txt2stix 1.1.8__py3-none-any.whl → 1.1.10__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- txt2stix/includes/extractions/ai/config.yaml +20 -0
- txt2stix/includes/extractions/lookup/config.yaml +33 -15
- txt2stix/includes/lookups/_generate_lookups.py +39 -30
- txt2stix/includes/lookups/{disarm_id_v1_5.txt → disarm_id_v1_6.txt} +95 -32
- txt2stix/includes/lookups/{disarm_name_v1_5.txt → disarm_name_v1_6.txt} +380 -317
- txt2stix/includes/lookups/{mitre_atlas_id_v4_5_2.txt → mitre_atlas_id_v4_9_0.txt} +41 -1
- txt2stix/includes/lookups/mitre_atlas_name_v4_9_0.txt +157 -0
- txt2stix/includes/lookups/{mitre_attack_enterprise_aliases_v16_0.txt → mitre_attack_enterprise_aliases_v18_0.txt} +679 -531
- txt2stix/includes/lookups/mitre_attack_enterprise_id_v18_0.txt +4293 -0
- txt2stix/includes/lookups/mitre_attack_enterprise_name_v18_0.txt +4295 -0
- txt2stix/includes/lookups/{mitre_attack_ics_aliases_v16_0.txt → mitre_attack_ics_aliases_v18_0.txt} +7 -3
- txt2stix/includes/lookups/mitre_attack_ics_id_v18_0.txt +410 -0
- txt2stix/includes/lookups/{mitre_attack_ics_name_v16_0.txt → mitre_attack_ics_name_v18_0.txt} +172 -53
- txt2stix/includes/lookups/{mitre_attack_mobile_aliases_v16_0.txt → mitre_attack_mobile_aliases_v18_0.txt} +33 -0
- txt2stix/includes/lookups/mitre_attack_mobile_id_v18_0.txt +643 -0
- txt2stix/includes/lookups/mitre_attack_mobile_name_v18_0.txt +645 -0
- txt2stix/includes/lookups/mitre_capec_name_v3_9.txt +522 -522
- txt2stix/includes/lookups/{mitre_cwe_id_v4_15.txt → mitre_cwe_id_v4_18.txt} +5 -0
- txt2stix/includes/lookups/{mitre_cwe_name_v4_15.txt → mitre_cwe_name_v4_18.txt} +889 -884
- txt2stix/includes/lookups/sector_aliases_v1_0.txt +751 -0
- txt2stix/includes/tests/test_cases.yaml +8 -0
- txt2stix/retriever.py +6 -0
- {txt2stix-1.1.8.dist-info → txt2stix-1.1.10.dist-info}/METADATA +2 -10
- {txt2stix-1.1.8.dist-info → txt2stix-1.1.10.dist-info}/RECORD +27 -26
- txt2stix/includes/lookups/mitre_atlas_name_v4_5_2.txt +0 -117
- txt2stix/includes/lookups/mitre_attack_enterprise_id_v16_0.txt +0 -1656
- txt2stix/includes/lookups/mitre_attack_enterprise_name_v16_0.txt +0 -1765
- txt2stix/includes/lookups/mitre_attack_ics_id_v16_0.txt +0 -254
- txt2stix/includes/lookups/mitre_attack_mobile_id_v16_0.txt +0 -277
- txt2stix/includes/lookups/mitre_attack_mobile_name_v16_0.txt +0 -296
- {txt2stix-1.1.8.dist-info → txt2stix-1.1.10.dist-info}/WHEEL +0 -0
- {txt2stix-1.1.8.dist-info → txt2stix-1.1.10.dist-info}/entry_points.txt +0 -0
- {txt2stix-1.1.8.dist-info → txt2stix-1.1.10.dist-info}/licenses/LICENSE +0 -0
|
@@ -0,0 +1,645 @@
|
|
|
1
|
+
Scheduled Task/Job
|
|
2
|
+
Adversary-in-the-Middle
|
|
3
|
+
Abuse Elevation Control Mechanism
|
|
4
|
+
Remote Access Software
|
|
5
|
+
Uninstall Malicious Application
|
|
6
|
+
Indicator Removal on Host
|
|
7
|
+
Supply Chain Compromise
|
|
8
|
+
Impersonate SS7 Nodes
|
|
9
|
+
Match Legitimate Name or Location
|
|
10
|
+
Protected User Data
|
|
11
|
+
Asymmetric Cryptography
|
|
12
|
+
Software Discovery
|
|
13
|
+
Process Discovery
|
|
14
|
+
Call Log
|
|
15
|
+
Security Software Discovery
|
|
16
|
+
Ptrace System Calls
|
|
17
|
+
Impair Defenses
|
|
18
|
+
Abuse Accessibility Features
|
|
19
|
+
Exploitation of Remote Services
|
|
20
|
+
Web Protocols
|
|
21
|
+
Steal Application Access Token
|
|
22
|
+
User Evasion
|
|
23
|
+
Virtualization/Sandbox Evasion
|
|
24
|
+
Application Versioning
|
|
25
|
+
Command and Scripting Interpreter
|
|
26
|
+
Disable or Modify Tools
|
|
27
|
+
Ingress Tool Transfer
|
|
28
|
+
Dynamic Resolution
|
|
29
|
+
Network Service Scanning
|
|
30
|
+
Exfiltration Over C2 Channel
|
|
31
|
+
Accounts
|
|
32
|
+
Exploitation for Privilege Escalation
|
|
33
|
+
Call Control
|
|
34
|
+
Exfiltration Over Unencrypted Non-C2 Protocol
|
|
35
|
+
Broadcast Receivers
|
|
36
|
+
Access Notifications
|
|
37
|
+
Exfiltration Over Alternative Protocol
|
|
38
|
+
Internet Connection Discovery
|
|
39
|
+
Boot or Logon Initialization Scripts
|
|
40
|
+
Execution Guardrails
|
|
41
|
+
GUI Input Capture
|
|
42
|
+
Compromise Client Software Binary
|
|
43
|
+
Software Packing
|
|
44
|
+
Native API
|
|
45
|
+
Exploitation for Client Execution
|
|
46
|
+
Proxy Through Victim
|
|
47
|
+
Foreground Persistence
|
|
48
|
+
Replication Through Removable Media
|
|
49
|
+
Audio Capture
|
|
50
|
+
Hijack Execution Flow
|
|
51
|
+
Unix Shell
|
|
52
|
+
Application Layer Protocol
|
|
53
|
+
Download New Code at Runtime
|
|
54
|
+
Exploitation for Initial Access
|
|
55
|
+
System Checks
|
|
56
|
+
Stored Application Data
|
|
57
|
+
Screen Capture
|
|
58
|
+
Transmitted Data Manipulation
|
|
59
|
+
Compromise Software Dependencies and Development Tools
|
|
60
|
+
URI Hijacking
|
|
61
|
+
Subvert Trust Controls
|
|
62
|
+
Keychain
|
|
63
|
+
Virtualization Solution
|
|
64
|
+
Bidirectional Communication
|
|
65
|
+
Non-Standard Port
|
|
66
|
+
Compromise Software Supply Chain
|
|
67
|
+
Dead Drop Resolver
|
|
68
|
+
Location Tracking
|
|
69
|
+
Device Administrator Permissions
|
|
70
|
+
Remote Device Management Services
|
|
71
|
+
Data Destruction
|
|
72
|
+
Linked Devices
|
|
73
|
+
SIM Card Swap
|
|
74
|
+
Input Capture
|
|
75
|
+
Generate Traffic from Victim
|
|
76
|
+
Disguise Root/Jailbreak Indicators
|
|
77
|
+
Calendar Entries
|
|
78
|
+
File Deletion
|
|
79
|
+
Device Lockout
|
|
80
|
+
Keylogging
|
|
81
|
+
SMS Control
|
|
82
|
+
Process Injection
|
|
83
|
+
Symmetric Cryptography
|
|
84
|
+
Wi-Fi Discovery
|
|
85
|
+
Compromise Hardware Supply Chain
|
|
86
|
+
Clipboard Data
|
|
87
|
+
Data Manipulation
|
|
88
|
+
SMS Messages
|
|
89
|
+
Web Service
|
|
90
|
+
System Runtime API Hijacking
|
|
91
|
+
Credentials from Password Store
|
|
92
|
+
Hooking
|
|
93
|
+
File and Directory Discovery
|
|
94
|
+
Obfuscated Files or Information
|
|
95
|
+
Input Injection
|
|
96
|
+
Network Denial of Service
|
|
97
|
+
Compromise Application Executable
|
|
98
|
+
Event Triggered Execution
|
|
99
|
+
System Network Configuration Discovery
|
|
100
|
+
Video Capture
|
|
101
|
+
One-Way Communication
|
|
102
|
+
Data Encrypted for Impact
|
|
103
|
+
Prevent Application Removal
|
|
104
|
+
System Network Connections Discovery
|
|
105
|
+
Phishing
|
|
106
|
+
SSL Pinning
|
|
107
|
+
Lockscreen Bypass
|
|
108
|
+
Contact List
|
|
109
|
+
Data from Local System
|
|
110
|
+
Account Access Removal
|
|
111
|
+
System Information Discovery
|
|
112
|
+
Archive Collected Data
|
|
113
|
+
Geofencing
|
|
114
|
+
Conceal Multimedia Files
|
|
115
|
+
Endpoint Denial of Service
|
|
116
|
+
Out of Band Data
|
|
117
|
+
Encrypted Channel
|
|
118
|
+
Suppress Application Icon
|
|
119
|
+
Masquerading
|
|
120
|
+
Steganography
|
|
121
|
+
Hide Artifacts
|
|
122
|
+
Code Signing Policy Modification
|
|
123
|
+
Domain Generation Algorithms
|
|
124
|
+
Drive-By Compromise
|
|
125
|
+
Operation Dust Storm
|
|
126
|
+
C0033
|
|
127
|
+
Operation Triangulation
|
|
128
|
+
Use Recent OS Version
|
|
129
|
+
Application Developer Guidance
|
|
130
|
+
Enterprise Policy
|
|
131
|
+
User Guidance
|
|
132
|
+
Do Not Mitigate
|
|
133
|
+
Antivirus/Antimalware
|
|
134
|
+
System Partition Integrity
|
|
135
|
+
Encrypt Network Traffic
|
|
136
|
+
Lock Bootloader
|
|
137
|
+
Security Updates
|
|
138
|
+
Deploy Compromised Device Detection Method
|
|
139
|
+
Interconnection Filtering
|
|
140
|
+
Attestation
|
|
141
|
+
The MITRE Corporation
|
|
142
|
+
Bouncing Golf
|
|
143
|
+
APT41
|
|
144
|
+
UNC788
|
|
145
|
+
MuddyWater
|
|
146
|
+
Sandworm Team
|
|
147
|
+
Scattered Spider
|
|
148
|
+
Confucius
|
|
149
|
+
MoustachedBouncer
|
|
150
|
+
BITTER
|
|
151
|
+
APT-C-23
|
|
152
|
+
Dark Caracal
|
|
153
|
+
Star Blizzard
|
|
154
|
+
Windshift
|
|
155
|
+
APT28
|
|
156
|
+
Earth Lusca
|
|
157
|
+
LAPSUS$
|
|
158
|
+
PROMETHIUM
|
|
159
|
+
CarbonSteal
|
|
160
|
+
Cerberus
|
|
161
|
+
DroidJack
|
|
162
|
+
Rotexy
|
|
163
|
+
Stealth Mango
|
|
164
|
+
Allwinner
|
|
165
|
+
GoldenEagle
|
|
166
|
+
FlixOnline
|
|
167
|
+
Bread
|
|
168
|
+
TriangleDB
|
|
169
|
+
Hornbill
|
|
170
|
+
Judy
|
|
171
|
+
OldBoot
|
|
172
|
+
Gooligan
|
|
173
|
+
SpyNote RAT
|
|
174
|
+
TrickMo
|
|
175
|
+
INSOMNIA
|
|
176
|
+
Dvmap
|
|
177
|
+
Zen
|
|
178
|
+
NotCompatible
|
|
179
|
+
AhRat
|
|
180
|
+
XLoader for Android
|
|
181
|
+
Trojan-SMS.AndroidOS.FakeInst.a
|
|
182
|
+
XLoader for iOS
|
|
183
|
+
AbstractEmu
|
|
184
|
+
Chameleon
|
|
185
|
+
Exodus
|
|
186
|
+
Dendroid
|
|
187
|
+
WireLurker
|
|
188
|
+
Desert Scorpion
|
|
189
|
+
Pegasus for iOS
|
|
190
|
+
Tangelo
|
|
191
|
+
RCSAndroid
|
|
192
|
+
Corona Updates
|
|
193
|
+
Skygofree
|
|
194
|
+
KeyRaider
|
|
195
|
+
ZergHelper
|
|
196
|
+
CherryBlos
|
|
197
|
+
DoubleAgent
|
|
198
|
+
Twitoor
|
|
199
|
+
Fakecalls
|
|
200
|
+
S.O.V.A.
|
|
201
|
+
ANDROIDOS_ANSERVER.A
|
|
202
|
+
DualToy
|
|
203
|
+
Mandrake
|
|
204
|
+
HilalRAT
|
|
205
|
+
X-Agent for Android
|
|
206
|
+
DEFENSOR ID
|
|
207
|
+
BRATA
|
|
208
|
+
LightSpy
|
|
209
|
+
MazarBOT
|
|
210
|
+
Ginp
|
|
211
|
+
HummingWhale
|
|
212
|
+
eSurv
|
|
213
|
+
TangleBot
|
|
214
|
+
Monokle
|
|
215
|
+
RatMilad
|
|
216
|
+
DCHSpy
|
|
217
|
+
Red Alert 2.0
|
|
218
|
+
ViceLeaker
|
|
219
|
+
FlyTrap
|
|
220
|
+
FakeSpy
|
|
221
|
+
SpyDealer
|
|
222
|
+
Concipit1248
|
|
223
|
+
RuMMS
|
|
224
|
+
Pegasus for Android
|
|
225
|
+
SpyC23
|
|
226
|
+
FrozenCell
|
|
227
|
+
AndroidOS/MalLocker.B
|
|
228
|
+
SharkBot
|
|
229
|
+
RedDrop
|
|
230
|
+
CHEMISTGAMES
|
|
231
|
+
YiSpecter
|
|
232
|
+
Trojan-SMS.AndroidOS.Agent.ao
|
|
233
|
+
BOULDSPY
|
|
234
|
+
Anubis
|
|
235
|
+
AndroRAT
|
|
236
|
+
FinFisher
|
|
237
|
+
Agent Smith
|
|
238
|
+
Asacub
|
|
239
|
+
GPlayed
|
|
240
|
+
EventBot
|
|
241
|
+
HenBox
|
|
242
|
+
Binary Validator
|
|
243
|
+
GodFather
|
|
244
|
+
Riltok
|
|
245
|
+
GolfSpy
|
|
246
|
+
Pallas
|
|
247
|
+
Circles
|
|
248
|
+
Tiktok Pro
|
|
249
|
+
PJApps
|
|
250
|
+
ShiftyBug
|
|
251
|
+
HummingBad
|
|
252
|
+
Exobot
|
|
253
|
+
OBAD
|
|
254
|
+
FjordPhantom
|
|
255
|
+
Android/Chuli.A
|
|
256
|
+
Charger
|
|
257
|
+
Drinik
|
|
258
|
+
Trojan-SMS.AndroidOS.OpFake.a
|
|
259
|
+
XcodeGhost
|
|
260
|
+
SilkBean
|
|
261
|
+
WolfRAT
|
|
262
|
+
BusyGasper
|
|
263
|
+
BrainTest
|
|
264
|
+
TERRACOTTA
|
|
265
|
+
Escobar
|
|
266
|
+
Android/SpyAgent
|
|
267
|
+
Triada
|
|
268
|
+
Golden Cup
|
|
269
|
+
FluBot
|
|
270
|
+
ViperRAT
|
|
271
|
+
Adups
|
|
272
|
+
SimBad
|
|
273
|
+
Android/AdDisplay.Ashas
|
|
274
|
+
Phenakite
|
|
275
|
+
TianySpy
|
|
276
|
+
Sunbird
|
|
277
|
+
DressCode
|
|
278
|
+
Gustuff
|
|
279
|
+
None
|
|
280
|
+
FlexiSpy
|
|
281
|
+
Xbot
|
|
282
|
+
Analytic 1789
|
|
283
|
+
Analytic 1740
|
|
284
|
+
Analytic 1649
|
|
285
|
+
Analytic 1679
|
|
286
|
+
Analytic 1725
|
|
287
|
+
Analytic 1792
|
|
288
|
+
Analytic 1829
|
|
289
|
+
Analytic 1747
|
|
290
|
+
Analytic 1736
|
|
291
|
+
Analytic 1807
|
|
292
|
+
Analytic 1836
|
|
293
|
+
Analytic 1727
|
|
294
|
+
Analytic 1832
|
|
295
|
+
Analytic 1759
|
|
296
|
+
Analytic 1819
|
|
297
|
+
Analytic 1814
|
|
298
|
+
Analytic 1662
|
|
299
|
+
Analytic 1704
|
|
300
|
+
Analytic 1801
|
|
301
|
+
Analytic 1705
|
|
302
|
+
Analytic 1768
|
|
303
|
+
Analytic 1714
|
|
304
|
+
Analytic 1816
|
|
305
|
+
Analytic 1762
|
|
306
|
+
Analytic 1644
|
|
307
|
+
Analytic 1738
|
|
308
|
+
Analytic 1778
|
|
309
|
+
Analytic 1711
|
|
310
|
+
Analytic 1720
|
|
311
|
+
Analytic 1729
|
|
312
|
+
Analytic 1718
|
|
313
|
+
Analytic 1737
|
|
314
|
+
Analytic 1760
|
|
315
|
+
Analytic 1750
|
|
316
|
+
Analytic 1717
|
|
317
|
+
Analytic 1688
|
|
318
|
+
Analytic 1788
|
|
319
|
+
Analytic 1669
|
|
320
|
+
Analytic 1687
|
|
321
|
+
Analytic 1774
|
|
322
|
+
Analytic 1799
|
|
323
|
+
Analytic 1735
|
|
324
|
+
Analytic 1820
|
|
325
|
+
Analytic 1672
|
|
326
|
+
Analytic 1795
|
|
327
|
+
Analytic 1764
|
|
328
|
+
Analytic 1845
|
|
329
|
+
Analytic 1808
|
|
330
|
+
Analytic 1769
|
|
331
|
+
Analytic 1773
|
|
332
|
+
Analytic 1665
|
|
333
|
+
Analytic 1831
|
|
334
|
+
Analytic 1734
|
|
335
|
+
Analytic 1696
|
|
336
|
+
Analytic 1719
|
|
337
|
+
Analytic 1763
|
|
338
|
+
Analytic 1766
|
|
339
|
+
Analytic 1748
|
|
340
|
+
Analytic 1689
|
|
341
|
+
Analytic 1847
|
|
342
|
+
Analytic 1673
|
|
343
|
+
Analytic 1685
|
|
344
|
+
Analytic 1733
|
|
345
|
+
Analytic 1723
|
|
346
|
+
Analytic 1654
|
|
347
|
+
Analytic 1648
|
|
348
|
+
Analytic 1659
|
|
349
|
+
Analytic 1804
|
|
350
|
+
Analytic 1805
|
|
351
|
+
Analytic 1693
|
|
352
|
+
Analytic 1703
|
|
353
|
+
Analytic 1658
|
|
354
|
+
Analytic 1691
|
|
355
|
+
Analytic 1701
|
|
356
|
+
Analytic 1790
|
|
357
|
+
Analytic 1671
|
|
358
|
+
Analytic 1708
|
|
359
|
+
Analytic 1732
|
|
360
|
+
Analytic 1756
|
|
361
|
+
Analytic 1821
|
|
362
|
+
Analytic 1783
|
|
363
|
+
Analytic 1851
|
|
364
|
+
Analytic 1826
|
|
365
|
+
Analytic 1700
|
|
366
|
+
Analytic 1749
|
|
367
|
+
Analytic 1787
|
|
368
|
+
Analytic 1667
|
|
369
|
+
Analytic 1852
|
|
370
|
+
Analytic 1846
|
|
371
|
+
Analytic 1721
|
|
372
|
+
Analytic 1730
|
|
373
|
+
Analytic 1806
|
|
374
|
+
Analytic 1686
|
|
375
|
+
Analytic 1742
|
|
376
|
+
Analytic 1761
|
|
377
|
+
Analytic 1824
|
|
378
|
+
Analytic 1677
|
|
379
|
+
Analytic 1828
|
|
380
|
+
Analytic 1812
|
|
381
|
+
Analytic 1683
|
|
382
|
+
Analytic 1752
|
|
383
|
+
Analytic 1779
|
|
384
|
+
Analytic 1724
|
|
385
|
+
Analytic 1776
|
|
386
|
+
Analytic 1675
|
|
387
|
+
Analytic 1848
|
|
388
|
+
Analytic 1784
|
|
389
|
+
Analytic 1815
|
|
390
|
+
Analytic 1744
|
|
391
|
+
Analytic 1751
|
|
392
|
+
Analytic 1680
|
|
393
|
+
Analytic 1661
|
|
394
|
+
Analytic 1800
|
|
395
|
+
Analytic 1743
|
|
396
|
+
Analytic 1794
|
|
397
|
+
Analytic 1726
|
|
398
|
+
Analytic 1842
|
|
399
|
+
Analytic 1715
|
|
400
|
+
Analytic 1840
|
|
401
|
+
Analytic 1839
|
|
402
|
+
Analytic 1710
|
|
403
|
+
Analytic 1786
|
|
404
|
+
Analytic 1646
|
|
405
|
+
Analytic 1699
|
|
406
|
+
Analytic 1698
|
|
407
|
+
Analytic 1825
|
|
408
|
+
Analytic 1728
|
|
409
|
+
Analytic 1754
|
|
410
|
+
Analytic 1785
|
|
411
|
+
Analytic 1651
|
|
412
|
+
Analytic 1653
|
|
413
|
+
Analytic 1650
|
|
414
|
+
Analytic 1811
|
|
415
|
+
Analytic 1765
|
|
416
|
+
Analytic 1771
|
|
417
|
+
Analytic 1682
|
|
418
|
+
Analytic 1690
|
|
419
|
+
Analytic 1833
|
|
420
|
+
Analytic 1741
|
|
421
|
+
Analytic 1652
|
|
422
|
+
Analytic 1645
|
|
423
|
+
Analytic 1802
|
|
424
|
+
Analytic 1803
|
|
425
|
+
Analytic 1770
|
|
426
|
+
Analytic 1775
|
|
427
|
+
Analytic 1676
|
|
428
|
+
Analytic 1796
|
|
429
|
+
Analytic 1753
|
|
430
|
+
Analytic 1757
|
|
431
|
+
Analytic 1835
|
|
432
|
+
Analytic 1843
|
|
433
|
+
Analytic 1678
|
|
434
|
+
Analytic 1827
|
|
435
|
+
Analytic 1684
|
|
436
|
+
Analytic 1841
|
|
437
|
+
Analytic 1853
|
|
438
|
+
Analytic 1745
|
|
439
|
+
Analytic 1767
|
|
440
|
+
Analytic 1713
|
|
441
|
+
Analytic 1647
|
|
442
|
+
Analytic 1817
|
|
443
|
+
Analytic 1697
|
|
444
|
+
Analytic 1781
|
|
445
|
+
Analytic 1668
|
|
446
|
+
Analytic 1854
|
|
447
|
+
Analytic 1692
|
|
448
|
+
Analytic 1707
|
|
449
|
+
Analytic 1702
|
|
450
|
+
Analytic 1709
|
|
451
|
+
Analytic 1694
|
|
452
|
+
Analytic 1660
|
|
453
|
+
Analytic 1791
|
|
454
|
+
Analytic 1780
|
|
455
|
+
Analytic 1793
|
|
456
|
+
Analytic 1822
|
|
457
|
+
Analytic 1722
|
|
458
|
+
Analytic 1731
|
|
459
|
+
Analytic 1849
|
|
460
|
+
Analytic 1656
|
|
461
|
+
Analytic 1772
|
|
462
|
+
Analytic 1850
|
|
463
|
+
Analytic 1655
|
|
464
|
+
Analytic 1674
|
|
465
|
+
Analytic 1666
|
|
466
|
+
Analytic 1663
|
|
467
|
+
Analytic 1670
|
|
468
|
+
Analytic 1664
|
|
469
|
+
Analytic 1782
|
|
470
|
+
Analytic 1797
|
|
471
|
+
Analytic 1695
|
|
472
|
+
Analytic 1809
|
|
473
|
+
Analytic 1739
|
|
474
|
+
Analytic 1834
|
|
475
|
+
Analytic 1818
|
|
476
|
+
Analytic 1755
|
|
477
|
+
Analytic 1830
|
|
478
|
+
Analytic 1681
|
|
479
|
+
Analytic 1798
|
|
480
|
+
Analytic 1657
|
|
481
|
+
Analytic 1716
|
|
482
|
+
Analytic 1777
|
|
483
|
+
Analytic 1746
|
|
484
|
+
Analytic 1810
|
|
485
|
+
Analytic 1813
|
|
486
|
+
Analytic 1706
|
|
487
|
+
Analytic 1758
|
|
488
|
+
Analytic 1712
|
|
489
|
+
Analytic 1837
|
|
490
|
+
Analytic 1838
|
|
491
|
+
Analytic 1844
|
|
492
|
+
Analytic 1823
|
|
493
|
+
Network Connection Creation
|
|
494
|
+
Network Traffic Content
|
|
495
|
+
Process Creation
|
|
496
|
+
System Settings
|
|
497
|
+
API Calls
|
|
498
|
+
Application Assets
|
|
499
|
+
Process Termination
|
|
500
|
+
Command Execution
|
|
501
|
+
Protected Configuration
|
|
502
|
+
Network Communication
|
|
503
|
+
Host Status
|
|
504
|
+
OS API Execution
|
|
505
|
+
Network Traffic Flow
|
|
506
|
+
Permissions Requests
|
|
507
|
+
System Notifications
|
|
508
|
+
Permissions Request
|
|
509
|
+
Process Metadata
|
|
510
|
+
Detection of Contact List
|
|
511
|
+
Detection of Phishing
|
|
512
|
+
Detection of Boot or Logon Initialization Scripts
|
|
513
|
+
Detection of Exploitation for Client Execution
|
|
514
|
+
Detection of Network Service Scanning
|
|
515
|
+
Detection of Call Log
|
|
516
|
+
Detection of System Information Discovery
|
|
517
|
+
Detection of Call Control
|
|
518
|
+
Detection of System Checks
|
|
519
|
+
Detection of Symmetric Cryptography
|
|
520
|
+
Detection of Abuse Accessibility Features
|
|
521
|
+
Detection of Calendar Entries
|
|
522
|
+
Detection of Disable or Modify Tools
|
|
523
|
+
Detection of Process Discovery
|
|
524
|
+
Detection of URI Hijacking
|
|
525
|
+
Detection of Disguise Root/Jailbreak Indicators
|
|
526
|
+
Detection of Native API
|
|
527
|
+
Detection of Compromise Software Supply Chain
|
|
528
|
+
Detection of Compromise Application Executable
|
|
529
|
+
Detection of Dynamic Resolution
|
|
530
|
+
Detection of Hide Artifacts
|
|
531
|
+
Detection of Generate Traffic from Victim
|
|
532
|
+
Detection of Input Injection
|
|
533
|
+
Detection of Data Encrypted for Impact
|
|
534
|
+
Detection of SMS Control
|
|
535
|
+
Detection of Input Capture
|
|
536
|
+
Detection of Geofencing
|
|
537
|
+
Detection of Exploitation for Initial Access
|
|
538
|
+
Detection of Bidirectional Communication
|
|
539
|
+
Detection of Indicator Removal on Host
|
|
540
|
+
Detection of Virtualization Solution
|
|
541
|
+
Detection of Internet Connection Discovery
|
|
542
|
+
Detection of Hooking
|
|
543
|
+
Detection of Device Lockout
|
|
544
|
+
Detection of Lockscreen Bypass
|
|
545
|
+
Detection of Software Packing
|
|
546
|
+
Detection of Unix Shell
|
|
547
|
+
Detection of Screen Capture
|
|
548
|
+
Detection of Web Protocols
|
|
549
|
+
Detection of Exploitation of Remote Services
|
|
550
|
+
Detection of Replication Through Removable Media
|
|
551
|
+
Detection of Audio Capture
|
|
552
|
+
Detection of Exfiltration Over C2 Channel
|
|
553
|
+
Detection of One-Way Communication
|
|
554
|
+
Detection of Device Administrator Permissions
|
|
555
|
+
Detection of Transmitted Data Manipulation
|
|
556
|
+
Detection of Steal Application Access Token
|
|
557
|
+
Detection of GUI Input Capture
|
|
558
|
+
Detection of Protected User Data
|
|
559
|
+
Detection of System Network Configuration Discovery
|
|
560
|
+
Detection of Steganography
|
|
561
|
+
Detection of Impair Defenses
|
|
562
|
+
Detection of File Deletion
|
|
563
|
+
Detection of SIM Card Swap
|
|
564
|
+
Detection of Uninstall Malicious Application
|
|
565
|
+
Detection of Ingress Tool Transfer
|
|
566
|
+
Detection of Exploitation for Privilege Escalation
|
|
567
|
+
Detection of User Evasion
|
|
568
|
+
Detection of Suppress Application Icon
|
|
569
|
+
Detection of Remote Device Management Services
|
|
570
|
+
Detection of Ptrace System Calls
|
|
571
|
+
Detection of Subvert Trust Controls
|
|
572
|
+
Detection of Command and Scripting Interpreter
|
|
573
|
+
Detection of Software Discovery
|
|
574
|
+
Detection of Web Service
|
|
575
|
+
Detection of Data Manipulation
|
|
576
|
+
Detection of Encrypted Channel
|
|
577
|
+
Detection of Account Access Removal
|
|
578
|
+
Detection of Non-Standard Port
|
|
579
|
+
Detection of Adversary-in-the-Middle
|
|
580
|
+
Detection of Prevent Application Removal
|
|
581
|
+
Detection of Clipboard Data
|
|
582
|
+
Detection of Obfuscated Files or Information
|
|
583
|
+
Detection of Compromise Client Software Binary
|
|
584
|
+
Detection of System Network Connections Discovery
|
|
585
|
+
Detection of Exfiltration Over Alternative Protocol
|
|
586
|
+
Detection of System Runtime API Hijacking
|
|
587
|
+
Detection of Execution Guardrails
|
|
588
|
+
Detection of Dead Drop Resolver
|
|
589
|
+
Detection of Access Notifications
|
|
590
|
+
Detection of Network Denial of Service
|
|
591
|
+
Detection of Supply Chain Compromise
|
|
592
|
+
Detection of Match Legitimate Name or Location
|
|
593
|
+
Detection of Proxy Through Victim
|
|
594
|
+
Detection of Accounts
|
|
595
|
+
Detection of Security Software Discovery
|
|
596
|
+
Detection of Download New Code at Runtime
|
|
597
|
+
Detection of Conceal Multimedia Files
|
|
598
|
+
Detection of Abuse Elevation Control Mechanism
|
|
599
|
+
Detection of Broadcast Receivers
|
|
600
|
+
Detection of Data from Local System
|
|
601
|
+
Detection of Virtualization/Sandbox Evasion
|
|
602
|
+
Detection of Application Layer Protocol
|
|
603
|
+
Detection of Impersonate SS7 Nodes
|
|
604
|
+
Detection of Code Signing Policy Modification
|
|
605
|
+
Detection of Location Tracking
|
|
606
|
+
Detection of SMS Messages
|
|
607
|
+
Detection of File and Directory Discovery
|
|
608
|
+
Detection of Credentials from Password Store
|
|
609
|
+
Detection of Keychain
|
|
610
|
+
Detection of Hijack Execution Flow
|
|
611
|
+
Detection of Archive Collected Data
|
|
612
|
+
Detection of Process Injection
|
|
613
|
+
Detection of Endpoint Denial of Service
|
|
614
|
+
Detection of Asymmetric Cryptography
|
|
615
|
+
Detection of Domain Generation Algorithms
|
|
616
|
+
Detection of Foreground Persistence
|
|
617
|
+
Detection of SSL Pinning
|
|
618
|
+
Detection of Exfiltration Over Unencrypted Non-C2 Protocol
|
|
619
|
+
Detection of Compromise Software Dependencies and Development Tools
|
|
620
|
+
Detection of Remote Access Software
|
|
621
|
+
Detection of Drive-By Compromise
|
|
622
|
+
Detection of Video Capture
|
|
623
|
+
Detection of Masquerading
|
|
624
|
+
Detection of Stored Application Data
|
|
625
|
+
Detection of Out of Band Data
|
|
626
|
+
Detection of Application Versioning
|
|
627
|
+
Detection of Scheduled Task/Job
|
|
628
|
+
Detection of Compromise Hardware Supply Chain
|
|
629
|
+
Detection of Linked Devices
|
|
630
|
+
Detection of Wi-Fi Discovery
|
|
631
|
+
Detection of Keylogging
|
|
632
|
+
Detection of Data Destruction
|
|
633
|
+
Detection of Event Triggered Execution
|
|
634
|
+
Initial Access
|
|
635
|
+
Exfiltration
|
|
636
|
+
Persistence
|
|
637
|
+
Privilege Escalation
|
|
638
|
+
Command and Control
|
|
639
|
+
Execution
|
|
640
|
+
Impact
|
|
641
|
+
Credential Access
|
|
642
|
+
Collection
|
|
643
|
+
Lateral Movement
|
|
644
|
+
Defense Evasion
|
|
645
|
+
Discovery
|