ATLAS Data 4.4, ATT&CK Enterprise v13

mitre-atlas · Apr 25, 2023 · ff9c843 · ff9c843
1 parent f7e1fe7
commit ff9c843
Show file tree

Hide file tree

Showing 24 changed files with 50 additions and 44 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,10 @@
 # ATLAS Navigator Data Changelog
 
+## [1.5.0]() (2023-04-25)
+
+- ATLAS STIX updated with ATT&CK Enterprise v13
+- Updated to use ATLAS Data 4.4.0
+
 ## [1.4.0]() (2023-03-01)
 
 - Updated to use ATLAS Data 4.3.0

diff --git a/atlas-data b/atlas-data
diff --git a/dist/case-study-navigator-layers/AML.CS0000.json b/dist/case-study-navigator-layers/AML.CS0000.json
@@ -11,11 +11,11 @@
         },
         {
             "name": "atlas_data_version",
-            "value": "4.3.0"
+            "value": "4.4.0"
         },
         {
             "name": "generated_on",
-            "value": "2023-03-01"
+            "value": "2023-04-25"
         }
     ],
     "name": "Evasion of Deep Learning Detector for Malware C&C Traffic",

diff --git a/dist/case-study-navigator-layers/AML.CS0001.json b/dist/case-study-navigator-layers/AML.CS0001.json
@@ -11,11 +11,11 @@
         },
         {
             "name": "atlas_data_version",
-            "value": "4.3.0"
+            "value": "4.4.0"
         },
         {
             "name": "generated_on",
-            "value": "2023-03-01"
+            "value": "2023-04-25"
         }
     ],
     "name": "Botnet Domain Generation Algorithm (DGA) Detection Evasion",

diff --git a/dist/case-study-navigator-layers/AML.CS0002.json b/dist/case-study-navigator-layers/AML.CS0002.json
@@ -11,11 +11,11 @@
         },
         {
             "name": "atlas_data_version",
-            "value": "4.3.0"
+            "value": "4.4.0"
         },
         {
             "name": "generated_on",
-            "value": "2023-03-01"
+            "value": "2023-04-25"
         }
     ],
     "name": "VirusTotal Poisoning",

diff --git a/dist/case-study-navigator-layers/AML.CS0003.json b/dist/case-study-navigator-layers/AML.CS0003.json
@@ -11,11 +11,11 @@
         },
         {
             "name": "atlas_data_version",
-            "value": "4.3.0"
+            "value": "4.4.0"
         },
         {
             "name": "generated_on",
-            "value": "2023-03-01"
+            "value": "2023-04-25"
         }
     ],
     "name": "Bypassing Cylance's AI Malware Detection",

diff --git a/dist/case-study-navigator-layers/AML.CS0004.json b/dist/case-study-navigator-layers/AML.CS0004.json
@@ -11,11 +11,11 @@
         },
         {
             "name": "atlas_data_version",
-            "value": "4.3.0"
+            "value": "4.4.0"
         },
         {
             "name": "generated_on",
-            "value": "2023-03-01"
+            "value": "2023-04-25"
         }
     ],
     "name": "Camera Hijack Attack on Facial Recognition System",

diff --git a/dist/case-study-navigator-layers/AML.CS0005.json b/dist/case-study-navigator-layers/AML.CS0005.json
@@ -11,11 +11,11 @@
         },
         {
             "name": "atlas_data_version",
-            "value": "4.3.0"
+            "value": "4.4.0"
         },
         {
             "name": "generated_on",
-            "value": "2023-03-01"
+            "value": "2023-04-25"
         }
     ],
     "name": "Attack on Machine Translation Service - Google Translate, Bing Translator, and Systran Translate",

diff --git a/dist/case-study-navigator-layers/AML.CS0006.json b/dist/case-study-navigator-layers/AML.CS0006.json
@@ -11,11 +11,11 @@
         },
         {
             "name": "atlas_data_version",
-            "value": "4.3.0"
+            "value": "4.4.0"
         },
         {
             "name": "generated_on",
-            "value": "2023-03-01"
+            "value": "2023-04-25"
         }
     ],
     "name": "ClearviewAI Misconfiguration",

diff --git a/dist/case-study-navigator-layers/AML.CS0007.json b/dist/case-study-navigator-layers/AML.CS0007.json
@@ -11,11 +11,11 @@
         },
         {
             "name": "atlas_data_version",
-            "value": "4.3.0"
+            "value": "4.4.0"
         },
         {
             "name": "generated_on",
-            "value": "2023-03-01"
+            "value": "2023-04-25"
         }
     ],
     "name": "GPT-2 Model Replication",

diff --git a/dist/case-study-navigator-layers/AML.CS0008.json b/dist/case-study-navigator-layers/AML.CS0008.json
@@ -11,11 +11,11 @@
         },
         {
             "name": "atlas_data_version",
-            "value": "4.3.0"
+            "value": "4.4.0"
         },
         {
             "name": "generated_on",
-            "value": "2023-03-01"
+            "value": "2023-04-25"
         }
     ],
     "name": "ProofPoint Evasion",

diff --git a/dist/case-study-navigator-layers/AML.CS0009.json b/dist/case-study-navigator-layers/AML.CS0009.json
@@ -11,11 +11,11 @@
         },
         {
             "name": "atlas_data_version",
-            "value": "4.3.0"
+            "value": "4.4.0"
         },
         {
             "name": "generated_on",
-            "value": "2023-03-01"
+            "value": "2023-04-25"
         }
     ],
     "name": "Tay Poisoning",

diff --git a/dist/case-study-navigator-layers/AML.CS0010.json b/dist/case-study-navigator-layers/AML.CS0010.json
@@ -11,11 +11,11 @@
         },
         {
             "name": "atlas_data_version",
-            "value": "4.3.0"
+            "value": "4.4.0"
         },
         {
             "name": "generated_on",
-            "value": "2023-03-01"
+            "value": "2023-04-25"
         }
     ],
     "name": "Microsoft Azure Service Disruption",

diff --git a/dist/case-study-navigator-layers/AML.CS0011.json b/dist/case-study-navigator-layers/AML.CS0011.json
@@ -11,11 +11,11 @@
         },
         {
             "name": "atlas_data_version",
-            "value": "4.3.0"
+            "value": "4.4.0"
         },
         {
             "name": "generated_on",
-            "value": "2023-03-01"
+            "value": "2023-04-25"
         }
     ],
     "name": "Microsoft Edge AI Evasion",

diff --git a/dist/case-study-navigator-layers/AML.CS0012.json b/dist/case-study-navigator-layers/AML.CS0012.json
@@ -11,11 +11,11 @@
         },
         {
             "name": "atlas_data_version",
-            "value": "4.3.0"
+            "value": "4.4.0"
         },
         {
             "name": "generated_on",
-            "value": "2023-03-01"
+            "value": "2023-04-25"
         }
     ],
     "name": "Face Identification System Evasion via Physical Countermeasures",

diff --git a/dist/case-study-navigator-layers/AML.CS0013.json b/dist/case-study-navigator-layers/AML.CS0013.json
@@ -11,11 +11,11 @@
         },
         {
             "name": "atlas_data_version",
-            "value": "4.3.0"
+            "value": "4.4.0"
         },
         {
             "name": "generated_on",
-            "value": "2023-03-01"
+            "value": "2023-04-25"
         }
     ],
     "name": "Backdoor Attack on Deep Learning Models in Mobile Apps",

diff --git a/dist/case-study-navigator-layers/AML.CS0014.json b/dist/case-study-navigator-layers/AML.CS0014.json
@@ -11,11 +11,11 @@
         },
         {
             "name": "atlas_data_version",
-            "value": "4.3.0"
+            "value": "4.4.0"
         },
         {
             "name": "generated_on",
-            "value": "2023-03-01"
+            "value": "2023-04-25"
         }
     ],
     "name": "Confusing Antimalware Neural Networks",

diff --git a/dist/case-study-navigator-layers/AML.CS0015.json b/dist/case-study-navigator-layers/AML.CS0015.json
@@ -11,11 +11,11 @@
         },
         {
             "name": "atlas_data_version",
-            "value": "4.3.0"
+            "value": "4.4.0"
         },
         {
             "name": "generated_on",
-            "value": "2023-03-01"
+            "value": "2023-04-25"
         }
     ],
     "name": "Compromised PyTorch Dependency Chain",

diff --git a/dist/case-study-navigator-layers/AML.CS0016.json b/dist/case-study-navigator-layers/AML.CS0016.json
@@ -11,11 +11,11 @@
         },
         {
             "name": "atlas_data_version",
-            "value": "4.3.0"
+            "value": "4.4.0"
         },
         {
             "name": "generated_on",
-            "value": "2023-03-01"
+            "value": "2023-04-25"
         }
     ],
     "name": "Achieving Code Execution in MathGPT via Prompt Injection",

diff --git a/dist/default-navigator-layers/atlas_case_study_frequency.json b/dist/default-navigator-layers/atlas_case_study_frequency.json
@@ -7,11 +7,11 @@
     "metadata": [
         {
             "name": "atlas_data_version",
-            "value": "4.3.0"
+            "value": "4.4.0"
         },
         {
             "name": "generated_on",
-            "value": "2023-03-01"
+            "value": "2023-04-25"
         }
     ],
     "name": "ATLAS Case Study Frequency",

diff --git a/dist/default-navigator-layers/atlas_layer_matrix.json b/dist/default-navigator-layers/atlas_layer_matrix.json
@@ -7,11 +7,11 @@
     "metadata": [
         {
             "name": "atlas_data_version",
-            "value": "4.3.0"
+            "value": "4.4.0"
         },
         {
             "name": "generated_on",
-            "value": "2023-03-01"
+            "value": "2023-04-25"
         }
     ],
     "name": "ATLAS Matrix",

diff --git a/dist/stix-atlas.json b/dist/stix-atlas.json
diff --git a/tools/generate_stix.py b/tools/generate_stix.py
@@ -30,7 +30,7 @@ def __init__(self, **kwargs):
     ('description', properties.StringProperty()),
     # https://github.com/oasis-open/cti-python-stix2/blob/master/stix2/properties.py#L197
     ('external_references', properties.ListProperty(ExternalReference)),
-    ('tactic_refs', properties.ListProperty(properties.StringProperty))
+    ('tactic_refs', properties.ListProperty(properties.ReferenceProperty(valid_types='x-mitre-tactic')))
 ])
 class AttackMatrix():
     """Custom MITRE ATT&CK matrix STIX object."""
@@ -49,7 +49,7 @@ def __init__(self, **kwargs):
     ('x_mitre_version', properties.StringProperty()),
     ('spec_version', properties.StringProperty()),
     ('x_mitre_attack_spec_version', properties.StringProperty()),
-    ('created_by_ref', properties.StringProperty()),
+    ('created_by_ref', properties.ReferenceProperty(valid_types='identity')),
     ('object_marking_refs', properties.ListProperty(properties.IDProperty(type='x-mitre-collection'))),
     ('x_mitre_contents', properties.ListProperty(properties.DictionaryProperty())),
 ])
@@ -156,7 +156,8 @@ def to_stix_json(self, stix_output_filepath, atlas_url, identity_name):
                 name=f'{matrix["name"]}',
                 description=f'{self.data_id} matrix for {matrix["name"]}',
                 external_references=external_references,
-                tactic_refs=tactic_refs
+                tactic_refs=tactic_refs,
+                allow_custom=True
             )
 
             stix_matrices.append(stix_matrix_obj)

diff --git a/tools/requirements.txt b/tools/requirements.txt
@@ -1,2 +1,2 @@
 PyYAML==6.0
-stix2==2.1.0
+stix2==3.0.1