@blamejs/exceptd-skills 0.19.24 → 0.19.26

package/data/attack-techniques.json

@@ -1,7 +1,7 @@
 {
   "_meta": {
     "schema_version": "1.0.0",
-    "last_updated": "2026-08-08",
+    "last_updated": "2026-08-15",
     "last_threat_review": "2026-08-08",
     "attack_version": "19.2",
     "attack_version_date": "2026-08-05",
@@ -147,6 +147,7 @@
     "name": "Exfiltration Over C2 Channel",
     "version": "v19",
     "cve_refs": [
+      "CVE-2015-4495",
       "CVE-2026-30615",
       "MAL-2026-MOIKA-DEPCONFUSION"
     ],
@@ -184,6 +185,9 @@
       "Execution",
       "Persistence",
       "Privilege Escalation"
+    ],
+    "cve_refs": [
+      "CVE-2017-15944"
     ]
   },
   "T1055": {
@@ -235,9 +239,11 @@
       "CVE-2018-9276",
       "CVE-2019-0344",
       "CVE-2019-11001",
+      "CVE-2019-15271",
       "CVE-2019-16278",
       "CVE-2019-17621",
       "CVE-2019-20500",
+      "CVE-2019-7193",
       "CVE-2019-7256",
       "CVE-2019-9874",
       "CVE-2019-9875",
@@ -263,6 +269,7 @@
       "CVE-2022-21445",
       "CVE-2022-21587",
       "CVE-2022-24816",
+      "CVE-2022-26134",
       "CVE-2022-29303",
       "CVE-2022-31199",
       "CVE-2022-39197",
@@ -524,6 +531,8 @@
     "name": "Command and Scripting Interpreter: PowerShell",
     "version": "v19",
     "cve_refs": [
+      "CVE-2016-3393",
+      "CVE-2022-30190",
       "CVE-2022-35405",
       "CVE-2022-41040",
       "CVE-2022-41080",
@@ -582,6 +591,11 @@
     "name": "Command and Scripting Interpreter: JavaScript",
     "version": "v19",
     "cve_refs": [
+      "CVE-2012-1889",
+      "CVE-2018-17463",
+      "CVE-2018-17480",
+      "CVE-2018-19943",
+      "CVE-2018-19953",
       "CVE-2020-35730",
       "CVE-2021-26829",
       "CVE-2022-27926",
@@ -623,6 +637,7 @@
     "version": "v19",
     "cve_refs": [
       "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
+      "CVE-2010-0840",
       "CVE-2010-3904",
       "CVE-2011-1823",
       "CVE-2013-2094",
@@ -630,8 +645,21 @@
       "CVE-2013-2597",
       "CVE-2013-6282",
       "CVE-2014-0196",
+      "CVE-2014-0546",
+      "CVE-2014-2817",
+      "CVE-2014-3153",
+      "CVE-2014-4077",
+      "CVE-2014-4123",
+      "CVE-2014-4148",
+      "CVE-2015-0016",
+      "CVE-2015-1671",
+      "CVE-2015-1769",
       "CVE-2015-2291",
+      "CVE-2015-2360",
+      "CVE-2015-6175",
       "CVE-2016-0165",
+      "CVE-2016-3393",
+      "CVE-2016-7256",
       "CVE-2017-1000253",
       "CVE-2018-0824",
       "CVE-2018-14634",
@@ -639,12 +667,19 @@
       "CVE-2018-19321",
       "CVE-2018-19322",
       "CVE-2018-19323",
+      "CVE-2018-4344",
+      "CVE-2018-4990",
+      "CVE-2018-8611",
       "CVE-2018-8639",
       "CVE-2019-1388",
+      "CVE-2019-3010",
       "CVE-2019-8526",
+      "CVE-2019-8605",
       "CVE-2020-17103-REREGRESSION-2026",
       "CVE-2020-3153",
       "CVE-2020-3433",
+      "CVE-2020-3837",
+      "CVE-2020-9907",
       "CVE-2021-22555",
       "CVE-2021-25337",
       "CVE-2021-25370",
@@ -656,12 +691,15 @@
       "CVE-2021-29256",
       "CVE-2021-30900",
       "CVE-2021-30952",
+      "CVE-2021-30983",
       "CVE-2021-31010",
       "CVE-2021-3493",
       "CVE-2021-3560",
+      "CVE-2021-4034",
       "CVE-2021-43226",
       "CVE-2022-0185",
       "CVE-2022-0492",
+      "CVE-2022-22047",
       "CVE-2022-22071",
       "CVE-2022-22265",
       "CVE-2022-22706",
@@ -803,6 +841,7 @@
       "CVE-2026-54420",
       "CVE-2026-56155",
       "CVE-2026-56164",
+      "CVE-2026-68820",
       "CVE-2026-6973"
     ],
     "description_full": "Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions. When initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable. This could also enable an adversary to move from a virtualized environment, such as within a virtual machine or container, onto the underlying host. This may be a necessary step for an adversary compromising an endpoint system that has been properly configured and limits other privilege escalation methods. Adversaries may bring a signed vulnerable driver onto a compromised machine so that they can exploit the vulnerability to execute code in kernel mode. This process is sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD).(Citation: ESET InvisiMole June 2020)(Citation: Unit42 AcidBox June 2020) Adversaries may include the vulnerable driver with files delivered during Initial Access or download it to a compromised system via [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) or [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570).",
@@ -851,6 +890,7 @@
     "cve_refs": [
       "BUG-2026-NIGHTMARE-ECLIPSE-YELLOWKEY",
       "CVE-2011-4723",
+      "CVE-2013-3993",
       "CVE-2015-7755",
       "CVE-2016-7836",
       "CVE-2017-5521",
@@ -1021,6 +1061,7 @@
     "cve_refs": [
       "CVE-2022-24112",
       "CVE-2022-24706",
+      "CVE-2022-26138",
       "CVE-2022-28810",
       "CVE-2026-18577",
       "CVE-2026-20316",
@@ -1317,6 +1358,9 @@
     "cve_refs": [
       "CVE-2008-4128",
       "CVE-2008-4250",
+      "CVE-2010-0738",
+      "CVE-2010-1428",
+      "CVE-2013-3993",
       "CVE-2014-100005",
       "CVE-2014-2120",
       "CVE-2014-3931",
@@ -1326,19 +1370,24 @@
       "CVE-2015-7755",
       "CVE-2016-10033",
       "CVE-2016-20017",
+      "CVE-2016-2386",
+      "CVE-2016-2388",
       "CVE-2016-3427",
       "CVE-2016-3714",
       "CVE-2016-6415",
       "CVE-2016-7836",
       "CVE-2016-8735",
+      "CVE-2017-0147",
       "CVE-2017-1000353",
       "CVE-2017-11357",
       "CVE-2017-12637",
+      "CVE-2017-15944",
       "CVE-2017-18368",
       "CVE-2017-3066",
       "CVE-2017-3506",
       "CVE-2017-5521",
       "CVE-2017-6742",
+      "CVE-2017-6862",
       "CVE-2017-6884",
       "CVE-2017-7494",
       "CVE-2017-7921",
@@ -1347,6 +1396,9 @@
       "CVE-2018-15133",
       "CVE-2018-18809",
       "CVE-2018-19410",
+      "CVE-2018-19943",
+      "CVE-2018-19949",
+      "CVE-2018-19953",
       "CVE-2018-2628",
       "CVE-2018-4063",
       "CVE-2018-5430",
@@ -1355,12 +1407,17 @@
       "CVE-2018-9276",
       "CVE-2019-0344",
       "CVE-2019-11001",
+      "CVE-2019-15271",
       "CVE-2019-16278",
       "CVE-2019-17621",
       "CVE-2019-19006",
       "CVE-2019-20500",
       "CVE-2019-5418",
       "CVE-2019-6693",
+      "CVE-2019-7192",
+      "CVE-2019-7193",
+      "CVE-2019-7194",
+      "CVE-2019-7195",
       "CVE-2019-7256",
       "CVE-2019-9621",
       "CVE-2019-9874",
@@ -1407,6 +1464,7 @@
       "CVE-2021-33045",
       "CVE-2021-35587",
       "CVE-2021-36380",
+      "CVE-2021-38163",
       "CVE-2021-39144",
       "CVE-2021-39226",
       "CVE-2021-39935",
@@ -1429,15 +1487,21 @@
       "CVE-2022-24706",
       "CVE-2022-24816",
       "CVE-2022-24990",
+      "CVE-2022-26134",
+      "CVE-2022-26138",
       "CVE-2022-26258",
       "CVE-2022-26352",
       "CVE-2022-26500",
       "CVE-2022-26501",
       "CVE-2022-27518",
       "CVE-2022-27593",
+      "CVE-2022-27924",
+      "CVE-2022-27925",
       "CVE-2022-27926",
       "CVE-2022-28810",
       "CVE-2022-29303",
+      "CVE-2022-29499",
+      "CVE-2022-30333",
       "CVE-2022-31199",
       "CVE-2022-3236",
       "CVE-2022-33891",
@@ -1446,6 +1510,7 @@
       "CVE-2022-36537",
       "CVE-2022-36551",
       "CVE-2022-36804",
+      "CVE-2022-37042",
       "CVE-2022-37055",
       "CVE-2022-39197",
       "CVE-2022-40684",
@@ -1844,6 +1909,7 @@
       "CVE-2026-20253",
       "CVE-2026-20262",
       "CVE-2026-20316",
+      "CVE-2026-20349",
       "CVE-2026-20963",
       "CVE-2026-21525",
       "CVE-2026-21643",
@@ -1918,6 +1984,7 @@
       "CVE-2026-63030",
       "CVE-2026-63077",
       "CVE-2026-6973",
+      "CVE-2026-72898",
       "CVE-2026-7473",
       "CVE-2026-7482",
       "CVE-2026-8037",
@@ -2002,6 +2069,7 @@
     "name": "Supply Chain Compromise: Software Supply Chain",
     "version": "v19",
     "cve_refs": [
+      "CVE-2022-30333",
       "CVE-2024-0129",
       "CVE-2024-11392",
       "CVE-2024-11393",
@@ -2079,37 +2147,89 @@
     "name": "Exploitation for Client Execution",
     "version": "v19",
     "cve_refs": [
+      "CVE-2006-2492",
       "CVE-2007-0671",
+      "CVE-2007-5659",
       "CVE-2008-0015",
+      "CVE-2008-0655",
       "CVE-2009-0238",
       "CVE-2009-0556",
+      "CVE-2009-0557",
+      "CVE-2009-0563",
       "CVE-2009-1537",
+      "CVE-2009-1862",
       "CVE-2009-3459",
+      "CVE-2009-3953",
+      "CVE-2009-4324",
       "CVE-2010-0249",
       "CVE-2010-0806",
+      "CVE-2010-0840",
+      "CVE-2010-1297",
       "CVE-2010-2568",
+      "CVE-2010-2572",
+      "CVE-2010-2883",
       "CVE-2010-3765",
       "CVE-2010-3962",
+      "CVE-2011-0609",
+      "CVE-2011-2462",
       "CVE-2011-3402",
+      "CVE-2012-0754",
+      "CVE-2012-1710",
+      "CVE-2012-1889",
       "CVE-2012-4792",
+      "CVE-2012-4969",
+      "CVE-2012-5054",
+      "CVE-2013-0074",
+      "CVE-2013-0422",
+      "CVE-2013-0431",
       "CVE-2013-0643",
       "CVE-2013-0648",
+      "CVE-2013-1331",
+      "CVE-2013-2423",
       "CVE-2013-3163",
       "CVE-2013-3893",
+      "CVE-2013-3896",
       "CVE-2013-3918",
       "CVE-2014-0497",
       "CVE-2014-0502",
+      "CVE-2014-0546",
+      "CVE-2014-4123",
+      "CVE-2014-4148",
+      "CVE-2014-8439",
+      "CVE-2015-0016",
+      "CVE-2015-0071",
+      "CVE-2015-0310",
+      "CVE-2015-1671",
+      "CVE-2015-2425",
+      "CVE-2015-8651",
+      "CVE-2016-0034",
+      "CVE-2016-0984",
+      "CVE-2016-1010",
+      "CVE-2016-1646",
+      "CVE-2016-3393",
+      "CVE-2016-5198",
+      "CVE-2016-7256",
       "CVE-2016-9079",
+      "CVE-2017-0022",
+      "CVE-2017-5030",
+      "CVE-2017-5070",
       "CVE-2018-0824",
+      "CVE-2018-17463",
+      "CVE-2018-17480",
+      "CVE-2018-4990",
+      "CVE-2018-6065",
+      "CVE-2019-5825",
       "CVE-2020-9715",
       "CVE-2021-30900",
       "CVE-2021-30952",
       "CVE-2021-38406",
       "CVE-2022-21971",
       "CVE-2022-2294",
+      "CVE-2022-30190",
       "CVE-2022-3038",
       "CVE-2022-3075",
       "CVE-2022-32893",
+      "CVE-2022-34713",
       "CVE-2022-3723",
       "CVE-2022-38181",
       "CVE-2022-41128",
@@ -2287,6 +2407,7 @@
     ],
     "cve_refs": [
       "CVE-2015-5317",
+      "CVE-2016-2386",
       "CVE-2021-39226",
       "CVE-2021-44026",
       "CVE-2023-35078",
@@ -2296,7 +2417,8 @@
       "CVE-2026-21858",
       "CVE-2026-22218",
       "CVE-2026-41950",
-      "CVE-2026-60137"
+      "CVE-2026-60137",
+      "CVE-2026-72898"
     ]
   },
   "T1485": {
@@ -2347,10 +2469,19 @@
     "last_verified": "2026-05-19",
     "description": "Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.",
     "cve_refs": [
+      "CVE-2010-0738",
+      "CVE-2010-1428",
+      "CVE-2016-0034",
+      "CVE-2018-19949",
+      "CVE-2019-7194",
+      "CVE-2019-7195",
       "CVE-2022-24990",
       "CVE-2022-26500",
       "CVE-2022-27593",
+      "CVE-2022-27925",
+      "CVE-2022-29499",
       "CVE-2022-36537",
+      "CVE-2022-37042",
       "CVE-2022-44698",
       "CVE-2022-47986",
       "CVE-2023-28252",
@@ -2533,6 +2664,7 @@
     "version": "v19",
     "cve_refs": [
       "CVE-2011-1823",
+      "CVE-2017-15944",
       "CVE-2026-31431",
       "CVE-2026-31635",
       "CVE-2026-43284"
@@ -2572,6 +2704,7 @@
     "name": "Unsecured Credentials",
     "version": "v19",
     "cve_refs": [
+      "CVE-2016-2386",
       "CVE-2016-6415",
       "CVE-2018-15133",
       "CVE-2019-5418",
@@ -2616,6 +2749,7 @@
       "CVE-2026-3055",
       "CVE-2026-48027",
       "CVE-2026-55255",
+      "CVE-2026-72898",
       "MAL-2025-PYPI-COLORAMA-SOLANA-STEALER",
       "MAL-2026-RUBYGEMS-BUFFERZONECORP-SLEEPER"
     ],
@@ -2645,6 +2779,7 @@
     "version": "v19",
     "cve_refs": [
       "CVE-2011-4723",
+      "CVE-2015-4495",
       "CVE-2018-18809",
       "CVE-2018-5430",
       "CVE-2023-22952",
@@ -2839,6 +2974,7 @@
       "CVE-2021-33515",
       "CVE-2021-38371",
       "CVE-2022-22536",
+      "CVE-2022-27924",
       "CVE-2023-36761",
       "CVE-2024-13159",
       "CVE-2024-13160",
@@ -2911,7 +3047,23 @@
       "Initial Access"
     ],
     "cve_refs": [
+      "CVE-2006-2492",
+      "CVE-2007-5659",
+      "CVE-2009-0557",
+      "CVE-2009-0563",
+      "CVE-2009-3953",
+      "CVE-2009-4324",
+      "CVE-2010-2572",
+      "CVE-2010-2883",
+      "CVE-2011-0609",
+      "CVE-2011-2462",
+      "CVE-2012-0754",
+      "CVE-2013-1331",
+      "CVE-2018-4990",
       "CVE-2021-38406",
+      "CVE-2022-30190",
+      "CVE-2022-30333",
+      "CVE-2022-34713",
       "CVE-2022-41049",
       "CVE-2022-41091",
       "CVE-2022-41128",
@@ -2939,6 +3091,7 @@
       "Initial Access"
     ],
     "cve_refs": [
+      "CVE-2012-0767",
       "CVE-2023-37580"
     ]
   },
@@ -3049,6 +3202,7 @@
     "version": "v19",
     "cve_refs": [
       "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
+      "CVE-2014-4077",
       "CVE-2021-25337",
       "CVE-2022-23748",
       "CVE-2024-7262",
@@ -3546,10 +3700,13 @@
     "name": "Data from Local System",
     "version": "v19",
     "cve_refs": [
+      "CVE-2013-3993",
+      "CVE-2015-4495",
       "CVE-2020-9934",
       "CVE-2021-27876",
       "CVE-2021-41277",
       "CVE-2022-36537",
+      "CVE-2022-37042",
       "CVE-2023-0669",
       "CVE-2023-21237",
       "CVE-2023-36424",
@@ -3593,8 +3750,49 @@
     "name": "Drive-by Compromise",
     "version": "v19",
     "cve_refs": [
+      "CVE-2007-5659",
+      "CVE-2008-0655",
+      "CVE-2009-1862",
+      "CVE-2010-0840",
+      "CVE-2010-1297",
+      "CVE-2012-0767",
+      "CVE-2012-1710",
+      "CVE-2012-1889",
+      "CVE-2012-4969",
+      "CVE-2012-5054",
+      "CVE-2013-0074",
+      "CVE-2013-0422",
+      "CVE-2013-0431",
+      "CVE-2013-2423",
       "CVE-2013-3163",
+      "CVE-2013-3896",
+      "CVE-2013-7331",
+      "CVE-2014-2817",
+      "CVE-2014-4123",
+      "CVE-2014-4148",
+      "CVE-2014-8439",
+      "CVE-2015-0016",
+      "CVE-2015-0071",
+      "CVE-2015-0310",
+      "CVE-2015-1671",
+      "CVE-2015-2425",
+      "CVE-2015-4495",
+      "CVE-2015-8651",
+      "CVE-2016-0034",
+      "CVE-2016-0984",
+      "CVE-2016-1010",
+      "CVE-2016-1646",
+      "CVE-2016-5198",
+      "CVE-2016-7256",
       "CVE-2016-9079",
+      "CVE-2017-0022",
+      "CVE-2017-5030",
+      "CVE-2017-5070",
+      "CVE-2018-17463",
+      "CVE-2018-17480",
+      "CVE-2018-6065",
+      "CVE-2019-5825",
+      "CVE-2021-30533",
       "CVE-2022-2294",
       "CVE-2022-2856",
       "CVE-2022-3038",
@@ -3677,7 +3875,8 @@
       "CVE-2023-44487",
       "CVE-2023-50387",
       "CVE-2023-50868",
-      "CVE-2025-8671"
+      "CVE-2025-8671",
+      "CVE-2026-20349"
     ],
     "description_full": "Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. Network DoS can be performed by exhausting the network bandwidth services rely on. Example resources include specific websites, email services, DNS, and web-based applications. Adversaries have been observed conducting network DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014) A Network DoS will occur when the bandwidth capacity of the network connection to a system is exhausted due to the volume of malicious traffic directed at the resource or the network connections and network devices the resource relies on. For example, an adversary may send 10Gbps of traffic to a server that is hosted by a network with a 1Gbps connection to the internet. This traffic can be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS). To perform Network DoS attacks several aspects apply to multiple methods, including IP address spoofing, and botnets. Adversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices. For DoS attacks targeting the hosting system directly, see [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1499).",
     "platforms": [
@@ -3899,6 +4098,7 @@
       "CVE-2025-20352",
       "CVE-2025-30202",
       "CVE-2025-6543",
+      "CVE-2026-20349",
       "CVE-2026-24215",
       "CVE-2026-28318",
       "CVE-2026-45498"
@@ -3958,6 +4158,8 @@
     "stix_id": "attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22",
     "is_subtechnique": false,
     "cve_refs": [
+      "CVE-2019-7194",
+      "CVE-2019-7195",
       "CVE-2025-29824"
     ]
   },
@@ -4366,6 +4568,8 @@
     "stix_id": "attack-pattern--e3a12395-188d-4051-9a16-ea8e14d07b88",
     "is_subtechnique": false,
     "cve_refs": [
+      "CVE-2017-0147",
+      "CVE-2017-6862",
       "CVE-2022-24706",
       "CVE-2026-34486"
     ]
@@ -4716,8 +4920,13 @@
     "stix_id": "attack-pattern--7bc57495-ea59-4380-be31-a64af124ef18",
     "is_subtechnique": false,
     "cve_refs": [
+      "CVE-2013-3993",
+      "CVE-2013-7331",
+      "CVE-2017-0022",
       "CVE-2017-12637",
       "CVE-2018-18809",
+      "CVE-2019-7194",
+      "CVE-2019-7195",
       "CVE-2020-17519",
       "CVE-2021-20123",
       "CVE-2021-20124",
@@ -4781,7 +4990,10 @@
       "Windows"
     ],
     "stix_id": "attack-pattern--72b74d71-8169-42aa-92e0-e7b04b9f5a08",
-    "is_subtechnique": false
+    "is_subtechnique": false,
+    "cve_refs": [
+      "CVE-2016-2388"
+    ]
   },
   "T1090": {
     "id": "T1090",
@@ -4806,6 +5018,7 @@
     "stix_id": "attack-pattern--731f4f55-b6d0-41d1-a7a9-072a66389aea",
     "is_subtechnique": false,
     "cve_refs": [
+      "CVE-2022-29499",
       "CVE-2022-36551",
       "CVE-2025-25297",
       "CVE-2025-56520"
@@ -4831,7 +5044,8 @@
     "stix_id": "attack-pattern--3b744087-9945-4a6f-91e8-9dbceda417a4",
     "is_subtechnique": false,
     "cve_refs": [
-      "CVE-2010-2568"
+      "CVE-2010-2568",
+      "CVE-2015-1769"
     ]
   },
   "T1092": {
@@ -4930,6 +5144,7 @@
       "CVE-2022-26258",
       "CVE-2022-26500",
       "CVE-2022-26501",
+      "CVE-2022-34713",
       "CVE-2022-40139",
       "CVE-2022-44877",
       "CVE-2022-46169",
@@ -5427,6 +5642,9 @@
     "stix_id": "attack-pattern--544b0346-29ad-41e1-a808-501bb4193f47",
     "is_subtechnique": false,
     "cve_refs": [
+      "CVE-2012-0767",
+      "CVE-2018-19943",
+      "CVE-2018-19953",
       "CVE-2024-9526"
     ]
   },
@@ -5449,6 +5667,7 @@
     "stix_id": "attack-pattern--b77cf5f3-6060-475d-bd60-40ccbf28fdc2",
     "is_subtechnique": false,
     "cve_refs": [
+      "CVE-2022-26925",
       "CVE-2023-23397",
       "CVE-2023-36563",
       "CVE-2023-36761",
@@ -5502,6 +5721,7 @@
     "stix_id": "attack-pattern--d40239b3-05ff-46d8-9bdd-b46d13463ef9",
     "is_subtechnique": false,
     "cve_refs": [
+      "CVE-2015-1769",
       "CVE-2024-50302",
       "CVE-2025-24200"
     ]
@@ -5661,7 +5881,9 @@
       "CVE-2008-4250",
       "CVE-2016-3427",
       "CVE-2016-8735",
+      "CVE-2017-0147",
       "CVE-2017-6742",
+      "CVE-2017-6862",
       "CVE-2017-7494",
       "CVE-2018-7445",
       "CVE-2021-27137",
@@ -5701,7 +5923,13 @@
     "stix_id": "attack-pattern--fe926152-f431-4baf-956c-4ad3cb0bf23b",
     "is_subtechnique": false,
     "cve_refs": [
+      "CVE-2013-0422",
+      "CVE-2013-0431",
       "CVE-2013-0643",
+      "CVE-2013-2423",
+      "CVE-2015-0071",
+      "CVE-2015-0310",
+      "CVE-2018-4344",
       "CVE-2021-25369",
       "CVE-2021-25370",
       "CVE-2021-31010",
@@ -5860,6 +6088,7 @@
     "stix_id": "attack-pattern--dc31fe1e-d722-49da-8f5f-92c7b5aff534",
     "is_subtechnique": false,
     "cve_refs": [
+      "CVE-2022-30190",
       "CVE-2022-41128"
     ]
   },
@@ -6063,7 +6292,10 @@
       "Windows"
     ],
     "stix_id": "attack-pattern--82caa33e-d11a-433a-94ea-9b5a5fbef81d",
-    "is_subtechnique": false
+    "is_subtechnique": false,
+    "cve_refs": [
+      "CVE-2017-0022"
+    ]
   },
   "T1526": {
     "id": "T1526",
@@ -6249,6 +6481,7 @@
     "is_subtechnique": false,
     "cve_refs": [
       "CVE-2021-3560",
+      "CVE-2021-4034",
       "CVE-2026-48172"
     ]
   },
@@ -6619,7 +6852,10 @@
       "PRE"
     ],
     "stix_id": "attack-pattern--edadea33-549c-4ed1-9783-8f5a5853cbdf",
-    "is_subtechnique": false
+    "is_subtechnique": false,
+    "cve_refs": [
+      "CVE-2015-2360"
+    ]
   },
   "T1588": {
     "id": "T1588",
@@ -6657,7 +6893,10 @@
       "PRE"
     ],
     "stix_id": "attack-pattern--5282dd9a-d26d-4e16-88b7-7c0f4553daf4",
-    "is_subtechnique": false
+    "is_subtechnique": false,
+    "cve_refs": [
+      "CVE-2016-2388"
+    ]
   },
   "T1590": {
     "id": "T1590",
@@ -8200,7 +8439,10 @@
     "stix_id": "attack-pattern--4f9ca633-15c5-463c-9724-bdcd54fde541",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-attack-stix"
+    "_intake_method": "mitre-attack-stix",
+    "cve_refs": [
+      "CVE-2017-0147"
+    ]
   },
   "T1021.003": {
     "id": "T1021.003",
@@ -8868,7 +9110,10 @@
     "stix_id": "attack-pattern--b4b7458f-81f2-4d38-84be-1c5ba0167a52",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-attack-stix"
+    "_intake_method": "mitre-attack-stix",
+    "cve_refs": [
+      "CVE-2012-0151"
+    ]
   },
   "T1036.002": {
     "id": "T1036.002",
@@ -10036,6 +10281,8 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2017-15944",
+      "CVE-2018-19949",
       "CVE-2018-2628",
       "CVE-2018-6530",
       "CVE-2018-7445",
@@ -10043,10 +10290,13 @@
       "CVE-2022-24112",
       "CVE-2022-24990",
       "CVE-2022-26258",
+      "CVE-2022-27925",
+      "CVE-2022-29499",
       "CVE-2022-3236",
       "CVE-2022-33891",
       "CVE-2022-35914",
       "CVE-2022-36804",
+      "CVE-2022-37042",
       "CVE-2022-44877",
       "CVE-2022-46169",
       "CVE-2026-34486",
@@ -11010,6 +11260,7 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2022-30333",
       "CVE-2022-40684"
     ]
   },
@@ -11914,6 +12165,17 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2012-1710",
+      "CVE-2012-4969",
+      "CVE-2012-5054",
+      "CVE-2013-0074",
+      "CVE-2013-0422",
+      "CVE-2016-0984",
+      "CVE-2016-1010",
+      "CVE-2016-7256",
+      "CVE-2017-5030",
+      "CVE-2017-5070",
+      "CVE-2021-30533",
       "CVE-2022-27926",
       "CVE-2022-2856",
       "CVE-2022-4262",
@@ -11947,11 +12209,41 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2006-2492",
+      "CVE-2007-5659",
+      "CVE-2008-0655",
+      "CVE-2009-0557",
+      "CVE-2009-0563",
+      "CVE-2009-1862",
+      "CVE-2009-3953",
+      "CVE-2009-4324",
+      "CVE-2010-1297",
+      "CVE-2010-2572",
+      "CVE-2010-2883",
+      "CVE-2011-0609",
+      "CVE-2011-2462",
+      "CVE-2012-0151",
+      "CVE-2012-0754",
+      "CVE-2013-1331",
       "CVE-2013-6282",
+      "CVE-2014-0546",
+      "CVE-2014-4077",
+      "CVE-2014-4148",
+      "CVE-2015-1671",
+      "CVE-2015-6175",
+      "CVE-2016-7256",
+      "CVE-2018-4344",
+      "CVE-2018-4990",
+      "CVE-2019-8605",
       "CVE-2020-28949",
+      "CVE-2020-3837",
+      "CVE-2020-9907",
+      "CVE-2021-30983",
       "CVE-2021-38406",
       "CVE-2022-21971",
       "CVE-2022-23748",
+      "CVE-2022-30190",
+      "CVE-2022-34713",
       "CVE-2022-41049",
       "CVE-2022-41091",
       "CVE-2022-41128",
@@ -13272,7 +13564,10 @@
     "stix_id": "attack-pattern--2bee5ffb-7a7a-4119-b1f2-158151b19ac0",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-attack-stix"
+    "_intake_method": "mitre-attack-stix",
+    "cve_refs": [
+      "CVE-2026-20349"
+    ]
   },
   "T1505.001": {
     "id": "T1505.001",
@@ -13354,16 +13649,25 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2010-0738",
+      "CVE-2010-1428",
       "CVE-2014-2120",
       "CVE-2017-11357",
+      "CVE-2017-15944",
       "CVE-2018-4063",
       "CVE-2020-14644",
       "CVE-2020-28949",
       "CVE-2020-36193",
       "CVE-2021-26828",
       "CVE-2021-31196",
+      "CVE-2021-38163",
       "CVE-2022-21587",
+      "CVE-2022-26134",
       "CVE-2022-26352",
+      "CVE-2022-27925",
+      "CVE-2022-29499",
+      "CVE-2022-30333",
+      "CVE-2022-37042",
       "CVE-2022-41040",
       "CVE-2022-41082",
       "CVE-2022-41352",
@@ -13521,7 +13825,11 @@
     "stix_id": "attack-pattern--cba37adb-d6fb-4610-b069-dd04c0643384",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-attack-stix"
+    "_intake_method": "mitre-attack-stix",
+    "cve_refs": [
+      "CVE-2013-7331",
+      "CVE-2017-0022"
+    ]
   },
   "T1518.002": {
     "id": "T1518.002",
@@ -14326,6 +14634,7 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2022-34713",
       "CVE-2025-6218",
       "CVE-2025-8088"
     ]
@@ -15046,6 +15355,7 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2012-0151",
       "CVE-2026-8398"
     ]
   },
@@ -15572,6 +15882,7 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2022-26925",
       "CVE-2023-23397",
       "CVE-2025-33073"
     ]
@@ -16953,7 +17264,10 @@
     "stix_id": "attack-pattern--633a100c-b2c9-41bf-9be5-905c1b16c825",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-attack-stix"
+    "_intake_method": "mitre-attack-stix",
+    "cve_refs": [
+      "CVE-2019-3010"
+    ]
   },
   "T1574.007": {
     "id": "T1574.007",
@@ -17462,7 +17776,10 @@
     "stix_id": "attack-pattern--155207c0-7f53-4f13-a06b-0a9907ef5096",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-attack-stix"
+    "_intake_method": "mitre-attack-stix",
+    "cve_refs": [
+      "CVE-2013-3896"
+    ]
   },
   "T1584.001": {
     "id": "T1584.001",
@@ -18049,6 +18366,7 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2014-8439",
       "CVE-2022-41073"
     ]
   },