|
When
|
Duration
i
Indicates the duration of the attack within the given scenario.
Short: Seconds to minutes
Medium: Minutes to hours
Long: Hours to days
Very Long: Days to weeks or longer
|
|
|
When
|
Attack Steps
i
Indicates which steps occurred during the attack in the given scenario.
Select all steps that apply to the attack.
Reconnaissance: Gathering information about the target (e.g., systems, users, network structure).
Resource Development: Preparing resources for the attack (e.g., creating malware, setting up infrastructure, acquiring credentials).
Exploit: Actively exploiting a vulnerability or executing malicious code to gain access.
Pivot: Using a compromised system to move into another network or environment.
Lateral Movement: Moving within a network to access additional systems or accounts.
Impact: Achieving the final objective of the attack (e.g., data destruction, service disruption, data encryption, or exfiltration consequences).
|
|
|
Where
|
Stealth Level
i
Indicates how detectable the attack is by users or security systems.
Low: Easily noticeable (e.g., visible pop-ups, system crashes, obvious alerts).
Medium: Partially hidden, but detectable with standard monitoring or attentive users.
High: Highly stealthy and difficult to detect, often requiring advanced security tools or detailed analysis.
|
|
|
Where
|
Detection Method
i
Describes how this attack could be detected using monitoring or analysis techniques. Select all that apply.
Signature-Based Detection: Identifying known attack patterns or signatures (e.g., malware hashes, known indicators of compromise).
Anomaly Detection: Detecting deviations from normal system or user behavior.
Network Traffic Monitoring: Detecting unusual or suspicious network activity (e.g., unexpected connections, data transfers).
Resource Usage Monitoring: Identifying abnormal CPU, GPU, or memory usage caused by malicious activity.
System Log Monitoring: Analyzing logs for suspicious events or anomalies (e.g., login attempts, process execution).
Behavioral Pattern Analysis: Detecting unusual sequences of actions or behaviors across systems or users.
|
|
|
How
|
Communication Path
i
Describes the communication channel or infrastructure used by the attack to transfer data or commands. Select all that apply.
Local Endpoint: Communication occurs within the same device (e.g., local processes, inter-process communication).
Internal Network: Communication within a private or organizational network (e.g., lateral movement between systems).
Web Infrastructure: Communication over the internet via web-based services or protocols (e.g., HTTP/HTTPS, web servers).
Cloud Services: Communication through cloud-based platforms or services (e.g., SaaS, storage services, APIs).
|
|
|
Who
|
User Interaction Required
i
Indicates whether the attack depends on user actions, such as clicking a link or opening a file.
|
|
|
How
|
Supply Chain Involvement
i
Indicates whether the attack involves components from the software or service supply chain.
None: The attack does not rely on any third-party or external components.
Third-Party Software: Exploiting or abusing external software provided by vendors (e.g., installed applications, platforms).
External Libraries: Targeting or compromising dependencies such as libraries, packages, or modules used by software.
CI/CD Pipeline: Manipulating build, integration, or deployment processes to introduce malicious code or artifacts.
|
|
|
How
|
Attack Vector
i
Indicates the attack vectors used during the attack in the given scenario. Select all that apply.
Attack vectors describe the paths or methods used by the attacker to access or interact with the target at any stage of the attack.
Network Access: Exploiting exposed services or vulnerabilities over a network connection.
Phishing: Using social engineering techniques (e.g., emails, messages) to trick users into revealing information or executing actions.
Scripting / Exploitation: Using scripts or code to exploit vulnerabilities or execute malicious actions.
Physical Access: Gaining access through physical interaction with a device or system.
Credential Access: Using stolen, guessed, or leaked credentials to gain access.
Supply Chain Attack: Compromising the target through third-party software, services, or dependencies.
|
|
|
How
|
Level of Automation
i
Indicates the extent to which the attack is automated by the attacker.
Manual: The attacker performs actions directly without automation.
Semi-Automated: The attacker uses tools or scripts but still requires manual interaction or decision-making.
Fully Automated: The attack step is executed automatically with little or no human intervention.
|
|
|
With what
|
Execution / Delivery Mechanism Type
i
Describes the type of mechanism or software used to execute or deliver the attack. Select all that apply.
Custom Malicious Code: Tailored or attacker-developed code designed specifically for the attack.
Commodity Malware: Widely available or reused malware not specifically developed for this target.
Legitimate Software Abuse: Misuse of legitimate tools or software for malicious purposes (e.g., living-off-the-land techniques).
Adware: Software primarily designed to display advertisements, potentially abused for malicious purposes.
In-Person / Physical Interaction: Execution or delivery through direct physical interaction (e.g., USB devices, hands-on access).
|
|
|
With what
|
Attacker Tools
i
Specifies the concrete tools or resources used by the attacker to execute the attack. Select all that apply.
Scripts: Custom or generic scripts used to automate tasks or execute commands.
Custom Malware: Malware specifically developed or tailored for the attack.
Living-off-the-Land Tools: Legitimate system tools or utilities abused for malicious purposes (e.g., PowerShell, Bash).
Exploit Kit: Pre-packaged tools designed to exploit known vulnerabilities automatically.
Other: Any additional tools not covered by the categories above.
|
|
|
Custom 1
|
Custom Criterion 1
|
Custom Expressions 1
|
|
Custom 2
|
Custom Criterion 2
|
Custom Expressions 2
|
|
Custom 3
|
Custom Criterion 3
|
Custom Expressions 3
|