threatwright 0.1.0__py3-none-any.whl

threatwright/__init__.py

@@ -0,0 +1,3 @@
+"""Threatwright: threat modelling and risk analysis after BSI TR-03183-1."""
+
+__version__ = "0.1.0"

threatwright/__main__.py

@@ -0,0 +1,3 @@
+from threatwright.cli import app
+
+app()

threatwright/arc.py

@@ -0,0 +1,295 @@
+"""Applicability of Adaptable Risk-based Controls (ARC), BSI TR-03183-1 §6 (p. 54-57).
+
+A control carries one or more risk scenarios (§6.1, p. 54): prose, affected
+assets with impact, and an environment (access restriction, interface
+restriction, user capability). Per §6.2 (p. 54) a control applies to the PwDE
+or a part of it if that part handles an asset with at least the listed impact
+and expects one of the listed values for every environment parameter ("*"
+matches any value).
+
+The BSI's OSCAL encoding of risk scenarios is not public. Threatwright reads
+them from control parts named `risk-scenario` (ADR-0012, assumption); imported
+controls keep their parts in `oscal_extra.parts`, and hand-written library
+entries use the same structure there.
+"""
+
+import re
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any, Literal, cast
+
+from ruamel.yaml.comments import CommentedMap
+
+from threatwright.library import Libraries, MeasureTemplate
+from threatwright.method import Cia, Method, asset_impact, load_method
+from threatwright.model.objects import Asset, Element, Environment, Flow, Strict, Threat
+from threatwright.model.store import Project, merge_into, read_yaml, to_plain, write_yaml
+
+OVERRIDES_FILE = Path("profiles") / "arc-overrides.yaml"
+SCENARIO_PART = "risk-scenario"
+ENV_PROPS = {
+    "interface": "interface-restriction",
+    "access": "access-restriction",
+    "user": "user-capability",
+}
+IMPACT = re.compile(r"^\s*([CIA])\s*[:(]\s*([1-5])\s*\)?\s*$")
+EnvName = Literal["interface", "access", "user"]
+ENV_LABELS = {
+    "interface": ("Schnittstelle", "interface"),
+    "access": ("Zugang", "access"),
+    "user": ("Nutzer", "user"),
+}
+
+
+def normalize(value: str) -> str:
+    """TR wording ("External network", "Layman") -> method key (external_network, layman)."""
+    value = value.strip()
+    return value if value == "*" else re.sub(r"[^a-z0-9]+", "_", value.lower()).strip("_")
+
+
+@dataclass
+class RiskScenario:
+    prose: str = ""
+    impact: dict[Cia, int] = field(default_factory=dict)  # minimum impact; empty = any
+    asset_classes: list[str] = field(default_factory=list)  # empty = any
+    environment: dict[str, list[str]] = field(default_factory=dict)  # missing / "*" = any
+
+
+def risk_scenarios(entry: MeasureTemplate) -> list[RiskScenario]:
+    found: list[RiskScenario] = []
+
+    def walk(parts: list[Any]) -> None:
+        for part in parts:
+            if not isinstance(part, dict):
+                continue
+            if part.get("name") == SCENARIO_PART:
+                found.append(_scenario(part))
+            walk(part.get("parts", []))
+
+    walk(entry.oscal_extra.get("parts", []))
+    return found
+
+
+def _scenario(part: dict[str, Any]) -> RiskScenario:
+    s = RiskScenario(prose=str(part.get("prose", "")))
+    for prop in part.get("props", []):
+        name, value = prop.get("name"), str(prop.get("value", ""))
+        if name == "asset-impact" and (m := IMPACT.match(value)):
+            dim = cast(Cia, m[1])
+            s.impact[dim] = min(s.impact.get(dim, 5), int(m[2]))
+        elif name == "asset-class":
+            s.asset_classes.append(value.strip())
+        for env, prop_name in ENV_PROPS.items():
+            if name == prop_name:
+                s.environment.setdefault(env, []).append(normalize(value))
+    return s
+
+
+# --- model parts ----------------------------------------------------------------------
+
+
+@dataclass
+class _Asset:
+    id: str
+    title: str
+    asset_class: str
+    impact: dict[Cia, int | None]
+
+
+@dataclass
+class _Part:
+    label: str
+    env: dict[str, set[str]]
+    assets: list[_Asset]
+
+
+def _env(env: Environment) -> dict[str, set[str]]:
+    return {name: {v} if (v := getattr(env, name)) else set() for name in ENV_PROPS}
+
+
+def _parts(project: Project, model_name: str, method: Method, combined: bool) -> list[_Part]:
+    """Elements (zone environment) and assessed threats, each with the assets they handle."""
+    sub = project.models[model_name]
+    assets = cast(dict[str, Asset], sub.objects["assets"])
+    elements = cast(dict[str, Element], sub.objects["elements"])
+    flows = cast(dict[str, Flow], sub.objects["flows"])
+    threats = cast(dict[str, Threat], sub.objects["threats"])
+    zones = {z.id: z.environment for z in sub.meta.zones}
+
+    def info(ids: list[str]) -> list[_Asset]:
+        return [
+            _Asset(a, assets[a].title, assets[a].asset_class, asset_impact(method, assets, a))
+            for a in dict.fromkeys(ids)
+            if a in assets
+        ]
+
+    parts: list[_Part] = []
+    for el in elements.values():
+        handled = [a for f in flows.values() if el.id in (f.source, f.target) for a in f.assets]
+        handled += [a for t in threats.values() if el.id in t.targets for a in t.assets]
+        env = zones.get(el.zone) if el.zone else None
+        parts.append(_Part(f"{el.id} {el.title}", _env(env or Environment()), info(handled)))
+    for t in threats.values():
+        parts.append(_Part(f"{t.id} {t.title}", _env(t.assessment), info(t.assets)))
+    if combined:  # §6.3 (p. 54-55): one profile of all assets and all environments
+        merged: dict[str, set[str]] = {name: set() for name in ENV_PROPS}
+        for p in parts:
+            for name, values in p.env.items():
+                merged[name] |= values
+        return [_Part("combined", merged, info(list(assets)))]
+    return parts
+
+
+def _env_ok(s: RiskScenario, part: _Part) -> bool:
+    return all(
+        not wanted or "*" in wanted or bool(part.env[name] & set(wanted))
+        for name, wanted in s.environment.items()
+    )
+
+
+def _asset_hit(s: RiskScenario, part: _Part) -> tuple[_Asset, Cia, int] | None | Literal[True]:
+    """Matching asset with dimension and value; True when the scenario has no asset condition."""
+    if not s.impact and not s.asset_classes:
+        return True
+    for a in part.assets:
+        if s.asset_classes and a.asset_class not in s.asset_classes:
+            continue
+        if not s.impact:
+            return a, "C", 0
+        for dim, minimum in s.impact.items():
+            value = a.impact.get(dim)
+            if value is not None and value >= minimum:
+                return a, dim, value
+    return None
+
+
+# --- result -------------------------------------------------------------------------
+
+
+@dataclass
+class ControlApplicability:
+    measure_id: str
+    control_id: str | None
+    applies: bool
+    rationale: dict[str, str]  # {"de": ..., "en": ...}
+    part: str | None = None
+    scenario: int | None = None  # 1-based index of the matching risk scenario
+    overridden: bool = False
+
+
+def _env_text(env: dict[str, set[str]] | dict[str, list[str]], lang: int) -> str:
+    return ", ".join(f"{ENV_LABELS[n][lang]} {'/'.join(sorted(v)) or '?'}" for n, v in env.items())
+
+
+def _requirement(s: RiskScenario, lang: int) -> str:
+    alt = (" oder ", " or ")[lang]
+    items = []
+    if s.impact:
+        items.append(alt.join(f"{d}≥{v}" for d, v in s.impact.items()))
+    if s.asset_classes:
+        items.append(("Assetklasse ", "asset class ")[lang] + "/".join(s.asset_classes))
+    env = {n: v for n, v in s.environment.items() if v and "*" not in v}
+    if env:
+        items.append(_env_text(env, lang))
+    return "; ".join(items) or ("keine Bedingung", "no condition")[lang]
+
+
+def _applies(
+    entry: MeasureTemplate, scenarios: list[RiskScenario], parts: list[_Part]
+) -> ControlApplicability:
+    control_id = entry.oscal_ref.control_id if entry.oscal_ref else None
+    for n, s in enumerate(scenarios, 1):
+        for part in parts:
+            hit = _asset_hit(s, part) if _env_ok(s, part) else None
+            if hit is None:
+                continue
+            if hit is True:
+                why_de, why_en = "keine Asset-Bedingung", "no asset condition"
+            else:
+                a, dim, value = hit
+                cond = f"{dim}={value}" if s.impact else a.asset_class
+                why_de = f"Asset {a.id} ({a.title}) mit {cond}"
+                why_en = f"asset {a.id} ({a.title}) with {cond}"
+            rationale = {
+                "de": f"Risikoszenario {n} trifft auf {part.label} zu: {why_de}; "
+                f"Umgebung {_env_text(part.env, 0)} (TR-03183-1 §6.2, S. 54).",
+                "en": f"Risk scenario {n} matches {part.label}: {why_en}; "
+                f"environment {_env_text(part.env, 1)} (TR-03183-1 §6.2, p. 54).",
+            }
+            return ControlApplicability(entry.id, control_id, True, rationale, part.label, n)
+    need_de = " | ".join(f"Szenario {n}: {_requirement(s, 0)}" for n, s in enumerate(scenarios, 1))
+    need_en = " | ".join(f"scenario {n}: {_requirement(s, 1)}" for n, s in enumerate(scenarios, 1))
+    rationale = {
+        "de": "Kein Teil des Modells verarbeitet ein Asset mit der geforderten Auswirkung "
+        f"in passender Umgebung ({need_de}; TR-03183-1 §6.2, S. 54).",
+        "en": "No part of the model handles an asset with the required impact in a matching "
+        f"environment ({need_en}; TR-03183-1 §6.2, p. 54).",
+    }
+    return ControlApplicability(entry.id, control_id, False, rationale)
+
+
+def applicability(
+    project: Project, model_name: str, library: Libraries, combined: bool = False
+) -> list[ControlApplicability]:
+    """Per library measure with risk scenarios: does it apply to the model? Overrides win."""
+    method = load_method(project.root, project.config)
+    parts = _parts(project, model_name, method, combined)
+    overrides = load_overrides(project.root).models.get(model_name, {})
+    out: list[ControlApplicability] = []
+    for entry in sorted(library.measures.values(), key=lambda m: m.id):
+        scenarios = risk_scenarios(entry)
+        if not scenarios:
+            continue
+        result = _applies(entry, scenarios, parts)
+        if (o := overrides.get(entry.id)) is not None:
+            prefix = ("Manuell festgelegt", "Manual override")
+            by = f" ({o.by})" if o.by else ""
+            result.applies = o.applies
+            result.overridden = True
+            result.rationale = {
+                "de": f"{prefix[0]}{by}: {o.rationale}",
+                "en": f"{prefix[1]}{by}: {o.rationale}",
+            }
+        out.append(result)
+    return out
+
+
+# --- overrides -------------------------------------------------------------------------
+
+
+class ArcOverride(Strict):
+    applies: bool
+    rationale: str
+    by: str | None = None
+
+
+class ArcOverrides(Strict):
+    """Content of profiles/arc-overrides.yaml: model name -> library measure id -> decision."""
+
+    schema_version: Literal[1] = 1
+    models: dict[str, dict[str, ArcOverride]] = {}
+
+
+def load_overrides(project_root: Path) -> ArcOverrides:
+    path = Path(project_root) / OVERRIDES_FILE
+    if not path.exists():
+        return ArcOverrides()
+    return ArcOverrides.model_validate(to_plain(read_yaml(path)))
+
+
+def set_override(
+    project_root: Path, model_name: str, measure_id: str, override: ArcOverride | None
+) -> None:
+    """Store or (with None) remove a manual decision; comments in the file survive."""
+    path = Path(project_root) / OVERRIDES_FILE
+    doc = read_yaml(path) if path.exists() else CommentedMap()
+    data = load_overrides(project_root)
+    per_model = data.models.setdefault(model_name, {})
+    if override is None:
+        per_model.pop(measure_id, None)
+    else:
+        per_model[measure_id] = override
+    if not per_model:
+        data.models.pop(model_name)
+    if merge_into(doc, data) or not path.exists():
+        write_yaml(path, doc)

threatwright/assistant.py

@@ -0,0 +1,290 @@
+"""Turn library entries into model objects; STRIDE suggestions and coverage.
+
+Environment of an adopted threat: the interface comes from the threat template
+(it describes the attack path); access and user come from the zone of the
+target where set, otherwise from the template. Measures suggested by the
+template are reused when the model already contains them (same library entry).
+"""
+
+from dataclasses import dataclass, field
+from typing import Literal
+
+from threatwright.library import REF, ElementType, Libraries, MeasureTemplate, ThreatTemplate
+from threatwright.method import Method
+from threatwright.model.objects import (
+    Assessment,
+    Asset,
+    Element,
+    Environment,
+    Flow,
+    Measure,
+    ModelObject,
+    NodeLayout,
+    ProjectConfig,
+    Threat,
+)
+from threatwright.model.store import SubModel
+
+Lang = Literal["de", "en"]
+
+
+def _lang(config: ProjectConfig) -> Lang:
+    return config.language
+
+
+def library_type(obj: ModelObject) -> str | None:
+    """Element type id an element or flow was created from."""
+    m = REF.match(obj.library_ref or "")
+    return m[3] if m and m[2] == "element" else None
+
+
+def _entry_id(obj: ModelObject, kind: str) -> str | None:
+    m = REF.match(obj.library_ref or "")
+    return m[3] if m and m[2] == kind else None
+
+
+def _zone_env(sub: SubModel, target: ModelObject) -> Environment:
+    element = target
+    if isinstance(target, Flow):
+        element = sub.objects["elements"].get(target.target, target)
+    zone_id = element.zone if isinstance(element, Element) else None
+    zone = next((z for z in sub.meta.zones if z.id == zone_id), None)
+    return zone.environment if zone else Environment()
+
+
+def _new_assets(
+    sub: SubModel, libs: Libraries, etype: ElementType, owner_title: str, lang: Lang
+) -> list[str]:
+    ids = []
+    for a in etype.assets:
+        asset_id = sub.next_id("assets")
+        sub.objects["assets"][asset_id] = Asset(
+            id=asset_id,
+            title=f"{getattr(a.title, lang)} ({owner_title})",
+            asset_class=a.asset_class,
+            description=getattr(a.rationale, lang) if a.rationale else None,
+        )
+        ids.append(asset_id)
+    return ids
+
+
+def add_element(
+    sub: SubModel,
+    libs: Libraries,
+    config: ProjectConfig,
+    type_id: str,
+    title: str | None = None,
+    zone: str | None = None,
+    position: tuple[float, float] | None = None,
+) -> Element:
+    """New element from a library element type, with its typical assets."""
+    etype = libs.elements[type_id]
+    if etype.kind == "flow":
+        raise ValueError(f"'{type_id}' is a data flow type")
+    lang = _lang(config)
+    element = Element(
+        id=sub.next_id("elements"),
+        title=title or getattr(etype.name, lang),
+        kind=etype.kind,
+        zone=zone,
+        library_ref=libs.ref("element", type_id),
+        description=getattr(etype.description, lang) if etype.description else None,
+    )
+    sub.objects["elements"][element.id] = element
+    _new_assets(sub, libs, etype, element.title, lang)
+    if position is not None:
+        sub.layout.nodes[element.id] = NodeLayout(x=position[0], y=position[1])
+    return element
+
+
+def add_flow(
+    sub: SubModel,
+    libs: Libraries,
+    config: ProjectConfig,
+    source: str,
+    target: str,
+    type_id: str | None = None,
+) -> Flow:
+    """New data flow between two elements, optionally typed by a library flow type."""
+    for end in (source, target):
+        if end not in sub.objects["elements"]:
+            raise KeyError(end)
+    lang = _lang(config)
+    etype = libs.elements.get(type_id) if type_id else None
+    if etype is not None and etype.kind != "flow":
+        raise ValueError(f"'{type_id}' is not a data flow type")
+    names = [sub.objects["elements"][e].title for e in (source, target)]
+    title = getattr(etype.name, lang) if etype else f"{names[0]} → {names[1]}"
+    flow_id = sub.next_id("flows")
+    assets = _new_assets(sub, libs, etype, f"{flow_id}", lang) if etype else []
+    flow = Flow(
+        id=flow_id,
+        title=title,
+        source=source,
+        target=target,
+        protocol=etype.name.en if etype else None,
+        assets=assets,
+        library_ref=libs.ref("element", type_id) if etype and type_id else None,
+    )
+    sub.objects["flows"][flow.id] = flow
+    return flow
+
+
+def _measure_for(sub: SubModel, libs: Libraries, template: MeasureTemplate, lang: Lang) -> str:
+    for m in sub.objects["measures"].values():
+        if _entry_id(m, "measure") == template.id:
+            return m.id
+    measure = Measure(
+        id=sub.next_id("measures"),
+        title=getattr(template.title, lang),
+        description=getattr(template.description, lang),
+        kind=template.kind,
+        compensating=template.compensating,
+        evidence=getattr(template.evidence, lang) if template.evidence else None,
+        cra_refs=list(template.cra_refs),
+        library_ref=libs.ref("measure", template.id),
+    )
+    sub.objects["measures"][measure.id] = measure
+    return measure.id
+
+
+def adopt_threat(
+    sub: SubModel, libs: Libraries, config: ProjectConfig, template_id: str, target_id: str
+) -> Threat:
+    """New threat on a target from a library template incl. suggested measures."""
+    template: ThreatTemplate = libs.threats[template_id]
+    target = sub.objects["elements"].get(target_id) or sub.objects["flows"].get(target_id)
+    if target is None:
+        raise KeyError(target_id)
+    lang = _lang(config)
+
+    def fill(text: str) -> str:
+        return text.replace("{element}", target.title)
+
+    zone = _zone_env(sub, target)
+    env = template.environment
+    measures = [
+        _measure_for(sub, libs, libs.measures[m], lang)
+        for m in template.measures
+        if m in libs.measures
+    ]
+    threat = Threat(
+        id=sub.next_id("threats"),
+        title=fill(getattr(template.title, lang)),
+        stride=list(template.stride),
+        targets=[target_id],
+        assets=list(target.assets) if isinstance(target, Flow) else [],
+        configurations=list(getattr(target, "configurations", [])),
+        scenario=fill(getattr(template.scenario, lang)),
+        consequence=fill(getattr(template.consequence, lang)),
+        safety_related=template.safety_related,
+        assessment=Assessment(
+            interface=env.interface or zone.interface,
+            access=zone.access or env.access,
+            user=zone.user or env.user,
+            impact=template.impact,
+        ),
+        measures=measures,
+        cra_refs=list(template.cra_refs),
+        library_ref=libs.ref("threat", template_id),
+    )
+    sub.objects["threats"][threat.id] = threat
+    return threat
+
+
+# --- suggestions and coverage -------------------------------------------------------
+
+
+@dataclass
+class Suggestion:
+    template_id: str
+    title: str
+    scenario: str
+    impact: int | None
+    safety_related: bool
+    adopted: bool
+
+
+@dataclass
+class Category:
+    relevant: bool
+    existing: list[str] = field(default_factory=list)
+    not_relevant: str | None = None
+    suggestions: list[Suggestion] = field(default_factory=list)
+
+
+def _kind(obj: ModelObject) -> str:
+    return obj.kind if isinstance(obj, Element) else "flow"
+
+
+def suggestions(
+    sub: SubModel, libs: Libraries, method: Method, config: ProjectConfig, target_id: str
+) -> dict[str, Category]:
+    """Per STRIDE category: existing threats and fitting library templates."""
+    target = sub.objects["elements"].get(target_id) or sub.objects["flows"].get(target_id)
+    if not isinstance(target, Element | Flow):
+        raise KeyError(target_id)
+    lang = _lang(config)
+    kind = _kind(target)
+    etype = library_type(target)
+    if etype in libs.elements:
+        types = {etype}
+    elif kind == "flow":
+        # flow templates are protocol specific (fieldbus, VPN, Wi-Fi); none fits an untyped flow
+        types = set()
+    else:  # no library type: offer templates for element types of the same kind
+        types = {e.id for e in libs.elements.values() if e.kind == kind}
+    threats = [t for t in sub.objects["threats"].values() if isinstance(t, Threat)]
+    adopted = {(_entry_id(t, "threat"), tuple(t.targets)) for t in threats}
+    relevant = set(method.stride_per_kind.map.get(kind, []))
+    out: dict[str, Category] = {}
+    for s in "STRIDE":
+        cat = Category(
+            relevant=s in relevant,
+            existing=[t.id for t in threats if target_id in t.targets and s in t.stride],
+            not_relevant=target.stride_not_relevant.get(s),  # type: ignore[call-overload]
+        )
+        for tpl in libs.threats.values():
+            if s in tpl.stride and types & set(tpl.applies_to):
+                cat.suggestions.append(
+                    Suggestion(
+                        template_id=tpl.id,
+                        title=getattr(tpl.title, lang).replace("{element}", target.title),
+                        scenario=getattr(tpl.scenario, lang).replace("{element}", target.title),
+                        impact=tpl.impact,
+                        safety_related=tpl.safety_related,
+                        adopted=any(a == tpl.id and target_id in tg for a, tg in adopted),
+                    )
+                )
+        out[s] = cat
+    return out
+
+
+@dataclass
+class CoverageRow:
+    id: str
+    title: str
+    kind: str
+    cells: dict[str, Category]
+
+
+def coverage(sub: SubModel, method: Method) -> list[CoverageRow]:
+    """Elements and flows x STRIDE: threat count and 'not relevant' marks."""
+    threats = [t for t in sub.objects["threats"].values() if isinstance(t, Threat)]
+    rows = []
+    for coll in ("elements", "flows"):
+        for obj in sub.objects[coll].values():
+            if not isinstance(obj, Element | Flow):
+                continue
+            kind = _kind(obj)
+            relevant = set(method.stride_per_kind.map.get(kind, []))
+            cells = {
+                s: Category(
+                    relevant=s in relevant,
+                    existing=[t.id for t in threats if obj.id in t.targets and s in t.stride],
+                    not_relevant=obj.stride_not_relevant.get(s),  # type: ignore[call-overload]
+                )
+                for s in "STRIDE"
+            }
+            rows.append(CoverageRow(obj.id, obj.title, kind, cells))
+    return rows

threatwright/branding.py

@@ -0,0 +1,4 @@
+"""Product naming. The only place the product name is defined."""
+
+PRODUCT_NAME = "Threatwright"
+PROJECT_FILE = "threatwright.yaml"

threatwright/catalogs/attack-ics.yaml

@@ -0,0 +1,87 @@
+# MITRE ATT&CK for ICS technique IDs, used to validate library references.
+# (c) The MITRE Corporation. ATT&CK is reproduced and distributed with the
+# permission of The MITRE Corporation (https://attack.mitre.org/resources/legal-and-branding/terms-of-use/).
+schema_version: 1
+id: attack-ics
+title: MITRE ATT&CK for ICS
+version: v20
+retrieved: '2026-10-19'
+source: https://attack.mitre.org/techniques/ics/
+entries:
+  T0800: Activate Firmware Update Mode
+  T0802: Automated Collection
+  T0806: Brute Force I/O
+  T0809: Data Destruction
+  T0811: Data from Information Repositories
+  T0813: Denial of Control
+  T0814: Denial of Service
+  T0815: Denial of View
+  T0816: Device Restart/Shutdown
+  T0817: Drive-by Compromise
+  T0819: Exploit Public-Facing Application
+  T0820: Exploitation for Evasion
+  T0821: Modify Controller Tasking
+  T0822: External Remote Services
+  T0823: Graphical User Interface
+  T0826: Loss of Availability
+  T0827: Loss of Control
+  T0828: Loss of Productivity and Revenue
+  T0829: Loss of View
+  T0830: Adversary-in-the-Middle
+  T0831: Manipulation of Control
+  T0832: Manipulation of View
+  T0834: Native API
+  T0835: Manipulate I/O Image
+  T0836: Modify Parameter
+  T0837: Loss of Protection
+  T0838: Modify Alarm Settings
+  T0840: Network Connection Enumeration
+  T0842: Network Sniffing
+  T0843: Program Download
+  T0845: Program Upload
+  T0846: Remote System Discovery
+  T0847: Replication Through Removable Media
+  T0848: Rogue Master
+  T0849: Masquerading
+  T0851: Rootkit
+  T0852: Screen Capture
+  T0858: Change Operating Mode
+  T0859: Valid Accounts
+  T0860: Wireless Compromise
+  T0861: Point & Tag Identification
+  T0862: Supply Chain Compromise
+  T0863: User Execution
+  T0864: Transient Cyber Asset
+  T0865: Spearphishing Attachment
+  T0866: Exploitation of Remote Services
+  T0867: Lateral Tool Transfer
+  T0868: Detect Operating Mode
+  T0869: Standard Application Layer Protocol
+  T0871: Execution through API
+  T0872: Indicator Removal on Host
+  T0873: Project File Infection
+  T0874: Hooking
+  T0877: I/O Image
+  T0878: Alarm Suppression
+  T0879: Damage to Property
+  T0880: Loss of Safety
+  T0881: Service Stop
+  T0882: Theft of Operational Information
+  T0883: Internet Accessible Device
+  T0884: Connection Proxy
+  T0885: Commonly Used Port
+  T0886: Remote Services
+  T0887: Wireless Sniffing
+  T0888: Remote System Information Discovery
+  T0889: Modify Program
+  T0890: Exploitation for Privilege Escalation
+  T0892: Change Credential
+  T0893: Data from Local System
+  T0894: System Binary Proxy Execution
+  T0895: Autorun Image
+  T1691: Block Operational Technology Message
+  T1692: Unauthorized Message
+  T1693: Modify Firmware
+  T1694: Insecure Credentials
+  T1695: Block Communications
+  T1701: Command and Scripting Interpreter