{
  "name": "DarkStrata credential-exposure findings",
  "versions": {
    "attack": "20",
    "navigator": "5.3.2",
    "layer": "4.5"
  },
  "domain": "enterprise-attack",
  "description": "ATT&CK techniques DarkStrata tags on credential-exposure findings. Score = number of finding classes that can carry the tag. Generated from packages/database/src/mitre.ts.",
  "sorting": 0,
  "hideDisabled": false,
  "techniques": [
    {
      "techniqueID": "T1110.004",
      "score": 1,
      "comment": "inferred",
      "enabled": true,
      "showSubtechniques": false,
      "metadata": [
        {
          "name": "finding class",
          "value": "Customer logins at stuffing volume"
        }
      ]
    },
    {
      "techniqueID": "T1528",
      "score": 4,
      "comment": "observed",
      "enabled": true,
      "showSubtechniques": false,
      "metadata": [
        {
          "name": "finding class",
          "value": "Stealer log, fresh infection"
        },
        {
          "name": "finding class",
          "value": "Stealer log, password also breached"
        },
        {
          "name": "finding class",
          "value": "Stealer log, limited data"
        },
        {
          "name": "finding class",
          "value": "Customer logins at stuffing volume"
        },
        {
          "name": "files_found",
          "value": "discord_tokens, telegram, messaging"
        }
      ]
    },
    {
      "techniqueID": "T1539",
      "score": 4,
      "comment": "observed",
      "enabled": true,
      "showSubtechniques": false,
      "metadata": [
        {
          "name": "finding class",
          "value": "Stealer log, fresh infection"
        },
        {
          "name": "finding class",
          "value": "Stealer log, password also breached"
        },
        {
          "name": "finding class",
          "value": "Stealer log, limited data"
        },
        {
          "name": "finding class",
          "value": "Customer logins at stuffing volume"
        },
        {
          "name": "files_found",
          "value": "cookies"
        }
      ]
    },
    {
      "techniqueID": "T1552.001",
      "score": 4,
      "comment": "observed",
      "enabled": true,
      "showSubtechniques": false,
      "metadata": [
        {
          "name": "finding class",
          "value": "Stealer log, fresh infection"
        },
        {
          "name": "finding class",
          "value": "Stealer log, password also breached"
        },
        {
          "name": "finding class",
          "value": "Stealer log, limited data"
        },
        {
          "name": "finding class",
          "value": "Customer logins at stuffing volume"
        },
        {
          "name": "files_found",
          "value": "vpn, ftp_clients, wifi"
        }
      ]
    },
    {
      "techniqueID": "T1552.004",
      "score": 4,
      "comment": "observed",
      "enabled": true,
      "showSubtechniques": false,
      "metadata": [
        {
          "name": "finding class",
          "value": "Stealer log, fresh infection"
        },
        {
          "name": "finding class",
          "value": "Stealer log, password also breached"
        },
        {
          "name": "finding class",
          "value": "Stealer log, limited data"
        },
        {
          "name": "finding class",
          "value": "Customer logins at stuffing volume"
        },
        {
          "name": "files_found",
          "value": "ssh_keys"
        }
      ]
    },
    {
      "techniqueID": "T1555",
      "score": 4,
      "comment": "observed",
      "enabled": true,
      "showSubtechniques": true,
      "metadata": [
        {
          "name": "finding class",
          "value": "Stealer log, fresh infection"
        },
        {
          "name": "finding class",
          "value": "Stealer log, password also breached"
        },
        {
          "name": "finding class",
          "value": "Stealer log, limited data"
        },
        {
          "name": "finding class",
          "value": "Customer logins at stuffing volume"
        },
        {
          "name": "files_found",
          "value": "two_factor, email_clients"
        }
      ]
    },
    {
      "techniqueID": "T1555.003",
      "score": 4,
      "comment": "observed",
      "enabled": true,
      "showSubtechniques": false,
      "metadata": [
        {
          "name": "finding class",
          "value": "Stealer log, fresh infection"
        },
        {
          "name": "finding class",
          "value": "Stealer log, password also breached"
        },
        {
          "name": "finding class",
          "value": "Stealer log, limited data"
        },
        {
          "name": "finding class",
          "value": "Customer logins at stuffing volume"
        }
      ]
    },
    {
      "techniqueID": "T1555.005",
      "score": 4,
      "comment": "observed",
      "enabled": true,
      "showSubtechniques": false,
      "metadata": [
        {
          "name": "finding class",
          "value": "Stealer log, fresh infection"
        },
        {
          "name": "finding class",
          "value": "Stealer log, password also breached"
        },
        {
          "name": "finding class",
          "value": "Stealer log, limited data"
        },
        {
          "name": "finding class",
          "value": "Customer logins at stuffing volume"
        },
        {
          "name": "files_found",
          "value": "password_managers"
        }
      ]
    },
    {
      "techniqueID": "T1589.001",
      "score": 7,
      "comment": "observed",
      "enabled": true,
      "showSubtechniques": false,
      "metadata": [
        {
          "name": "finding class",
          "value": "Stealer log, fresh infection"
        },
        {
          "name": "finding class",
          "value": "Stealer log, password also breached"
        },
        {
          "name": "finding class",
          "value": "Stealer-channel combolist"
        },
        {
          "name": "finding class",
          "value": "Stealer log, limited data"
        },
        {
          "name": "finding class",
          "value": "Customer logins at stuffing volume"
        },
        {
          "name": "finding class",
          "value": "Breach record with password"
        },
        {
          "name": "finding class",
          "value": "Combolist"
        }
      ]
    },
    {
      "techniqueID": "T1589.002",
      "score": 1,
      "comment": "observed",
      "enabled": true,
      "showSubtechniques": false,
      "metadata": [
        {
          "name": "finding class",
          "value": "Breach record, identifier only"
        }
      ]
    },
    {
      "techniqueID": "T1110",
      "enabled": true,
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1552",
      "enabled": true,
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1589",
      "enabled": true,
      "showSubtechniques": true
    }
  ],
  "gradient": {
    "colors": [
      "#ffffff",
      "#00b7c8"
    ],
    "minValue": 0,
    "maxValue": 7
  },
  "legendItems": [],
  "metadata": [
    {
      "name": "generated_from",
      "value": "packages/database/src/mitre.ts"
    }
  ],
  "links": [],
  "showTacticRowBackground": false,
  "selectTechniquesAcrossTactics": true,
  "selectSubtechniquesWithParent": false
}