",
       "CVE-2019-5418",
       "CVE-2019-6693",
       "CVE-2019-9621",
+      "CVE-2019-9874",
+      "CVE-2019-9875",
       "CVE-2020-10148",
       "CVE-2020-24363",
       "CVE-2020-25078",
       "CVE-2020-25079",
       "CVE-2020-7796",
+      "CVE-2021-20035",
       "CVE-2021-21311",
       "CVE-2021-22054",
       "CVE-2021-22175",
@@ -1034,6 +1067,9 @@
       "CVE-2022-36551",
       "CVE-2022-37055",
       "CVE-2022-40799",
+      "CVE-2022-43769",
+      "CVE-2022-43939",
+      "CVE-2023-20118",
       "CVE-2023-21529",
       "CVE-2023-2533",
       "CVE-2023-27351",
@@ -1066,6 +1102,8 @@
       "CVE-2024-1561",
       "CVE-2024-1708",
       "CVE-2024-1709",
+      "CVE-2024-20439",
+      "CVE-2024-20953",
       "CVE-2024-21182",
       "CVE-2024-21575",
       "CVE-2024-21576",
@@ -1082,12 +1120,15 @@
       "CVE-2024-42478",
       "CVE-2024-42479",
       "CVE-2024-43468",
+      "CVE-2024-48248",
+      "CVE-2024-4885",
       "CVE-2024-4889",
       "CVE-2024-50050",
       "CVE-2024-54085",
       "CVE-2024-56145",
       "CVE-2024-57726",
       "CVE-2024-57728",
+      "CVE-2024-57968",
       "CVE-2024-58136",
       "CVE-2024-6047",
       "CVE-2024-6587",
@@ -1095,6 +1136,7 @@
       "CVE-2024-7694",
       "CVE-2024-8068",
       "CVE-2024-8069",
+      "CVE-2025-0111",
       "CVE-2025-0282",
       "CVE-2025-10035",
       "CVE-2025-1094",
@@ -1102,6 +1144,7 @@
       "CVE-2025-11953",
       "CVE-2025-12480",
       "CVE-2025-12686",
+      "CVE-2025-1316",
       "CVE-2025-14611",
       "CVE-2025-14733",
       "CVE-2025-14847",
@@ -1114,7 +1157,11 @@
       "CVE-2025-20393",
       "CVE-2025-22457",
       "CVE-2025-24016",
+      "CVE-2025-24472",
+      "CVE-2025-24813",
       "CVE-2025-24893",
+      "CVE-2025-24989",
+      "CVE-2025-25181",
       "CVE-2025-25257",
       "CVE-2025-25297",
       "CVE-2025-26399",
@@ -1129,6 +1176,7 @@
       "CVE-2025-29635",
       "CVE-2025-30165",
       "CVE-2025-30202",
+      "CVE-2025-30406",
       "CVE-2025-31125",
       "CVE-2025-31161",
       "CVE-2025-31324",
@@ -1288,7 +1336,9 @@
       "CVE-2026-42897",
       "CVE-2026-42945",
       "CVE-2026-45247",
+      "CVE-2026-45659",
       "CVE-2026-45829",
+      "CVE-2026-48558",
       "CVE-2026-48907",
       "CVE-2026-50751",
       "CVE-2026-5760",
@@ -1441,6 +1491,9 @@
     "description": "Adversaries may breach or otherwise leverage organizations who have access to intended victims.",
     "tactic": [
       "Initial Access"
+    ],
+    "cve_refs": [
+      "CVE-2026-48558"
     ]
   },
   "T1203": {
@@ -1465,13 +1518,18 @@
       "CVE-2022-48503",
       "CVE-2023-41974",
       "CVE-2023-43000",
+      "CVE-2024-53150",
       "CVE-2025-10585",
       "CVE-2025-13223",
       "CVE-2025-14174",
       "CVE-2025-21042",
       "CVE-2025-21043",
       "CVE-2025-24201",
+      "CVE-2025-24983",
+      "CVE-2025-24985",
+      "CVE-2025-24993",
       "CVE-2025-27363",
+      "CVE-2025-2783",
       "CVE-2025-30397",
       "CVE-2025-30400",
       "CVE-2025-31200",
@@ -1522,6 +1580,7 @@
     "cve_refs": [
       "CVE-2023-43791",
       "CVE-2024-21182",
+      "CVE-2024-53197",
       "CVE-2025-14174",
       "CVE-2025-1796",
       "CVE-2025-69286"
@@ -1615,7 +1674,10 @@
     "stix_id": "attack-pattern--b80d107d-fa0d-4b60-9684-b0433e8bdba0",
     "is_subtechnique": false,
     "last_verified": "2026-05-19",
-    "description": "Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources."
+    "description": "Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.",
+    "cve_refs": [
+      "CVE-2025-29824"
+    ]
   },
   "T1505": {
     "name": "Server Software Component",
@@ -1877,6 +1939,7 @@
     "name": "Unsecured Credentials: Credentials In Files",
     "version": "v19",
     "cve_refs": [
+      "CVE-2024-48248",
       "CVE-2024-6587",
       "CVE-2025-21085",
       "CVE-2026-30615",
@@ -2024,7 +2087,8 @@
     "last_verified": "2026-05-19",
     "description": "Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts.",
     "cve_refs": [
-      "CVE-2024-12776"
+      "CVE-2024-12776",
+      "CVE-2025-24472"
     ]
   },
   "T1557": {
@@ -2050,6 +2114,9 @@
       "CVE-2011-0411",
       "CVE-2021-33515",
       "CVE-2021-38371",
+      "CVE-2024-13159",
+      "CVE-2024-13160",
+      "CVE-2024-13161",
       "CVE-2025-24054"
     ]
   },
@@ -2860,6 +2927,7 @@
     "name": "Drive-by Compromise",
     "version": "v19",
     "cve_refs": [
+      "CVE-2023-34192",
       "CVE-2023-6571",
       "CVE-2024-27132",
       "CVE-2025-10585",
@@ -2985,6 +3053,7 @@
     "name": "Steal Web Session Cookie",
     "version": "v19",
     "cve_refs": [
+      "CVE-2023-34192",
       "CVE-2023-6571",
       "CVE-2024-11182",
       "CVE-2024-42009",
@@ -3145,6 +3214,7 @@
     "cve_refs": [
       "CVE-2023-50387",
       "CVE-2023-50868",
+      "CVE-2025-1316",
       "CVE-2025-20352",
       "CVE-2025-30202",
       "CVE-2025-6543",
@@ -3205,7 +3275,10 @@
       "Windows"
     ],
     "stix_id": "attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22",
-    "is_subtechnique": false
+    "is_subtechnique": false,
+    "cve_refs": [
+      "CVE-2025-29824"
+    ]
   },
   "T1006": {
     "id": "T1006",
@@ -3225,7 +3298,12 @@
       "Windows"
     ],
     "stix_id": "attack-pattern--0c8ab3eb-df48-4b9c-ace7-beacaac81cc5",
-    "is_subtechnique": false
+    "is_subtechnique": false,
+    "cve_refs": [
+      "CVE-2024-53150",
+      "CVE-2025-24984",
+      "CVE-2025-24991"
+    ]
   },
   "T1007": {
     "id": "T1007",
@@ -3527,7 +3605,10 @@
       "Windows"
     ],
     "stix_id": "attack-pattern--42e8de7b-37b2-4258-905a-6897815e58e0",
-    "is_subtechnique": false
+    "is_subtechnique": false,
+    "cve_refs": [
+      "CVE-2025-26633"
+    ]
   },
   "T1037": {
     "id": "T1037",
@@ -3931,6 +4012,7 @@
     "stix_id": "attack-pattern--7bc57495-ea59-4380-be31-a64af124ef18",
     "is_subtechnique": false,
     "cve_refs": [
+      "CVE-2017-12637",
       "CVE-2023-51449",
       "CVE-2023-6021",
       "CVE-2023-6038",
@@ -3938,6 +4020,9 @@
       "CVE-2024-24591",
       "CVE-2024-38475",
       "CVE-2024-39722",
+      "CVE-2024-48248",
+      "CVE-2025-0111",
+      "CVE-2025-24984",
       "CVE-2026-20262",
       "CVE-2026-34909",
       "CVE-2026-34926",
@@ -4579,6 +4664,9 @@
     "stix_id": "attack-pattern--b77cf5f3-6060-475d-bd60-40ccbf28fdc2",
     "is_subtechnique": false,
     "cve_refs": [
+      "CVE-2024-13159",
+      "CVE-2024-13160",
+      "CVE-2024-13161",
       "CVE-2025-24054"
     ]
   },
@@ -4622,7 +4710,10 @@
       "macOS"
     ],
     "stix_id": "attack-pattern--d40239b3-05ff-46d8-9bdd-b46d13463ef9",
-    "is_subtechnique": false
+    "is_subtechnique": false,
+    "cve_refs": [
+      "CVE-2024-50302"
+    ]
   },
   "T1201": {
     "id": "T1201",
@@ -4701,6 +4792,7 @@
       "CVE-2024-37052",
       "CVE-2024-37060",
       "CVE-2025-1550",
+      "CVE-2025-26633",
       "CVE-2025-32434",
       "CVE-2025-33236",
       "CVE-2025-51480",
@@ -4799,6 +4891,8 @@
     "stix_id": "attack-pattern--fe926152-f431-4baf-956c-4ad3cb0bf23b",
     "is_subtechnique": false,
     "cve_refs": [
+      "CVE-2025-21590",
+      "CVE-2025-2783",
       "CVE-2025-31201",
       "CVE-2026-21509",
       "CVE-2026-21510",
@@ -4865,7 +4959,10 @@
       "Windows"
     ],
     "stix_id": "attack-pattern--457c7820-d331-465a-915e-42f85500ccc4",
-    "is_subtechnique": false
+    "is_subtechnique": false,
+    "cve_refs": [
+      "CVE-2025-26633"
+    ]
   },
   "T1219": {
     "id": "T1219",
@@ -10935,6 +11032,9 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2025-24985",
+      "CVE-2025-24991",
+      "CVE-2025-24993",
       "CVE-2025-31200",
       "CVE-2025-33053",
       "CVE-2025-48384"
@@ -12317,9 +12417,12 @@
       "CVE-2018-4063",
       "CVE-2021-26828",
       "CVE-2024-1708",
+      "CVE-2024-57968",
       "CVE-2024-7399",
       "CVE-2024-7694",
+      "CVE-2025-24813",
       "CVE-2025-2749",
+      "CVE-2025-30406",
       "CVE-2025-31324",
       "CVE-2025-34028",
       "CVE-2025-3928",