Skip to content

Commit 9bffc65

Browse files
isaisabelisaisabel
authored
Merge pull request #185 from mitre-attack/fix/#183-tactics-count
Fix/#183 tactics count
2 parents 82d24bb + b0ae1f6 commit 9bffc65

File tree

3 files changed

+31
-36
lines changed

3 files changed

+31
-36
lines changed

‎CHANGELOG.md

+1
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@
5151
- Fixed a crash that occurred when building the site with mitigations that have no relationships with techniques. See issue [#153](https://github.com/mitre-attack/attack-website/issues/153).
5252
- Fixed outdated ATT&CK Navigator link on the contact page. See issue [#143](https://github.com/mitre-attack/attack-website/issues/143).
5353
- Updated incorrect technique count on March 2020 update. See issue [#141](https://github.com/mitre-attack/attack-website/issues/141).
54+
- Fixed number of tactics displayed on tactics overview pages. See issue [#183](https://github.com/mitre-attack/attack-website/issues/183).
5455

5556
## ATT&CK Website version 2.0
5657
### New Features

‎attack-theme/templates/resources/contribute.html

+29-35
Original file line numberDiff line numberDiff line change
@@ -16,31 +16,22 @@
1616

1717
<div class="card mb-4 danger-card">
1818
<div class="card-header">
19-
<h5 class="mb-0">November 2019 Contribution Update</h5>
19+
<h5 class="mb-0">April 2020 Contribution Update</h5>
2020
</div>
2121
<div class="card-body">
2222
<!-- <div class="card-title">
2323
</div> -->
24-
<p class="card-text">
25-
Due to the major change to ATT&CK with the addition of sub-techniques, we are asking for the community’s patience
26-
because we will be delayed in incorporating contributions into Enterprise and PRE-ATT&CK over the next several months until we complete the sub-technique
27-
migration. You can read more about sub-techniques and why this is such a big change for ATT&CK <a href="https://medium.com/mitre-attack/attack-sub-techniques-preview-b79ff0ba669a">here</a>.
28-
For new technique contributions, you may continue to send them to <a href="mailto:[email protected]">[email protected]</a>,
29-
but please keep in mind that we may not reply for several months as we work to include contributions into the sub-technique
30-
refactoring. Contributions for Mobile will continue as normal. For new Group and Software contributions to Enterprise or PRE-ATT&CK, we ask that you please temporarily put a hold on sending these to us
31-
until we make the change to sub-techniques.
32-
(This will allow us to focus on migrating existing Groups and Software, as new contributions would add to our workload.)
33-
We do appreciate your contributions and feedback, but ask for your patience and understanding over the next several months
34-
as we focus all our efforts on adding sub-techniques.
35-
</p>
3624
<p class="card-text">
37-
If you send technique contributions, it may take us several months to get back to you. We may ask you follow-up questions
38-
to help us understand your contribution and gather additional information.
39-
We recommend you read our <a href="/docs/ATTACK_Design_and_Philosophy_March_2020.pdf">philosophy paper</a> to understand our approach to maintaining ATT&CK so that we get the right
40-
details up front. If we find the contribution fills a gap, then we will make edits and send you a draft version of the
41-
technique page for your review prior to it being published, listing you as a contributor if desired. The next content update
42-
will not be until 2020 and will be in a parallel site to attack.mitre.org to allow the community time to incorporate
43-
sub-techniques.
25+
We recently released a beta version of <a href="https://attack.mitre.org/beta/">ATT&CK with sub-techniques</a>
26+
and published <a href="https://medium.com/mitre-attack/attack-subs-what-you-need-to-know-99bce414ae0b">a blog post</a>
27+
describing the resulting changes. We haven’t been adding technique, group, or software contributions while we were
28+
implementing sub-techniques, resulting in a decent sized backlog since the last update in October 2019.
29+
We will be working through that backlog now and are accepting contributions again for techniques, groups and software.
30+
As stated in our blog post, <b>any new content in ATT&CK will only be added to the sub-technique version.</b> If you are contributing techniques we'd ask
31+
that you look if the behavior might be an appropriate sub-technique <a href="https://attack.mitre.org/beta/techniques/enterprise/">
32+
of an existing technique</a>. If you are contributing groups
33+
or software entries, we’d ask you to leverage <a href="https://attack.mitre.org/beta/">the sub-technique version of ATT&CK</a>.
34+
New contributions will next be reflected when ATT&CK with sub-techniques goes live, currently slated for early July.
4435
</p>
4536
</div>
4637
</div>
@@ -69,36 +60,36 @@ <h1 class="blog-post-title mb-4">Contribute</h1>
6960
</p>
7061
<h4 class="contribution-headers">Contributing to ATT&amp;CK</h4>
7162
<div class="bs-callout bs-callout-success">
72-
<h5 class="contribution-headers">Techniques</h5>
63+
<h5 class="contribution-headers">Sub-Techniques and Techniques</h5>
7364
<p>
7465
We appreciate your help to let us know about what new techniques and technique variations adversaries
75-
and red teamers are using. You can start by emailing us the technique name, a brief description, and
76-
references or knowledge about how it is being used by adversaries or red teams.
66+
are using in the wild. You can start by emailing us the technique name, a brief description, and
67+
references or knowledge about how it is being used by adversaries.
7768
We suggest you take a close look at what we already have on our site, paying attention
78-
to the level of abstraction of techniques. Since we are working on adding new technique details
69+
to the level of abstraction of techniques and sub-techniques. Since we are working on adding new technique details
7970
constantly, we will deconflict what you send with what we’re working on. We’ll provide feedback
8071
and work with you to get the content added.
8172
</p>
8273
</div>
8374

8475
<div class="bs-callout bs-callout-primary">
85-
<h5 class="contribution-headers">macOS and Linux</h5>
76+
<h5 class="contribution-headers">macOS, Linux, cloud, and ICS</h5>
8677
<p>
87-
While we are looking for new techniques for Windows, macOS, and Linux, we are interested in macOS and Linux
88-
techniques in particular since there is a lack of publicly available threat intel for techniques used against
89-
those systems. This leads to gaps in the knowledge base that you can help fill.
78+
While we also cover the Windows and mobile platforms, we are particularly interested in new macOS, Linux, cloud, and ICS techniques
79+
since there is a lack of publicly available threat intel for techniques used against
80+
those platforms. This leads to gaps in the knowledge base that you can help fill.
9081
</p>
9182
</div>
9283

9384
<div class="bs-callout bs-callout-info">
94-
<h5 class="contribution-headers">Threat Intelligence (Contributions paused until early 2020 due to sub-technique migration)</h5>
85+
<h5 class="contribution-headers">Threat Intelligence</h5>
9586
<p>
9687
We map Group and Software examples on our site, and there is too much open source threat intelligence
9788
reporting for us to keep up on everything. We appreciate your help with referenced information about
9889
how Groups and Software samples use ATT&CK techniques.
9990
Threat intelligence contributions are most helpful to us when they are in the specific format we have
10091
on our website, including citing techniques and group names or associated groups to
101-
publicly-available references. We ask that you provide the technique name, a brief description of
92+
publicly-available references. We ask that you provide the sub-technique or technique name, a brief description of
10293
how the technique is implemented, and the publicly-available reference.
10394
</p>
10495
</div>
@@ -125,7 +116,7 @@ <h4 class="contribution-headers">Contribution Examples</h4>
125116
<h5>New Technique Example</h5>
126117
<div class="example-container">
127118
<div class="examples-div">
128-
<h6 class="example-fields">Technique Name:</h6>
119+
<h6 class="example-fields">(Sub-)Technique Name:</h6>
129120
<p class="examples-p mr-0">COM, ROM, & BE GONE </p>
130121
<h6 class="margin-contribute-a example-fields">Tactic:</h6>
131122
<p class="examples-p">Persistence</p>
@@ -136,13 +127,16 @@ <h6 class="example-fields">Platform:</h6>
136127
<h6 class="margin-contribute-b example-fields">Required Permissions:</h6>
137128
<p class="examples-p mr-0">User</p>
138129
</div>
130+
<p class="examples-p mr-0 ml-0">
131+
<span class="example-fields">Sub-techniques:</span> This is a sub-technique of T1XXX, or this would have T1XXX as a sub-technique
132+
</p>
139133
<p class="examples-p mr-0 ml-0">
140134
<span class="example-fields">Data Sources:</span> Windows API, Process monitoring,
141135
or other sources that can be used to detect this activity
142136
</p>
143137
<p class="examples-p mr-0 ml-0">
144138
<span class="example-fields">Description:</span> Component Object Model (COM) servers
145-
associated with Graphics Interchange Format (GIF) image viewers can be abused to corrupt arbitrary memory banks. Adversaries may leverage this opportunity to modify, mux, and maliciously annoy (MMA) read-only memory (ROM) regularly accessed during normal system operations.
139+
associated with Graphics Interchange Format (JIF) image viewers can be abused to corrupt arbitrary memory banks. Adversaries may leverage this opportunity to modify, mux, and maliciously annoy (MMA) read-only memory (ROM) regularly accessed during normal system operations.
146140
</p>
147141
<p class="examples-p mr-0 ml-0">
148142
<span class="example-fields">Detection:</span> Monitor the JIF viewers for muxing
@@ -168,7 +162,7 @@ <h6 class="margin-contribute-b example-fields">Required Permissions:</h6>
168162
</div>
169163

170164
<div class="new-examples second-example">
171-
<h5>Group & Software Example (Contributions paused until early 2020 due to sub-technique migration)</h5>
165+
<h5>Group & Software Example</h5>
172166
<div class="example-container">
173167
<p class="examples-p mr-0 ml-0">
174168
<span class="example-fields">Group Name:</span> FUZZYSNUGGLYDUCK (www[.]sourceX[.]com)
@@ -186,7 +180,7 @@ <h5>Group & Software Example (Contributions paused until early 2020 due to sub-t
186180
<h6 class="nested-examples-div example-fields">Techniques:</h6>
187181
<ul>
188182
<li>
189-
Spearphishing Attachment (T1193) – FUZZYSNUGGLYDUCK has used spearphishing
183+
Phishing: Spearphishing Attachment (T1566.001) – FUZZYSNUGGLYDUCK has used spearphishing
190184
email attachments containing images of stale bread to deliver malware. (www[.]sourceX[.]com)
191185
</li>
192186
<li>
@@ -218,7 +212,7 @@ <h6 class="nested-examples-div example-fields">Techniques:</h6>
218212
<h6 class="example-fields">Techniques:</h6>
219213
<ul>
220214
<li>
221-
Registry Run Keys / Start Folder (T1060) – FLYINGV has added
215+
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001) – FLYINGV has added
222216
the Registry Run key “HueyDeweyLouie” to establish persistence. (www[.]sourceX[.]com)
223217
</li>
224218
<li>

‎modules/tactic.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ def generate_domain_markdown(domain, techniques_no_sub, tactics, side_nav_data):
4545
# Write out the markdown file for overview of domain
4646
data = {
4747
'domain': domain.split("-")[0],
48-
'tactics_list_len': str(len(tactics))
48+
'tactics_list_len': str(len(tactics[domain]))
4949
}
5050

5151
data['side_menu_data'] = side_nav_data

0 commit comments

Comments
 (0)