@blamejs/exceptd-skills 0.19.36 → 0.19.38

package/data/attack-techniques.json

@@ -85,6 +85,9 @@
     "description": "Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service that accepts remote connections, such as telnet, SSH, and VNC.",
     "tactic": [
       "Lateral Movement"
+    ],
+    "cve_refs": [
+      "CVE-2017-5689"
     ]
   },
   "T1027": {
@@ -97,6 +100,7 @@
       "DS0009"
     ],
     "cve_refs": [
+      "CVE-2022-0609",
       "CVE-2023-21237",
       "CVE-2023-36584",
       "CVE-2024-21412",
@@ -188,7 +192,8 @@
       "Privilege Escalation"
     ],
     "cve_refs": [
-      "CVE-2017-15944"
+      "CVE-2017-15944",
+      "CVE-2026-59310"
     ]
   },
   "T1055": {
@@ -210,7 +215,9 @@
       "Privilege Escalation"
     ],
     "cve_refs": [
+      "CVE-2002-0367",
       "CVE-2011-2005",
+      "CVE-2014-1761",
       "CVE-2015-0311",
       "CVE-2019-0841",
       "CVE-2019-0880",
@@ -229,6 +236,7 @@
     "cve_refs": [
       "CVE-2008-4128",
       "CVE-2013-0625",
+      "CVE-2013-0632",
       "CVE-2013-2251",
       "CVE-2013-4810",
       "CVE-2014-3120",
@@ -239,6 +247,7 @@
       "CVE-2016-0752",
       "CVE-2016-10033",
       "CVE-2016-20017",
+      "CVE-2016-3088",
       "CVE-2016-3714",
       "CVE-2016-6367",
       "CVE-2016-7262",
@@ -251,6 +260,8 @@
       "CVE-2017-6316",
       "CVE-2017-6334",
       "CVE-2017-6884",
+      "CVE-2017-9841",
+      "CVE-2018-1000861",
       "CVE-2018-1273",
       "CVE-2018-14667",
       "CVE-2018-14933",
@@ -271,6 +282,7 @@
       "CVE-2019-9875",
       "CVE-2020-0618",
       "CVE-2020-12641",
+      "CVE-2020-13927",
       "CVE-2020-13965",
       "CVE-2020-14644",
       "CVE-2020-15069",
@@ -286,11 +298,13 @@
       "CVE-2021-36380",
       "CVE-2021-39144",
       "CVE-2021-40407",
+      "CVE-2021-40870",
       "CVE-2021-44529",
       "CVE-2021-45046",
       "CVE-2022-1471",
       "CVE-2022-21445",
       "CVE-2022-21587",
+      "CVE-2022-23131",
       "CVE-2022-24816",
       "CVE-2022-26134",
       "CVE-2022-26871",
@@ -531,7 +545,9 @@
       "CVE-2026-5760",
       "CVE-2026-58644",
       "CVE-2026-63030",
-      "CVE-2026-6973"
+      "CVE-2026-6973",
+      "CVE-2026-72529",
+      "CVE-2026-72530"
     ],
     "description_full": "Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix Shell](https://attack.mitre.org/techniques/T1059/004) while Windows installations include the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). There are also cross-platform interpreters such as [Python](https://attack.mitre.org/techniques/T1059/006), as well as those commonly associated with client applications such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) and [Visual Basic](https://attack.mitre.org/techniques/T1059/005). Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in [Initial Access](https://attack.mitre.org/tactics/TA0001) payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various [Remote Services](https://attack.mitre.org/techniques/T1021) in order to achieve remote Execution.(Citation: Powershell Remote Commands)(Citation: Cisco IOS Software Integrity Assurance - Command History)(Citation: Remote Shell Execution in Python)",
     "platforms": [
@@ -559,6 +575,7 @@
       "CVE-2016-0099",
       "CVE-2016-3393",
       "CVE-2018-20753",
+      "CVE-2019-0752",
       "CVE-2019-1003030",
       "CVE-2022-30190",
       "CVE-2022-35405",
@@ -622,6 +639,7 @@
     "cve_refs": [
       "CVE-2012-1889",
       "CVE-2013-5223",
+      "CVE-2017-8570",
       "CVE-2018-17463",
       "CVE-2018-17480",
       "CVE-2018-19943",
@@ -630,6 +648,7 @@
       "CVE-2018-8298",
       "CVE-2020-35730",
       "CVE-2021-26829",
+      "CVE-2022-24682",
       "CVE-2022-27926",
       "CVE-2023-37580",
       "CVE-2023-6571",
@@ -669,6 +688,11 @@
     "version": "v19",
     "cve_refs": [
       "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
+      "CVE-2002-0367",
+      "CVE-2004-0210",
+      "CVE-2008-3431",
+      "CVE-2009-1123",
+      "CVE-2010-0232",
       "CVE-2010-0840",
       "CVE-2010-3904",
       "CVE-2010-4344",
@@ -676,9 +700,11 @@
       "CVE-2010-4398",
       "CVE-2011-1823",
       "CVE-2011-2005",
+      "CVE-2013-0641",
       "CVE-2013-2094",
       "CVE-2013-2596",
       "CVE-2013-2597",
+      "CVE-2013-3346",
       "CVE-2013-3660",
       "CVE-2013-5065",
       "CVE-2013-6282",
@@ -690,8 +716,11 @@
       "CVE-2014-4113",
       "CVE-2014-4123",
       "CVE-2014-4148",
+      "CVE-2014-4404",
       "CVE-2014-6324",
+      "CVE-2014-7169",
       "CVE-2015-0016",
+      "CVE-2015-1130",
       "CVE-2015-1671",
       "CVE-2015-1701",
       "CVE-2015-1769",
@@ -700,6 +729,8 @@
       "CVE-2015-2387",
       "CVE-2015-2426",
       "CVE-2015-2546",
+      "CVE-2015-3246",
+      "CVE-2015-5287",
       "CVE-2015-6175",
       "CVE-2016-0040",
       "CVE-2016-0099",
@@ -716,6 +747,8 @@
       "CVE-2017-0005",
       "CVE-2017-0101",
       "CVE-2017-0213",
+      "CVE-2017-0262",
+      "CVE-2017-0263",
       "CVE-2017-1000253",
       "CVE-2017-8540",
       "CVE-2018-0167",
@@ -732,6 +765,7 @@
       "CVE-2018-8405",
       "CVE-2018-8406",
       "CVE-2018-8440",
+      "CVE-2018-8453",
       "CVE-2018-8581",
       "CVE-2018-8589",
       "CVE-2018-8611",
@@ -758,6 +792,7 @@
       "CVE-2019-8526",
       "CVE-2019-8605",
       "CVE-2020-0638",
+      "CVE-2020-0787",
       "CVE-2020-1027",
       "CVE-2020-17103-REREGRESSION-2026",
       "CVE-2020-3153",
@@ -788,6 +823,7 @@
       "CVE-2021-34486",
       "CVE-2021-3493",
       "CVE-2021-3560",
+      "CVE-2021-36934",
       "CVE-2021-39793",
       "CVE-2021-4034",
       "CVE-2021-40450",
@@ -799,13 +835,16 @@
       "CVE-2022-0185",
       "CVE-2022-0492",
       "CVE-2022-0847",
+      "CVE-2022-0995",
       "CVE-2022-20700",
       "CVE-2022-20701",
+      "CVE-2022-21882",
       "CVE-2022-21919",
       "CVE-2022-21999",
       "CVE-2022-22047",
       "CVE-2022-22071",
       "CVE-2022-22265",
+      "CVE-2022-22587",
       "CVE-2022-22674",
       "CVE-2022-22675",
       "CVE-2022-22706",
@@ -949,11 +988,14 @@
       "CVE-2026-46300",
       "CVE-2026-46333",
       "CVE-2026-48172",
+      "CVE-2026-53362",
       "CVE-2026-54420",
       "CVE-2026-56155",
       "CVE-2026-56164",
       "CVE-2026-68820",
-      "CVE-2026-6973"
+      "CVE-2026-6973",
+      "CVE-2026-72529",
+      "CVE-2026-72530"
     ],
     "description_full": "Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions. When initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable. This could also enable an adversary to move from a virtualized environment, such as within a virtual machine or container, onto the underlying host. This may be a necessary step for an adversary compromising an endpoint system that has been properly configured and limits other privilege escalation methods. Adversaries may bring a signed vulnerable driver onto a compromised machine so that they can exploit the vulnerability to execute code in kernel mode. This process is sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD).(Citation: ESET InvisiMole June 2020)(Citation: Unit42 AcidBox June 2020) Adversaries may include the vulnerable driver with files delivered during Initial Access or download it to a compromised system via [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) or [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570).",
     "platforms": [
@@ -992,7 +1034,9 @@
     ],
     "cve_refs": [
       "CVE-2024-50603",
-      "CVE-2024-9680"
+      "CVE-2024-9680",
+      "CVE-2026-33824",
+      "CVE-2026-72529"
     ]
   },
   "T1078": {
@@ -1000,6 +1044,7 @@
     "version": "v19",
     "cve_refs": [
       "BUG-2026-NIGHTMARE-ECLIPSE-YELLOWKEY",
+      "CVE-2009-1123",
       "CVE-2011-4723",
       "CVE-2013-0625",
       "CVE-2013-3993",
@@ -1026,22 +1071,30 @@
       "CVE-2019-0703",
       "CVE-2019-1003029",
       "CVE-2019-1003030",
+      "CVE-2019-1068",
       "CVE-2019-11001",
       "CVE-2019-1652",
       "CVE-2019-19006",
       "CVE-2019-20500",
       "CVE-2019-6693",
       "CVE-2020-10148",
+      "CVE-2020-11978",
+      "CVE-2020-13671",
       "CVE-2020-2021",
       "CVE-2020-24363",
       "CVE-2020-2506",
       "CVE-2020-29574",
       "CVE-2020-9377",
       "CVE-2021-20035",
+      "CVE-2021-21975",
+      "CVE-2021-25296",
+      "CVE-2021-25297",
+      "CVE-2021-25298",
       "CVE-2021-27876",
       "CVE-2021-32030",
       "CVE-2021-33044",
       "CVE-2021-33045",
+      "CVE-2021-33766",
       "CVE-2021-40407",
       "CVE-2021-41379",
       "CVE-2021-42287",
@@ -1166,6 +1219,7 @@
       "CVE-2026-48558",
       "CVE-2026-50751",
       "CVE-2026-56155",
+      "CVE-2026-66384",
       "CVE-2026-6973",
       "MAL-2026-NODE-IPC-STEALER",
       "MAL-2026-SHAI-HULUD-OSS"
@@ -1199,6 +1253,7 @@
     "name": "Valid Accounts: Default Accounts",
     "version": "v19",
     "cve_refs": [
+      "CVE-2013-0632",
       "CVE-2017-6334",
       "CVE-2021-28799",
       "CVE-2022-24112",
@@ -1282,6 +1337,11 @@
       "Persistence",
       "Privilege Escalation",
       "Initial Access"
+    ],
+    "cve_refs": [
+      "CVE-2002-0367",
+      "CVE-2004-0210",
+      "CVE-2010-0232"
     ]
   },
   "T1078.004": {
@@ -1292,6 +1352,7 @@
       "CVE-2025-53767",
       "CVE-2025-55241",
       "CVE-2026-45321",
+      "CVE-2026-64849",
       "MAL-2026-3083",
       "MAL-2026-RUBYGEMS-BUFFERZONECORP-SLEEPER",
       "MAL-2026-TRAPDOOR-CROSS-ECOSYSTEM"
@@ -1319,6 +1380,7 @@
     "name": "Account Manipulation",
     "version": "v19",
     "cve_refs": [
+      "CVE-2021-32648",
       "CVE-2024-37085",
       "CVE-2025-55241"
     ],
@@ -1382,6 +1444,9 @@
     "description": "Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system.",
     "tactic": [
       "Command and Control"
+    ],
+    "cve_refs": [
+      "CVE-2026-72530"
     ]
   },
   "T1110": {
@@ -1443,9 +1508,12 @@
     "name": "External Remote Services",
     "version": "v19",
     "cve_refs": [
+      "CVE-2014-6271",
+      "CVE-2014-7169",
       "CVE-2018-10561",
       "CVE-2020-2021",
       "CVE-2020-8218",
+      "CVE-2021-20038",
       "CVE-2022-1040",
       "CVE-2022-23176",
       "CVE-2022-42475",
@@ -1456,8 +1524,10 @@
       "CVE-2026-0257",
       "CVE-2026-0300",
       "CVE-2026-10520",
+      "CVE-2026-33824",
       "CVE-2026-39987",
-      "CVE-2026-50751"
+      "CVE-2026-50751",
+      "CVE-2026-8452"
     ],
     "description_full": "Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) and [VNC](https://attack.mitre.org/techniques/T1021/005) can also be used externally.(Citation: MacOS VNC software for Remote Desktop) Access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network.(Citation: Volexity Virtual Private Keylogging) Access to remote services may be used as a redundant or persistent access mechanism during an operation. Access may also be gained through an exposed service that doesn’t require authentication. In containerized environments, this may include an exposed Docker API, Kubernetes API server, kubelet, or web application such as the Kubernetes dashboard.(Citation: Trend Micro Exposed Docker Server)(Citation: Unit 42 Hildegard Malware) Adversaries may also establish persistence on network by configuring a Tor hidden service on a compromised system. Adversaries may utilize the tool `ShadowLink` to facilitate the installation and configuration of the Tor hidden service. Tor hidden service is then accessible via the Tor network because `ShadowLink` sets up a .onion address on the compromised system. `ShadowLink` may be used to forward any inbound connections to RDP, allowing the adversaries to have remote access.(Citation: The BadPilot campaign) Adversaries may get `ShadowLink` to persist on a system by masquerading it as an MS Defender application.(Citation: Russian threat actors dig in, prepare to seize on war fatigue)",
     "platforms": [
@@ -1500,6 +1570,7 @@
       "CVE-2016-5195",
       "CVE-2022-21999",
       "CVE-2022-40684",
+      "CVE-2026-60004",
       "CVE-2026-63030"
     ]
   },
@@ -1508,6 +1579,7 @@
     "version": "v19",
     "cve_refs": [
       "CVE-2005-2773",
+      "CVE-2006-1547",
       "CVE-2007-3010",
       "CVE-2008-4128",
       "CVE-2008-4250",
@@ -1518,10 +1590,12 @@
       "CVE-2010-2861",
       "CVE-2010-4344",
       "CVE-2010-5330",
+      "CVE-2012-0391",
       "CVE-2012-1823",
       "CVE-2013-0625",
       "CVE-2013-0629",
       "CVE-2013-0631",
+      "CVE-2013-0632",
       "CVE-2013-2251",
       "CVE-2013-3993",
       "CVE-2013-4810",
@@ -1533,12 +1607,16 @@
       "CVE-2014-2120",
       "CVE-2014-3120",
       "CVE-2014-3931",
+      "CVE-2014-6271",
       "CVE-2014-6278",
       "CVE-2014-6287",
+      "CVE-2014-7169",
       "CVE-2014-8361",
       "CVE-2015-0666",
       "CVE-2015-1187",
       "CVE-2015-1427",
+      "CVE-2015-1635",
+      "CVE-2015-2051",
       "CVE-2015-3035",
       "CVE-2015-4068",
       "CVE-2015-5317",
@@ -1551,6 +1629,7 @@
       "CVE-2016-20017",
       "CVE-2016-2386",
       "CVE-2016-2388",
+      "CVE-2016-3088",
       "CVE-2016-3427",
       "CVE-2016-3714",
       "CVE-2016-4523",
@@ -1559,8 +1638,10 @@
       "CVE-2016-6415",
       "CVE-2016-7836",
       "CVE-2016-8735",
+      "CVE-2017-0144",
       "CVE-2017-0147",
       "CVE-2017-1000353",
+      "CVE-2017-10271",
       "CVE-2017-11317",
       "CVE-2017-11357",
       "CVE-2017-12240",
@@ -1574,6 +1655,7 @@
       "CVE-2017-3506",
       "CVE-2017-3881",
       "CVE-2017-5521",
+      "CVE-2017-5689",
       "CVE-2017-6077",
       "CVE-2017-6316",
       "CVE-2017-6334",
@@ -1586,6 +1668,8 @@
       "CVE-2017-6884",
       "CVE-2017-7494",
       "CVE-2017-7921",
+      "CVE-2017-9791",
+      "CVE-2017-9841",
       "CVE-2018-0125",
       "CVE-2018-0147",
       "CVE-2018-0151",
@@ -1599,6 +1683,7 @@
       "CVE-2018-0174",
       "CVE-2018-0179",
       "CVE-2018-0180",
+      "CVE-2018-1000861",
       "CVE-2018-10561",
       "CVE-2018-10562",
       "CVE-2018-11138",
@@ -1625,6 +1710,7 @@
       "CVE-2019-0344",
       "CVE-2019-1003029",
       "CVE-2019-10068",
+      "CVE-2019-1068",
       "CVE-2019-11001",
       "CVE-2019-11043",
       "CVE-2019-11581",
@@ -1657,9 +1743,13 @@
       "CVE-2020-0618",
       "CVE-2020-10148",
       "CVE-2020-11023",
+      "CVE-2020-11978",
       "CVE-2020-12641",
+      "CVE-2020-13671",
+      "CVE-2020-13927",
       "CVE-2020-13965",
       "CVE-2020-14644",
+      "CVE-2020-14864",
       "CVE-2020-15069",
       "CVE-2020-15415",
       "CVE-2020-1631",
@@ -1682,6 +1772,7 @@
       "CVE-2020-36193",
       "CVE-2020-5135",
       "CVE-2020-5410",
+      "CVE-2020-5722",
       "CVE-2020-5741",
       "CVE-2020-7247",
       "CVE-2020-7796",
@@ -1690,14 +1781,23 @@
       "CVE-2020-9377",
       "CVE-2021-20028",
       "CVE-2021-20035",
+      "CVE-2021-20038",
       "CVE-2021-20123",
       "CVE-2021-20124",
       "CVE-2021-21311",
+      "CVE-2021-21315",
       "CVE-2021-21973",
+      "CVE-2021-21975",
+      "CVE-2021-22017",
       "CVE-2021-22054",
       "CVE-2021-22175",
       "CVE-2021-22681",
       "CVE-2021-22941",
+      "CVE-2021-22991",
+      "CVE-2021-23758",
+      "CVE-2021-25296",
+      "CVE-2021-25297",
+      "CVE-2021-25298",
       "CVE-2021-26085",
       "CVE-2021-26086",
       "CVE-2021-26828",
@@ -1711,8 +1811,11 @@
       "CVE-2021-31196",
       "CVE-2021-3129",
       "CVE-2021-32030",
+      "CVE-2021-32648",
       "CVE-2021-33044",
       "CVE-2021-33045",
+      "CVE-2021-33766",
+      "CVE-2021-35247",
       "CVE-2021-35587",
       "CVE-2021-36380",
       "CVE-2021-38163",
@@ -1721,6 +1824,7 @@
       "CVE-2021-39935",
       "CVE-2021-40407",
       "CVE-2021-40655",
+      "CVE-2021-40870",
       "CVE-2021-41277",
       "CVE-2021-42237",
       "CVE-2021-43798",
@@ -1745,7 +1849,10 @@
       "CVE-2022-22954",
       "CVE-2022-22963",
       "CVE-2022-22965",
+      "CVE-2022-23131",
+      "CVE-2022-23134",
       "CVE-2022-23227",
+      "CVE-2022-24086",
       "CVE-2022-24112",
       "CVE-2022-24706",
       "CVE-2022-24816",
@@ -1881,6 +1988,7 @@
       "CVE-2023-48365",
       "CVE-2023-48788",
       "CVE-2023-49103",
+      "CVE-2023-49105",
       "CVE-2023-4966",
       "CVE-2023-49897",
       "CVE-2023-50224",
@@ -2184,6 +2292,7 @@
       "CVE-2026-21643",
       "CVE-2026-21858",
       "CVE-2026-21877",
+      "CVE-2026-21962",
       "CVE-2026-22218",
       "CVE-2026-22219",
       "CVE-2026-22252",
@@ -2214,6 +2323,7 @@
       "CVE-2026-32201",
       "CVE-2026-32202",
       "CVE-2026-33017",
+      "CVE-2026-33824",
       "CVE-2026-34159",
       "CVE-2026-34197",
       "CVE-2026-34486",
@@ -2243,21 +2353,29 @@
       "CVE-2026-48939",
       "CVE-2026-50522",
       "CVE-2026-50751",
+      "CVE-2026-55040",
       "CVE-2026-55255",
       "CVE-2026-56164",
       "CVE-2026-56290",
       "CVE-2026-56291",
       "CVE-2026-5760",
       "CVE-2026-58644",
+      "CVE-2026-59310",
+      "CVE-2026-60004",
       "CVE-2026-60137",
       "CVE-2026-63030",
       "CVE-2026-63077",
+      "CVE-2026-64849",
+      "CVE-2026-65400",
       "CVE-2026-6973",
+      "CVE-2026-72529",
+      "CVE-2026-72530",
       "CVE-2026-72898",
       "CVE-2026-73570",
       "CVE-2026-7473",
       "CVE-2026-7482",
       "CVE-2026-8037",
+      "CVE-2026-8452",
       "CVE-2026-9082",
       "CVE-2026-9198",
       "MAL-2025-AI-FOUND-FFMPEG-BIGSLEEP"
@@ -2312,6 +2430,7 @@
     "version": "v19",
     "cve_refs": [
       "CVE-2019-15107",
+      "CVE-2021-21315",
       "CVE-2022-23812",
       "CVE-2025-30066",
       "CVE-2025-30154",
@@ -2342,6 +2461,7 @@
     "name": "Supply Chain Compromise: Software Supply Chain",
     "version": "v19",
     "cve_refs": [
+      "CVE-2018-1000861",
       "CVE-2019-1003030",
       "CVE-2022-30333",
       "CVE-2024-0129",
@@ -2367,6 +2487,8 @@
       "CVE-2026-45321",
       "CVE-2026-5760",
       "CVE-2026-63077",
+      "CVE-2026-66384",
+      "CVE-2026-72530",
       "CVE-2026-8398",
       "MAL-2024-PYPI-ULTRALYTICS-XMRIG",
       "MAL-2025-PYPI-COLORAMA-SOLANA-STEALER",
@@ -2426,6 +2548,7 @@
       "CVE-2007-5659",
       "CVE-2008-0015",
       "CVE-2008-0655",
+      "CVE-2008-2992",
       "CVE-2009-0238",
       "CVE-2009-0556",
       "CVE-2009-0557",
@@ -2433,9 +2556,11 @@
       "CVE-2009-0927",
       "CVE-2009-1537",
       "CVE-2009-1862",
+      "CVE-2009-3129",
       "CVE-2009-3459",
       "CVE-2009-3953",
       "CVE-2009-4324",
+      "CVE-2010-0188",
       "CVE-2010-0249",
       "CVE-2010-0806",
       "CVE-2010-0840",
@@ -2443,16 +2568,25 @@
       "CVE-2010-2568",
       "CVE-2010-2572",
       "CVE-2010-2883",
+      "CVE-2010-3333",
       "CVE-2010-3765",
       "CVE-2010-3962",
       "CVE-2011-0609",
+      "CVE-2011-0611",
+      "CVE-2011-1889",
       "CVE-2011-2462",
       "CVE-2011-3402",
+      "CVE-2011-3544",
+      "CVE-2012-0507",
       "CVE-2012-0754",
+      "CVE-2012-1535",
       "CVE-2012-1710",
+      "CVE-2012-1723",
+      "CVE-2012-1856",
       "CVE-2012-1889",
       "CVE-2012-2034",
       "CVE-2012-2539",
+      "CVE-2012-4681",
       "CVE-2012-4792",
       "CVE-2012-4969",
       "CVE-2012-5054",
@@ -2460,27 +2594,36 @@
       "CVE-2013-0074",
       "CVE-2013-0422",
       "CVE-2013-0431",
+      "CVE-2013-0640",
+      "CVE-2013-0641",
       "CVE-2013-0643",
       "CVE-2013-0648",
       "CVE-2013-1331",
+      "CVE-2013-1347",
       "CVE-2013-1690",
       "CVE-2013-2423",
       "CVE-2013-2465",
       "CVE-2013-2551",
       "CVE-2013-2729",
       "CVE-2013-3163",
+      "CVE-2013-3346",
       "CVE-2013-3893",
       "CVE-2013-3896",
+      "CVE-2013-3897",
+      "CVE-2013-3906",
       "CVE-2013-3918",
       "CVE-2014-0322",
       "CVE-2014-0496",
       "CVE-2014-0497",
       "CVE-2014-0502",
       "CVE-2014-0546",
+      "CVE-2014-1761",
+      "CVE-2014-1776",
       "CVE-2014-4114",
       "CVE-2014-4123",
       "CVE-2014-4148",
       "CVE-2014-6332",
+      "CVE-2014-6352",
       "CVE-2014-8439",
       "CVE-2014-9163",
       "CVE-2015-0016",
@@ -2528,22 +2671,30 @@
       "CVE-2017-0037",
       "CVE-2017-0059",
       "CVE-2017-0149",
+      "CVE-2017-0222",
       "CVE-2017-0261",
+      "CVE-2017-0262",
+      "CVE-2017-0263",
       "CVE-2017-11292",
       "CVE-2017-11826",
       "CVE-2017-5030",
       "CVE-2017-5070",
       "CVE-2017-8291",
+      "CVE-2017-8464",
       "CVE-2017-8540",
+      "CVE-2017-8570",
       "CVE-2018-0824",
+      "CVE-2018-15982",
       "CVE-2018-17463",
       "CVE-2018-17480",
       "CVE-2018-4990",
       "CVE-2018-5002",
       "CVE-2018-6065",
       "CVE-2018-8120",
+      "CVE-2018-8174",
       "CVE-2018-8298",
       "CVE-2018-8373",
+      "CVE-2019-0752",
       "CVE-2019-0880",
       "CVE-2019-0903",
       "CVE-2019-11707",
@@ -2565,9 +2716,11 @@
       "CVE-2021-30952",
       "CVE-2021-38406",
       "CVE-2021-38646",
+      "CVE-2022-0609",
       "CVE-2022-1096",
       "CVE-2022-1364",
       "CVE-2022-21971",
+      "CVE-2022-22620",
       "CVE-2022-22675",
       "CVE-2022-2294",
       "CVE-2022-26485",
@@ -2706,6 +2859,7 @@
     "name": "Exploitation for Credential Access",
     "version": "v19",
     "cve_refs": [
+      "CVE-2013-1675",
       "CVE-2014-6324",
       "CVE-2018-13374",
       "CVE-2023-23397",
@@ -2756,9 +2910,12 @@
     "cve_refs": [
       "CVE-2015-5317",
       "CVE-2016-2386",
+      "CVE-2020-11978",
+      "CVE-2021-21975",
       "CVE-2021-39226",
       "CVE-2021-44026",
       "CVE-2023-35078",
+      "CVE-2023-49105",
       "CVE-2024-12450",
       "CVE-2026-20133",
       "CVE-2026-20316",
@@ -2775,6 +2932,7 @@
     "cve_refs": [
       "CVE-2021-39226",
       "CVE-2022-23812",
+      "CVE-2023-49105",
       "MAL-2026-SHAI-HULUD-OSS"
     ],
     "description_full": "Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as <code>del</code> and <code>rm</code> often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure. Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017) To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018). In cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers.(Citation: Data Destruction - Threat Post)(Citation: DOJ - Cisco Insider) Similarly, they may delete virtual machines from on-prem virtualized environments.",
@@ -2817,19 +2975,30 @@
     "last_verified": "2026-05-19",
     "description": "Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.",
     "cve_refs": [
+      "CVE-2010-0188",
       "CVE-2010-0738",
       "CVE-2010-1428",
       "CVE-2016-0034",
       "CVE-2016-1019",
+      "CVE-2017-0144",
+      "CVE-2017-0145",
       "CVE-2017-0148",
+      "CVE-2017-10271",
       "CVE-2017-18362",
       "CVE-2018-19949",
+      "CVE-2018-20250",
       "CVE-2018-7602",
       "CVE-2018-8405",
+      "CVE-2018-8453",
+      "CVE-2019-0752",
       "CVE-2019-7194",
       "CVE-2019-7195",
       "CVE-2020-0638",
+      "CVE-2020-0787",
+      "CVE-2020-0796",
       "CVE-2020-2509",
+      "CVE-2021-20038",
+      "CVE-2021-21975",
       "CVE-2021-28799",
       "CVE-2022-24990",
       "CVE-2022-26500",
@@ -2994,6 +3163,9 @@
     "tactic": [
       "Privilege Escalation",
       "Persistence"
+    ],
+    "cve_refs": [
+      "CVE-2026-60004"
     ]
   },
   "T1547": {
@@ -3022,6 +3194,7 @@
     "cve_refs": [
       "CVE-2010-4345",
       "CVE-2011-1823",
+      "CVE-2015-3246",
       "CVE-2017-15944",
       "CVE-2026-31431",
       "CVE-2026-31635",
@@ -3070,6 +3243,8 @@
       "CVE-2018-15133",
       "CVE-2019-1003029",
       "CVE-2019-5418",
+      "CVE-2020-13927",
+      "CVE-2021-21975",
       "CVE-2021-22681",
       "CVE-2021-40655",
       "CVE-2021-43798",
@@ -3143,17 +3318,21 @@
       "CVE-2009-3960",
       "CVE-2010-2861",
       "CVE-2011-4723",
+      "CVE-2012-0391",
       "CVE-2014-0130",
       "CVE-2014-0780",
       "CVE-2015-0666",
       "CVE-2015-3035",
       "CVE-2015-4495",
       "CVE-2016-0752",
+      "CVE-2017-9841",
       "CVE-2018-0147",
       "CVE-2018-18809",
       "CVE-2018-5430",
       "CVE-2019-1003030",
       "CVE-2019-1652",
+      "CVE-2020-11978",
+      "CVE-2020-14864",
       "CVE-2020-1631",
       "CVE-2020-1938",
       "CVE-2023-22952",
@@ -3161,7 +3340,10 @@
       "CVE-2024-6587",
       "CVE-2025-21085",
       "CVE-2026-0770",
+      "CVE-2026-21962",
       "CVE-2026-30615",
+      "CVE-2026-60004",
+      "CVE-2026-8452",
       "MAL-2026-3083",
       "MAL-2026-MOIKA-DEPCONFUSION",
       "MAL-2026-NODE-IPC-STEALER",
@@ -3224,7 +3406,8 @@
       "Credential Access"
     ],
     "cve_refs": [
-      "CVE-2026-0770"
+      "CVE-2026-0770",
+      "CVE-2026-64849"
     ]
   },
   "T1552.007": {
@@ -3323,6 +3506,7 @@
       "CVE-2016-6366",
       "CVE-2018-0147",
       "CVE-2021-35587",
+      "CVE-2022-23134",
       "CVE-2023-20867",
       "CVE-2024-12776",
       "CVE-2025-24472"
@@ -3427,19 +3611,32 @@
     "cve_refs": [
       "CVE-2006-2492",
       "CVE-2007-5659",
+      "CVE-2008-2992",
       "CVE-2009-0557",
       "CVE-2009-0563",
       "CVE-2009-0927",
+      "CVE-2009-3129",
       "CVE-2009-3953",
       "CVE-2009-4324",
+      "CVE-2010-0188",
       "CVE-2010-2572",
       "CVE-2010-2883",
+      "CVE-2010-3333",
       "CVE-2011-0609",
+      "CVE-2011-0611",
       "CVE-2011-2462",
       "CVE-2012-0754",
+      "CVE-2012-1535",
+      "CVE-2012-1856",
       "CVE-2012-2539",
+      "CVE-2013-0640",
+      "CVE-2013-0641",
       "CVE-2013-1331",
+      "CVE-2013-3346",
+      "CVE-2013-3906",
       "CVE-2014-0496",
+      "CVE-2014-1761",
+      "CVE-2014-6352",
       "CVE-2015-1642",
       "CVE-2015-1770",
       "CVE-2015-2424",
@@ -3448,8 +3645,14 @@
       "CVE-2016-7193",
       "CVE-2016-7262",
       "CVE-2017-0261",
+      "CVE-2017-0262",
+      "CVE-2017-0263",
       "CVE-2017-8540",
+      "CVE-2017-8570",
+      "CVE-2018-15982",
+      "CVE-2018-20250",
       "CVE-2018-4990",
+      "CVE-2018-8174",
       "CVE-2018-8373",
       "CVE-2018-8414",
       "CVE-2019-0903",
@@ -3487,7 +3690,11 @@
     "cve_refs": [
       "CVE-2012-0518",
       "CVE-2012-0767",
+      "CVE-2013-3897",
+      "CVE-2014-1776",
       "CVE-2015-3113",
+      "CVE-2022-0609",
+      "CVE-2022-24682",
       "CVE-2023-37580"
     ]
   },
@@ -3571,6 +3778,10 @@
     "description": "Adversaries may transfer tools or other files between systems in a compromised environment.",
     "tactic": [
       "Lateral Movement"
+    ],
+    "cve_refs": [
+      "CVE-2017-0144",
+      "CVE-2017-0145"
     ]
   },
   "T1573": {
@@ -3696,6 +3907,9 @@
     "description": "Adversaries may forge web cookies that can be used to gain access to web applications or Internet services.",
     "tactic": [
       "Credential Access"
+    ],
+    "cve_refs": [
+      "CVE-2022-23131"
     ]
   },
   "T1606.002": {
@@ -3753,6 +3967,7 @@
       "CVE-2016-5195",
       "CVE-2021-22600",
       "CVE-2022-0492",
+      "CVE-2022-0995",
       "CVE-2024-0132",
       "CVE-2024-21626",
       "CVE-2024-3154",
@@ -3760,7 +3975,8 @@
       "CVE-2025-22225",
       "CVE-2025-22226",
       "CVE-2025-23266",
-      "CVE-2025-38352"
+      "CVE-2025-38352",
+      "CVE-2026-53362"
     ],
     "description_full": "Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment.(Citation: Docker Overview) There are multiple ways an adversary may escape from a container to a host environment. Examples include creating a container configured to mount the host’s filesystem using the bind parameter, which allows the adversary to drop payloads and execute control utilities such as cron on the host; utilizing a privileged container to run commands or load a malicious kernel module on the underlying host; or abusing system calls such as `unshare` and `keyctl` to escalate privileges and steal secrets.(Citation: Docker Bind Mounts)(Citation: Trend Micro Privileged Container)(Citation: Intezer Doki July 20)(Citation: Container Escape)(Citation: Crowdstrike Kubernetes Container Escape)(Citation: Keyctl-unmask) Additionally, an adversary may be able to exploit a compromised container with a mounted container management socket, such as `docker.sock`, to break out of the container via a [Container Administration Command](https://attack.mitre.org/techniques/T1609).(Citation: Container Escape) Adversaries may also escape via [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), such as exploiting vulnerabilities in global symbolic links in order to access the root directory of a host machine.(Citation: Windows Server Containers Are Open) In ESXi environments, an adversary may exploit a vulnerability in order to escape from a virtual machine into the hypervisor.(Citation: Broadcom VMSA-2025-004) Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, accessing other containers or virtual machines running on the host, or setting up a command and control channel on the host.",
     "platforms": [
@@ -4036,7 +4252,8 @@
       "Discovery"
     ],
     "cve_refs": [
-      "CVE-2023-22952"
+      "CVE-2023-22952",
+      "CVE-2026-64849"
     ]
   },
   "T1538": {
@@ -4118,6 +4335,7 @@
       "CVE-2019-2616",
       "CVE-2019-3568",
       "CVE-2019-7287",
+      "CVE-2020-14864",
       "CVE-2020-1631",
       "CVE-2020-2509",
       "CVE-2020-9934",
@@ -4172,26 +4390,37 @@
       "CVE-2007-5659",
       "CVE-2008-0655",
       "CVE-2009-1862",
+      "CVE-2010-0188",
       "CVE-2010-0840",
       "CVE-2010-1297",
+      "CVE-2011-0611",
+      "CVE-2011-3544",
+      "CVE-2012-0507",
       "CVE-2012-0767",
       "CVE-2012-1710",
+      "CVE-2012-1723",
+      "CVE-2012-1856",
       "CVE-2012-1889",
       "CVE-2012-2034",
+      "CVE-2012-4681",
       "CVE-2012-4969",
       "CVE-2012-5054",
       "CVE-2012-5076",
       "CVE-2013-0074",
       "CVE-2013-0422",
       "CVE-2013-0431",
+      "CVE-2013-1347",
+      "CVE-2013-1675",
       "CVE-2013-1690",
       "CVE-2013-2423",
       "CVE-2013-2465",
       "CVE-2013-2551",
       "CVE-2013-3163",
       "CVE-2013-3896",
+      "CVE-2013-3897",
       "CVE-2013-7331",
       "CVE-2014-0322",
+      "CVE-2014-1776",
       "CVE-2014-2817",
       "CVE-2014-4123",
       "CVE-2014-4148",
@@ -4242,14 +4471,18 @@
       "CVE-2017-0059",
       "CVE-2017-0149",
       "CVE-2017-0210",
+      "CVE-2017-0222",
       "CVE-2017-5030",
       "CVE-2017-5070",
+      "CVE-2018-15982",
       "CVE-2018-17463",
       "CVE-2018-17480",
       "CVE-2018-6065",
+      "CVE-2018-8174",
       "CVE-2018-8298",
       "CVE-2018-8373",
       "CVE-2019-0676",
+      "CVE-2019-0752",
       "CVE-2019-13720",
       "CVE-2019-5786",
       "CVE-2019-5825",
@@ -4259,8 +4492,10 @@
       "CVE-2021-0920",
       "CVE-2021-1789",
       "CVE-2021-30533",
+      "CVE-2022-0609",
       "CVE-2022-1096",
       "CVE-2022-1364",
+      "CVE-2022-22620",
       "CVE-2022-2294",
       "CVE-2022-26485",
       "CVE-2022-2856",
@@ -4343,6 +4578,7 @@
     "cve_refs": [
       "CVE-2009-2055",
       "CVE-2010-3035",
+      "CVE-2015-2051",
       "CVE-2021-27137",
       "CVE-2021-45382",
       "CVE-2022-26143",
@@ -4421,6 +4657,7 @@
     "cve_refs": [
       "CVE-2013-5223",
       "CVE-2022-22536",
+      "CVE-2022-24682",
       "CVE-2023-34192",
       "CVE-2023-6571",
       "CVE-2024-11182",
@@ -4451,6 +4688,7 @@
     "name": "Financial Theft",
     "version": "v19",
     "cve_refs": [
+      "CVE-2022-24086",
       "MAL-2025-PYPI-COLORAMA-SOLANA-STEALER"
     ],
     "description_full": "Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware,(Citation: FBI-ransomware) business email compromise (BEC) and fraud,(Citation: FBI-BEC) \"pig butchering,\"(Citation: wired-pig butchering) bank hacking,(Citation: DOJ-DPRK Heist) and exploiting cryptocurrency networks.(Citation: BBC-Ronin) Adversaries may [Compromise Accounts](https://attack.mitre.org/techniques/T1586) to conduct unauthorized transfers of funds.(Citation: Internet crime report 2022) In the case of business email compromise or email fraud, an adversary may utilize [Impersonation](https://attack.mitre.org/techniques/T1684/001) of a trusted entity. Once the social engineering is successful, victims can be deceived into sending money to financial accounts controlled by an adversary.(Citation: FBI-BEC) This creates the potential for multiple victims (i.e., compromised accounts as well as the ultimate monetary loss) in incidents involving financial theft.(Citation: VEC) Extortion by ransomware may occur, for example, when an adversary demands payment from a victim after [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) (Citation: NYT-Colonial) and [Exfiltration](https://attack.mitre.org/tactics/TA0010) of data, followed by threatening to leak sensitive data to the public unless payment is made to the adversary.(Citation: Mandiant-leaks) Adversaries may use dedicated leak sites to distribute victim data.(Citation: Crowdstrike-leaks) Due to the potentially immense business impact of financial theft, an adversary may abuse the possibility of financial theft and seeking monetary gain to divert attention from their true goals such as [Data Destruction](https://attack.mitre.org/techniques/T1485) and business disruption.(Citation: AP-NotPetya)",
@@ -4483,7 +4721,9 @@
     "description": "Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premises servers) often use session cookies, tokens, or other materials to authenticate and authorize user access. In the context of YellowKey, the BitLocker key-inheritance class is a sibling pattern: the attacker does not extract the credential, they inherit a context where the credential is already in scope — the forgery is contextual rather than cryptographic.",
     "last_verified": "2026-05-19",
     "notes": "Added v0.13.17 to support BUG-2026-NIGHTMARE-ECLIPSE-YELLOWKEY attack_refs. Used as a near-fit for the BitLocker-inheritance class; tighter ATT&CK technique may be assigned when Microsoft publishes an advisory naming the specific boot-flow defect.",
-    "cve_refs": [],
+    "cve_refs": [
+      "CVE-2026-55040"
+    ],
     "description_full": "Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access. Adversaries may generate these credential materials in order to gain access to web resources. This differs from [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539), [Steal Application Access Token](https://attack.mitre.org/techniques/T1528), and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users. The generation of web credentials often requires secret values, such as passwords, [Private Keys](https://attack.mitre.org/techniques/T1552/004), or other cryptographic seed values.(Citation: GitHub AWS-ADFS-Credential-Generator) Adversaries may also forge tokens by taking advantage of features such as the `AssumeRole` and `GetFederationToken` APIs in AWS, which allow users to request temporary security credentials (i.e., [Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005)), or the `zmprov gdpak` command in Zimbra, which generates a pre-authentication key that can be used to generate tokens for any user in the domain.(Citation: AWS Temporary Security Credentials)(Citation: Zimbra Preauth) Once forged, adversaries may use these web credentials to access resources (ex: [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550)), which may bypass multi-factor and other authentication protection mechanisms.(Citation: Pass The Cookie)(Citation: Unit 42 Mac Crypto Cookies January 2019)(Citation: Microsoft SolarWinds Customer Guidance)",
     "platforms": [
       "SaaS",
@@ -4508,6 +4748,7 @@
     "last_verified": "2026-05-19",
     "notes": "Added v0.13.17 to support information-disclosure KEV imports' attack_refs. Per-CVE refinement may reroute to T1083 (File and Directory Discovery), T1005 (Data from Local System), or T1071 depending on the vector.",
     "cve_refs": [
+      "CVE-2013-1347",
       "CVE-2019-5418",
       "CVE-2019-9621",
       "CVE-2020-7796",
@@ -4568,9 +4809,11 @@
       "CVE-2017-6627",
       "CVE-2017-6740",
       "CVE-2018-0125",
+      "CVE-2019-1068",
       "CVE-2019-16928",
       "CVE-2020-11899",
       "CVE-2021-25489",
+      "CVE-2022-0995",
       "CVE-2023-20109",
       "CVE-2023-29552",
       "CVE-2023-33009",
@@ -4672,6 +4915,7 @@
     "stix_id": "attack-pattern--0c8ab3eb-df48-4b9c-ace7-beacaac81cc5",
     "is_subtechnique": false,
     "cve_refs": [
+      "CVE-2021-36934",
       "CVE-2024-53150",
       "CVE-2025-24984",
       "CVE-2025-24991"
@@ -4802,6 +5046,7 @@
     "stix_id": "attack-pattern--0f20e3cb-245b-4a61-8a91-2d93f7cb0e9b",
     "is_subtechnique": false,
     "cve_refs": [
+      "CVE-2009-1123",
       "CVE-2015-2291",
       "CVE-2018-19320",
       "CVE-2018-19323",
@@ -5059,9 +5304,11 @@
     "is_subtechnique": false,
     "cve_refs": [
       "CVE-2015-1427",
+      "CVE-2017-0144",
       "CVE-2017-0147",
       "CVE-2017-12233",
       "CVE-2017-12234",
+      "CVE-2017-5689",
       "CVE-2017-6743",
       "CVE-2017-6862",
       "CVE-2018-0156",
@@ -5291,7 +5538,8 @@
     "is_subtechnique": false,
     "cve_refs": [
       "CVE-2022-22960",
-      "CVE-2022-42475"
+      "CVE-2022-42475",
+      "CVE-2026-65400"
     ]
   },
   "T1072": {
@@ -5443,6 +5691,7 @@
       "CVE-2019-7194",
       "CVE-2019-7195",
       "CVE-2019-7483",
+      "CVE-2020-14864",
       "CVE-2020-17519",
       "CVE-2020-5410",
       "CVE-2021-20123",
@@ -5563,7 +5812,8 @@
     "is_subtechnique": false,
     "cve_refs": [
       "CVE-2010-2568",
-      "CVE-2015-1769"
+      "CVE-2015-1769",
+      "CVE-2017-8464"
     ]
   },
   "T1092": {
@@ -5655,11 +5905,18 @@
     "stix_id": "attack-pattern--e6919abc-99f9-4c6c-95a5-14761e7b2add",
     "is_subtechnique": false,
     "cve_refs": [
+      "CVE-2010-3333",
+      "CVE-2012-0391",
+      "CVE-2012-1723",
       "CVE-2014-0502",
+      "CVE-2014-1761",
       "CVE-2014-4114",
       "CVE-2015-1187",
+      "CVE-2015-2051",
       "CVE-2015-2502",
       "CVE-2017-11357",
+      "CVE-2017-9791",
+      "CVE-2021-23758",
       "CVE-2022-21587",
       "CVE-2022-22954",
       "CVE-2022-22963",
@@ -6023,6 +6280,7 @@
     "stix_id": "attack-pattern--dcaa092b-7de9-4a21-977f-7fcb77e89c48",
     "is_subtechnique": false,
     "cve_refs": [
+      "CVE-2002-0367",
       "CVE-2016-0151",
       "CVE-2017-0005",
       "CVE-2019-0543",
@@ -6419,11 +6677,14 @@
       "CVE-2008-4250",
       "CVE-2016-3427",
       "CVE-2016-8735",
+      "CVE-2017-0144",
+      "CVE-2017-0145",
       "CVE-2017-0146",
       "CVE-2017-0147",
       "CVE-2017-0148",
       "CVE-2017-12240",
       "CVE-2017-3881",
+      "CVE-2017-5689",
       "CVE-2017-6736",
       "CVE-2017-6737",
       "CVE-2017-6738",
@@ -6440,6 +6701,8 @@
       "CVE-2018-0175",
       "CVE-2018-7445",
       "CVE-2019-0703",
+      "CVE-2019-1068",
+      "CVE-2020-0796",
       "CVE-2021-20028",
       "CVE-2021-27137",
       "CVE-2021-27877",
@@ -6480,6 +6743,8 @@
     "stix_id": "attack-pattern--fe926152-f431-4baf-956c-4ad3cb0bf23b",
     "is_subtechnique": false,
     "cve_refs": [
+      "CVE-2012-1723",
+      "CVE-2012-4681",
       "CVE-2012-5076",
       "CVE-2013-0422",
       "CVE-2013-0431",
@@ -6495,6 +6760,7 @@
       "CVE-2019-11708",
       "CVE-2019-7286",
       "CVE-2021-21551",
+      "CVE-2021-22017",
       "CVE-2021-25369",
       "CVE-2021-25370",
       "CVE-2021-30883",
@@ -6890,7 +7156,10 @@
       "SaaS"
     ],
     "stix_id": "attack-pattern--e24fcba8-2557-4442-a139-1ee2f2e784db",
-    "is_subtechnique": false
+    "is_subtechnique": false,
+    "cve_refs": [
+      "CVE-2026-64849"
+    ]
   },
   "T1529": {
     "id": "T1529",
@@ -7017,7 +7286,8 @@
     "_auto_imported": true,
     "_intake_method": "v0.13.18-bulk-mitre-attack-stix",
     "cve_refs": [
-      "BUG-2026-NIGHTMARE-ECLIPSE-YELLOWKEY"
+      "BUG-2026-NIGHTMARE-ECLIPSE-YELLOWKEY",
+      "CVE-2017-5689"
     ],
     "description_full": "Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting) Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.",
     "platforms": [
@@ -7053,6 +7323,7 @@
     "stix_id": "attack-pattern--67720091-eee3-4d2d-ae16-8264567f6f5b",
     "is_subtechnique": false,
     "cve_refs": [
+      "CVE-2015-1130",
       "CVE-2019-1405",
       "CVE-2021-3560",
       "CVE-2021-4034",
@@ -7321,7 +7592,8 @@
     "is_subtechnique": false,
     "cve_refs": [
       "CVE-2022-47966",
-      "CVE-2026-18577"
+      "CVE-2026-18577",
+      "CVE-2026-59310"
     ]
   },
   "T1578": {
@@ -7479,7 +7751,8 @@
     "stix_id": "attack-pattern--5282dd9a-d26d-4e16-88b7-7c0f4553daf4",
     "is_subtechnique": false,
     "cve_refs": [
-      "CVE-2016-2388"
+      "CVE-2016-2388",
+      "CVE-2023-49105"
     ]
   },
   "T1590": {
@@ -8719,7 +8992,10 @@
     "stix_id": "attack-pattern--1644e709-12d2-41e5-a60f-3470991f5011",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-attack-stix"
+    "_intake_method": "mitre-attack-stix",
+    "cve_refs": [
+      "CVE-2021-36934"
+    ]
   },
   "T1003.003": {
     "id": "T1003.003",
@@ -8769,7 +9045,10 @@
     "stix_id": "attack-pattern--1ecfdab8-7d59-4c98-95d4-dc41970f57fc",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-attack-stix"
+    "_intake_method": "mitre-attack-stix",
+    "cve_refs": [
+      "CVE-2021-36934"
+    ]
   },
   "T1003.005": {
     "id": "T1003.005",
@@ -9034,9 +9313,11 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2017-0144",
       "CVE-2017-0146",
       "CVE-2017-0147",
-      "CVE-2017-8543"
+      "CVE-2017-8543",
+      "CVE-2020-0796"
     ]
   },
   "T1021.003": {
@@ -9091,7 +9372,8 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
-      "CVE-2021-28799"
+      "CVE-2021-28799",
+      "CVE-2026-59310"
     ]
   },
   "T1021.005": {
@@ -9119,7 +9401,10 @@
     "stix_id": "attack-pattern--01327cde-66c4-4123-bf34-5f258d59457b",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-attack-stix"
+    "_intake_method": "mitre-attack-stix",
+    "cve_refs": [
+      "CVE-2026-65400"
+    ]
   },
   "T1021.006": {
     "id": "T1021.006",
@@ -9821,7 +10106,10 @@
     "stix_id": "attack-pattern--1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-attack-stix"
+    "_intake_method": "mitre-attack-stix",
+    "cve_refs": [
+      "CVE-2009-3129"
+    ]
   },
   "T1036.006": {
     "id": "T1036.006",
@@ -9901,7 +10189,8 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
-      "CVE-2017-11357"
+      "CVE-2017-11357",
+      "CVE-2020-13671"
     ]
   },
   "T1036.009": {
@@ -10856,6 +11145,7 @@
       "CVE-2018-8414",
       "CVE-2019-10068",
       "CVE-2021-22941",
+      "CVE-2021-23758",
       "CVE-2021-27852",
       "CVE-2021-42237",
       "CVE-2022-28810"
@@ -10895,16 +11185,22 @@
       "CVE-2010-4344",
       "CVE-2010-4345",
       "CVE-2010-5330",
+      "CVE-2012-0391",
       "CVE-2012-1823",
+      "CVE-2014-6271",
+      "CVE-2014-7169",
       "CVE-2015-1187",
       "CVE-2015-1427",
+      "CVE-2015-2051",
       "CVE-2016-10174",
       "CVE-2016-11021",
       "CVE-2016-1555",
       "CVE-2016-6277",
+      "CVE-2017-10271",
       "CVE-2017-15944",
       "CVE-2017-6077",
       "CVE-2017-8291",
+      "CVE-2017-9791",
       "CVE-2018-0125",
       "CVE-2018-0147",
       "CVE-2018-10562",
@@ -10926,12 +11222,19 @@
       "CVE-2019-16928",
       "CVE-2019-3929",
       "CVE-2019-6340",
+      "CVE-2020-11978",
       "CVE-2020-1956",
       "CVE-2020-2509",
       "CVE-2020-25223",
+      "CVE-2020-5722",
       "CVE-2020-7247",
       "CVE-2020-9054",
       "CVE-2020-9377",
+      "CVE-2021-20038",
+      "CVE-2021-21315",
+      "CVE-2021-25296",
+      "CVE-2021-25297",
+      "CVE-2021-25298",
       "CVE-2021-41379",
       "CVE-2021-45382",
       "CVE-2022-0543",
@@ -10944,6 +11247,7 @@
       "CVE-2022-22954",
       "CVE-2022-22963",
       "CVE-2022-22965",
+      "CVE-2022-24086",
       "CVE-2022-24112",
       "CVE-2022-24990",
       "CVE-2022-26258",
@@ -10959,8 +11263,10 @@
       "CVE-2022-44877",
       "CVE-2022-46169",
       "CVE-2026-34486",
+      "CVE-2026-60004",
       "CVE-2026-73570",
-      "CVE-2026-8037"
+      "CVE-2026-8037",
+      "CVE-2026-8452"
     ]
   },
   "T1059.005": {
@@ -10991,7 +11297,9 @@
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
       "CVE-2014-6332",
+      "CVE-2018-8174",
       "CVE-2018-8373",
+      "CVE-2019-0752",
       "CVE-2023-21715"
     ]
   },
@@ -11459,6 +11767,9 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2013-0640",
+      "CVE-2013-1347",
+      "CVE-2017-0262",
       "CVE-2022-23176",
       "MAL-2026-MOIKA-DEPCONFUSION"
     ]
@@ -11891,7 +12202,10 @@
     "stix_id": "attack-pattern--e74de37c-a829-446c-937d-56a44f0e9306",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-attack-stix"
+    "_intake_method": "mitre-attack-stix",
+    "cve_refs": [
+      "CVE-2021-33766"
+    ]
   },
   "T1098.004": {
     "id": "T1098.004",
@@ -11924,7 +12238,8 @@
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
       "CVE-2022-30333",
-      "CVE-2022-40684"
+      "CVE-2022-40684",
+      "CVE-2026-65400"
     ]
   },
   "T1098.005": {
@@ -12034,7 +12349,10 @@
     "stix_id": "attack-pattern--f7827069-0bf2-4764-af4f-23fae0d181b7",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-attack-stix"
+    "_intake_method": "mitre-attack-stix",
+    "cve_refs": [
+      "CVE-2013-0640"
+    ]
   },
   "T1102.002": {
     "id": "T1102.002",
@@ -12241,7 +12559,9 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
-      "CVE-2018-8581"
+      "CVE-2018-8581",
+      "CVE-2021-33766",
+      "CVE-2022-24682"
     ]
   },
   "T1114.003": {
@@ -12270,7 +12590,10 @@
     "stix_id": "attack-pattern--7d77a07d-02fe-4e88-8bd9-e9c008c01bf0",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-attack-stix"
+    "_intake_method": "mitre-attack-stix",
+    "cve_refs": [
+      "CVE-2021-33766"
+    ]
   },
   "T1127.001": {
     "id": "T1127.001",
@@ -12436,6 +12759,8 @@
       "CVE-2016-0040",
       "CVE-2016-0099",
       "CVE-2016-0151",
+      "CVE-2017-0263",
+      "CVE-2022-21882",
       "CVE-2022-24521",
       "CVE-2022-37969",
       "CVE-2023-23376"
@@ -12841,10 +13166,12 @@
     "cve_refs": [
       "CVE-2012-0518",
       "CVE-2012-1710",
+      "CVE-2012-4681",
       "CVE-2012-4969",
       "CVE-2012-5054",
       "CVE-2013-0074",
       "CVE-2013-0422",
+      "CVE-2014-1776",
       "CVE-2016-0984",
       "CVE-2016-1010",
       "CVE-2016-4171",
@@ -12852,6 +13179,7 @@
       "CVE-2016-7256",
       "CVE-2017-0037",
       "CVE-2017-0210",
+      "CVE-2017-0222",
       "CVE-2017-5030",
       "CVE-2017-5070",
       "CVE-2019-0676",
@@ -12896,27 +13224,40 @@
       "CVE-2006-2492",
       "CVE-2007-5659",
       "CVE-2008-0655",
+      "CVE-2008-2992",
       "CVE-2009-0557",
       "CVE-2009-0563",
       "CVE-2009-0927",
       "CVE-2009-1862",
+      "CVE-2009-3129",
       "CVE-2009-3953",
       "CVE-2009-4324",
+      "CVE-2010-0188",
       "CVE-2010-1297",
       "CVE-2010-2572",
       "CVE-2010-2883",
+      "CVE-2010-3333",
       "CVE-2011-0609",
       "CVE-2011-2462",
       "CVE-2012-0151",
       "CVE-2012-0754",
+      "CVE-2012-1535",
+      "CVE-2012-1856",
+      "CVE-2013-0640",
+      "CVE-2013-0641",
       "CVE-2013-1331",
       "CVE-2013-2729",
+      "CVE-2013-3346",
+      "CVE-2013-3906",
       "CVE-2013-6282",
       "CVE-2014-0496",
       "CVE-2014-0546",
+      "CVE-2014-1761",
       "CVE-2014-4077",
       "CVE-2014-4114",
       "CVE-2014-4148",
+      "CVE-2014-4404",
+      "CVE-2014-6352",
       "CVE-2015-1642",
       "CVE-2015-1671",
       "CVE-2015-1770",
@@ -12931,12 +13272,18 @@
       "CVE-2016-7262",
       "CVE-2017-0101",
       "CVE-2017-0261",
+      "CVE-2017-0262",
+      "CVE-2017-0263",
       "CVE-2017-11292",
       "CVE-2017-11826",
+      "CVE-2017-8570",
+      "CVE-2018-15982",
+      "CVE-2018-20250",
       "CVE-2018-4344",
       "CVE-2018-4990",
       "CVE-2018-5002",
       "CVE-2018-8120",
+      "CVE-2018-8174",
       "CVE-2018-8414",
       "CVE-2019-1297",
       "CVE-2019-8605",
@@ -12947,6 +13294,7 @@
       "CVE-2021-38406",
       "CVE-2021-38646",
       "CVE-2022-21971",
+      "CVE-2022-22587",
       "CVE-2022-23748",
       "CVE-2022-30190",
       "CVE-2022-34713",
@@ -13154,7 +13502,10 @@
     "stix_id": "attack-pattern--0c4b4fda-9062-47da-98b9-ceae2dcf052a",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-attack-stix"
+    "_intake_method": "mitre-attack-stix",
+    "cve_refs": [
+      "CVE-2026-55040"
+    ]
   },
   "T1213.003": {
     "id": "T1213.003",
@@ -13805,6 +14156,7 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2015-5287",
       "CVE-2022-22960"
     ]
   },
@@ -13970,7 +14322,10 @@
     "stix_id": "attack-pattern--0cfe31a7-81fc-472c-bc45-e2808d1066a3",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-attack-stix"
+    "_intake_method": "mitre-attack-stix",
+    "cve_refs": [
+      "CVE-2021-32648"
+    ]
   },
   "T1496.001": {
     "id": "T1496.001",
@@ -14001,7 +14356,10 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
-      "CVE-2022-24706"
+      "CVE-2017-10271",
+      "CVE-2021-25296",
+      "CVE-2022-24706",
+      "CVE-2026-65400"
     ]
   },
   "T1496.002": {
@@ -14289,8 +14647,10 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2006-1547",
       "CVE-2009-2055",
       "CVE-2010-3035",
+      "CVE-2015-1635",
       "CVE-2016-4523",
       "CVE-2017-12231",
       "CVE-2017-12232",
@@ -14318,6 +14678,7 @@
       "CVE-2018-0179",
       "CVE-2018-0180",
       "CVE-2020-5135",
+      "CVE-2021-22991",
       "CVE-2021-31166",
       "CVE-2026-20349"
     ]
@@ -14405,32 +14766,41 @@
       "CVE-2009-1151",
       "CVE-2010-0738",
       "CVE-2010-1428",
+      "CVE-2012-0391",
       "CVE-2012-1823",
+      "CVE-2013-0632",
       "CVE-2013-4810",
       "CVE-2014-2120",
+      "CVE-2016-3088",
+      "CVE-2017-10271",
       "CVE-2017-11317",
       "CVE-2017-11357",
       "CVE-2017-12615",
       "CVE-2017-12617",
       "CVE-2017-15944",
+      "CVE-2017-9841",
       "CVE-2018-4063",
       "CVE-2018-7602",
       "CVE-2018-7841",
       "CVE-2019-10068",
       "CVE-2019-6340",
+      "CVE-2020-13671",
       "CVE-2020-14644",
       "CVE-2020-1938",
       "CVE-2020-28949",
       "CVE-2020-36193",
       "CVE-2021-22941",
+      "CVE-2021-23758",
       "CVE-2021-26828",
       "CVE-2021-31196",
       "CVE-2021-38163",
+      "CVE-2021-40870",
       "CVE-2022-1040",
       "CVE-2022-21587",
       "CVE-2022-22947",
       "CVE-2022-22954",
       "CVE-2022-22965",
+      "CVE-2022-24086",
       "CVE-2022-26134",
       "CVE-2022-26352",
       "CVE-2022-26871",
@@ -14493,7 +14863,9 @@
       "CVE-2026-58644",
       "CVE-2026-63030",
       "CVE-2026-63077",
-      "CVE-2026-73570"
+      "CVE-2026-72530",
+      "CVE-2026-73570",
+      "CVE-2026-8452"
     ]
   },
   "T1505.004": {
@@ -14859,7 +15231,9 @@
       "CVE-2019-1322",
       "CVE-2021-21551",
       "CVE-2022-2294",
-      "CVE-2026-18577"
+      "CVE-2026-18577",
+      "CVE-2026-72529",
+      "CVE-2026-72530"
     ]
   },
   "T1543.004": {
@@ -14886,7 +15260,10 @@
     "stix_id": "attack-pattern--573ad264-1371-4ae0-8482-d2673b719dba",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-attack-stix"
+    "_intake_method": "mitre-attack-stix",
+    "cve_refs": [
+      "CVE-2026-65400"
+    ]
   },
   "T1543.005": {
     "id": "T1543.005",
@@ -15306,7 +15683,8 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
-      "CVE-2022-2294"
+      "CVE-2022-2294",
+      "CVE-2026-72529"
     ]
   },
   "T1546.016": {
@@ -15417,6 +15795,8 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2013-0641",
+      "CVE-2018-20250",
       "CVE-2018-8589",
       "CVE-2022-34713",
       "CVE-2025-6218",
@@ -15554,6 +15934,8 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2008-3431",
+      "CVE-2015-5287",
       "CVE-2018-19320",
       "CVE-2018-19321",
       "CVE-2018-19322",
@@ -15637,7 +16019,10 @@
     "stix_id": "attack-pattern--4ab929c6-ee2d-4fb5-aab4-b14be2ed7179",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-attack-stix"
+    "_intake_method": "mitre-attack-stix",
+    "cve_refs": [
+      "CVE-2017-8464"
+    ]
   },
   "T1547.010": {
     "id": "T1547.010",
@@ -15908,6 +16293,7 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2026-55040",
       "CVE-2026-9198"
     ]
   },
@@ -17555,7 +17941,10 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
-      "CVE-2024-24591"
+      "CVE-2015-3246",
+      "CVE-2022-23134",
+      "CVE-2024-24591",
+      "CVE-2026-66384"
     ]
   },
   "T1565.002": {
@@ -18007,6 +18396,7 @@
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
       "CVE-2012-1854",
+      "CVE-2020-0787",
       "CVE-2020-3153",
       "CVE-2020-3433",
       "CVE-2022-21919",
@@ -18707,6 +19097,7 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2015-2051",
       "CVE-2021-45382",
       "CVE-2022-0543",
       "CVE-2024-11120",
@@ -19787,6 +20178,9 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2015-1635",
+      "CVE-2017-9841",
+      "CVE-2020-14864",
       "CVE-2022-0028"
     ]
   },
@@ -19813,7 +20207,10 @@
     "stix_id": "attack-pattern--bed04f7d-e48a-4e76-bd0f-4c57fe31fc46",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-attack-stix"
+    "_intake_method": "mitre-attack-stix",
+    "cve_refs": [
+      "CVE-2026-21962"
+    ]
   },
   "T1596.001": {
     "id": "T1596.001",
@@ -20303,7 +20700,10 @@
     "stix_id": "attack-pattern--3ee16395-03f0-4690-a32e-69ce9ada0f9e",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-attack-stix"
+    "_intake_method": "mitre-attack-stix",
+    "cve_refs": [
+      "CVE-2026-66384"
+    ]
   },
   "T1608.002": {
     "id": "T1608.002",
@@ -20380,8 +20780,12 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2011-3544",
+      "CVE-2012-1723",
+      "CVE-2013-1347",
       "CVE-2015-0311",
       "CVE-2015-0313",
+      "CVE-2022-0609",
       "CVE-2022-2294"
     ]
   },