Questions tagged [mitre]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2 votes
1 answer
128 views

Is it wrong to refer to ptrace process injection as process hollowing

ATT&CK defines process injection sub-technique 012 Process Hollowing different from sub-technique 008 Ptrace system calls. With this in mind, if I write some fancy shellcode into the .text segment ...
R-Rothrock's user avatar
0 votes
0 answers
63 views

Proof of concept: Services File Permissions Weakness (T1574.010)

I am trying to do a proof of concept where I use technique T1574.010. In this technique, I should rewrite the binpath of some service in Windows 10 so that when the service starts again the payload ...
P00's user avatar
  • 1
1 vote
0 answers
87 views

How to find out what Microsoft 365 Defender is monitoring?

I am currently analyzing our security landscape with the help of the MITRE ATT&CK Framework. Most techniques have ways to "Mitigate" and to "Detect" it, and one of the most ...
Unbuckle's user avatar
0 votes
1 answer
508 views

CVSS v3 and v3.1 Missing temporal metrics (Exploit Code Maturity and Remediation Level) in all CVEs using NVD API

I have been working with the NIST - NVD API v2 and I have noticed that the temporal metrics "remediationLevelType" and "exploitCodeMaturityType" are missing in ALL CVEs that I have ...
Tlopasha's user avatar
1 vote
1 answer
124 views

MITRE ATT&CK Design and Philosophy doc: "Process hollowing sub-technique can't be under Priviledge Escalation tactic"

I'm new to the MITRE ATT&CK framework, and am familiarizing myself with it by reading the Design and philosophy document (2020). I'm not sure if the, boldfaced part of the, following passage (p.13)...
Mussé Redi's user avatar
1 vote
0 answers
185 views

MITRE ATT&CK framework concept doubts between tactics

I am studying the MITRE ATT&CK framework and I am confused with the following tactics: Reconnaissance, Discovery, and Resource Development. What are the differences between these 3 tactics? ...
Jask_Skull's user avatar
1 vote
1 answer
114 views

Is it called Drive-by Compromise if attacker provided his website for user to access?

If the website is legitimate and the attacker exploited that legitimate website, and the attacker gains access to a victim's system that visits the website, then it is a drive-by compromise. However, ...
TIMOTHY LIM's user avatar
0 votes
0 answers
219 views

Why does Mitre T1203 technique includes macros as software vulnerabilities?

I was reading a recent report about an APT and jumped into this Technique: https://attack.mitre.org/techniques/T1203/ This technique is called: Exploitation for Client Execution And that might match ...
borcho's user avatar
  • 590
2 votes
1 answer
2k views

What is the difference between ATT&CK and CAPEC?

My question is on Cyber Threat Intelligence (CTI). I want to know the difference between Attack Patterns (as in MITRE CAPEC) and Tactics, Techniques and Procedures (as in MITRE ATT&CK). They both ...
JacopoStanchi's user avatar
0 votes
0 answers
2k views

Is there a way to map each CVE to a technique/tactic in the mitre ATT&CK matrix?

The only 'solution' I thought of is linking a CVE to a CWE and then to a CAPEC (Method found in this link: How to find CAPEC items related to a CVE) but I am unable to get from a CAPEC attack pattern ...
Xin's user avatar
  • 1
2 votes
1 answer
338 views

What does "Obtaining a CVE" mean

I've have seen the term around and I mostly get that it is referred to when someone reports a vulnerability to Mitre. But what does this mean practically? Are you listed somewhere as the reporter? ...
Artog's user avatar
  • 290
5 votes
1 answer
1k views

How long it takes to receive CVE-ID from cve.mitre.org?

I had applied for CVE ID at https://cveform.mitre.org/. I did followed their guidelines, and did exactly as their instructions said (didn't add PGP key as it seems optional). It's been 2 month since ...
Фывфыв Фывфыв's user avatar
2 votes
1 answer
166 views

What's the difference between OVAL definitions, objects, and tests?

I'm trying to become more familiar with OVAL tst def and obj references in joval xml definition files. For example, I'll see stuff like: <criterion comment="Foo" test_ref="oval:org.mitre.oval:...
Mike B's user avatar
  • 3,458