DOCSEARCHbyAlgolia
Submit Docs

MITRE ATT&CK STIX Data

repository·master·Indexed 20 days ago

https://github.com/mitre-attack/attack-stix-data

The MITRE ATT&CK dataset provided in STIX 2.1 JSON format, organized into collections for Enterprise, Mobile, and ICS domains. This repository includes machine-readable collection indexes (index.json) for automated data consumption and utilities for generating indexes and converting them to Markdown. It provides guidance on accessing data via the cti-python-stix2 library, using MemoryStore for local or remote GitHub files, and querying objects by STIX ID, ATT&CK ID, name, or alias.

Tokens
7K
Snippets
24
Records
29
Agent score
70%

What's inside attack-stix-data

  1. Overview of ATT&CK® STIX Data

    master

    This repository provides the MITRE ATT&CK dataset represented as STIX 2.1 JSON collections. It is designed for sharing cyber threat intelligence (CTI) in a consistent, machine-readable format.

    Key features include:

    • STIX 2.1 Format: Uses the latest STIX standard for serialization.
    • Collections: Data is organized into 'collections' which represent specific releases of the ATT&CK domains (Enterprise, Mobile, and ICS).
    • Versioning: Supports both specific historical releases (e.g., v9.0) and a pointer to the most recent release.

    Note: If you require STIX 2.0 JSON, use the MITRE/CTI repository instead, as this repository focuses on STIX 2.1 and the collections feature.

  2. Combine multiple ATT&CK domains using CompositeDataSource

    master

    ATT&CK data is partitioned into multiple domains (e.g., enterprise-attack, mobile-attack, and ics-attack). To query across all domains simultaneously, use stix2.CompositeDataSource to merge multiple DataStore objects into one.

    from stix2 import CompositeDataSource

# Assuming enterprise_attack_src, mobile_attack_src, and ics_attack_src 
# are already loaded MemoryStore objects
src = CompositeDataSource()
src.add_data_sources([enterprise_attack_src, mobile_attack_src, ics_attack_src])

# 'src' can now be used as a single DataStore for all domains

  3. Understand the Repository Structure

    master

    The repository is organized by ATT&CK domain, with each domain containing its own STIX 2.1 collection bundles.

    • enterprise-attack/: Contains Enterprise ATT&CK collections.
      • enterprise-attack.json: Always points to the most recent Enterprise release.
      • enterprise-attack-9.0.json: A specific versioned release.
    • mobile-attack/: Contains Mobile ATT&CK releases.
    • ics-attack/: Contains ATT&CK for ICS releases.
    • index.json: A machine-readable JSON file listing all collections in the repository.
    • index.md: A human-readable markdown file listing all collections.
    .
├─ enterprise-attack ∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙ [1] Collection folder for Enterprise
│   ├─ enterprise-attack.json ∙∙∙∙∙∙∙∙∙∙∙∙∙∙ [2] Most recent Enterprise release
│   ├─ enterprise-attack-9.0.json ∙∙∙∙∙∙∙∙∙∙∙∙∙∙ [3] Enterprise ATT&CK v9.0 collection
│   └─ [other releases of Enterprise ATT&CK]
├─ mobile-attack
│   └─ [Mobile ATT&CK releases]
├─ ics-attack
│   └─ [ATT&CK for ICS releases]
├─ index.json ∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙ [4] Collection index JSON
└─ index.md ∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙∙ [5] Collection index markdown

  4. Use Collection Indexes for automated data consumption

    master

    Collection indexes are JSON-formatted lists used to ease the distribution of ATT&CK data to consumers. They track individual releases (e.g., Enterprise v7, v8, v9) and allow applications to programmatically check if new releases have been published.

    To automate your data ingestion, use the index.json file provided in the repository. This allows your application to monitor the repository for updates without manual inspection.

  5. Access local ATT&CK STIX files via MemoryStore

    master

    You can load local copies of the ATT&CK STIX data into a stix2.MemoryStore. This is useful for offline access or when you need a static version of the catalog to ensure workflow stability.

    Access the most recent version

    Load the main JSON file for the domain (e.g., enterprise-attack/enterprise-attack.json).

    Access a specific version

    Load the file corresponding to a specific version number (e.g., enterprise-attack/enterprise-attack-18.0.json).

    from stix2 import MemoryStore
import os

# Access the most recent version
src = MemoryStore()
src.load_from_file("enterprise-attack/enterprise-attack.json")

# Access a specific version
def get_attack_version(domain, version):
    """get ATT&CK STIX data for a given domain and version. Domain should be 'enterprise-attack', 'mobile-attack' or 'ics-attack'."""
    ms = MemoryStore()
    ms.load_from_file(os.path.join(domain, f"{domain}-{version}.json"))
    return ms

src = get_attack_version("enterprise-attack", "18.0")

  7. Install the ATT&CK STIX Data utilities

    master

    To use the maintenance utilities, you must have python3 installed. Follow these steps to set up a local virtual environment and install the necessary dependencies:

    1. Create a virtual environment:
      • macOS and Linux: python3 -m venv env
      • Windows: py -m venv env
    2. Activate the virtual environment:
      • macOS and Linux: source env/bin/activate
      • Windows: env/Scripts/activate.bat
    3. Install requirements: pip3 install -r util/requirements.txt
    python3 -m venv env
source env/bin/activate
pip3 install -r util/requirements.txt

  8. Set up a Python environment for ATT&CK data

    master

    Before working with ATT&CK STIX data, it is recommended to set up a virtual environment to manage dependencies like stix2 and taxii2client.

    macOS and Linux:

    python3 -m venv env
source env/bin/activate

    Windows:

    py -m venv env
env/Scripts/activate.bat
    # macOS and Linux
python3 -m venv env
source env/bin/activate

# Windows
py -m venv env
env/Scripts/activate.bat

  9. Build relationship lookup tables with a Relationships microlibrary

    master

    When working with ATT&CK STIX data, you often need to parse relationships between objects (e.g., which intrusion-set uses which malware). A common pattern is to build a lookup table mapping a STIX ID to its related objects and the relationship itself.

    To ensure data quality, it is recommended to filter out objects that are marked as revoked or x_mitre_deprecated. The provided microlibrary uses a MemoryStore to build these mappings efficiently.

    from pprint import pprint
from stix2 import MemoryStore, Filter

# Example of how to initialize and use the library
src = MemoryStore()
src.load_from_file("path/to/enterprise-attack.json")

# Using a helper function (like software_used_by_groups) to get mappings
group_id_to_software = software_used_by_groups(src)
pprint(group_id_to_software["intrusion-set--2a158b0a-7ef8-43cb-9985-bf34d1e12050"])

  10. Filter out revoked and deprecated ATT&CK objects

    master

    ATT&CK objects that are no longer maintained are marked with either x_mitre_deprecated: true or revoked: true. To ensure your workflows only use current data, you should filter these objects out of your queries. Because these fields may not be present in all JSON objects, use the .get() method with a default value of False when checking their status.

    from stix2 import Filter

def remove_revoked_deprecated(stix_objects):
    """Remove any revoked or deprecated objects from queries made to the data source"""
    # Note we use .get() because the property may not be present in the JSON data. The default is False
    # if the property is not set.
    return list(
        filter(
            lambda x: x.get("x_mitre_deprecated", False) is False and x.get("revoked", False) is False,
            stix_objects
        )
    )

# Example usage:
mitigations = src.query([ Filter("type", "=", "course-of-action") ])
mitigations = remove_revoked_deprecated(mitigations)

  11. Access live ATT&CK data from GitHub via requests

    master

    To always work with the most up-to-date version without manual downloads, you can fetch the STIX data directly from GitHub using the requests library and load it into a MemoryStore.

    import requests
from stix2 import MemoryStore

# Access the most recent version from GitHub
def get_data_from_branch(domain):
    """get the ATT&CK STIX data from GitHub. Domain should be 'enterprise-attack', 'mobile-attack' or 'ics-attack'."""
    stix_json = requests.get(f"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/{domain}/{domain}.json").json()
    return MemoryStore(stix_data=stix_json["objects"])

src = get_data_from_branch("enterprise-attack")

# Access a specific version from GitHub
def get_data_from_version(domain, version):
    """get the ATT&CK STIX data for the given version from GitHub."""
    stix_json = requests.get(f"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/{domain}/{domain}-{version}.json").json()
    return MemoryStore(stix_data=stix_json["objects"])

src = get_data_from_version("enterprise-attack", "18.0")

  12. Find the replacement for a revoked ATT&CK object

    master

    When an object is replaced, it is marked as revoked: true and a STIX relationship of type revoked-by is created. In this relationship, the source_ref is the old (revoked) object and the target_ref is the new (replacing) object. You can follow this relationship to programmatically find the current version of a revoked object.

    from stix2 import Filter

def getRevokedBy(stix_id, thesrc):
    relations = thesrc.relationships(stix_id, 'revoked-by', source_only=True)
    revoked_by = thesrc.query([
        Filter('id', 'in', [r.target_ref for r in relations]),
        Filter('revoked', '=', False)
    ])
    if revoked_by is not None:
        revoked_by = revoked_by[0]

    return revoked_by

# Example usage:
getRevokedBy("attack-pattern--c16e5409-ee53-4d79-afdc-4099dc9292df", src)