auren-research/cyber-sec huggingface dataset:
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--072ec5a7-00ba-466f-9057-69751a22a967
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0032
external_id: DS0032
source_name: Docker Docs Container
description: docker docs. (n.d.). Containers. Retrieved October 13, 2021.
url: https://docs.docker.com/engine/api/v1.41/#tag/Container
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Container
description: A standard unit of virtualized software that packages up code and all its dependencies so the application runs quickly and reliably from one computing environment to another(Citation: Docker Docs Container)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Containers
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Container
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--0b4f86ed-f4ab-46a3-8ed1-175be1974da6
created: 2021-10-20T15:05:19.271Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0002
external_id: DS0002
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: User Account
description: A profile representing a user, device, service, or application used to authenticate and access resources
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Containers
IaaS
Linux
SaaS
Windows
macOS
Office Suite
Identity Provider
ESXi
x_mitre_deprecated: yes
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Cloud Control Plane
Container
Host
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--0f42a24c-e035-4f93-a91c-5f7076bd8da0
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0024
external_id: DS0024
source_name: Microsoft Registry
description: Microsoft. (2018, May 31). Registry. Retrieved September 29, 2021.
url: https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Windows Registry
description: A Windows OS hierarchical database that stores much of the information and settings for software programs, hardware devices, user preferences, and operating-system configurations(Citation: Microsoft Registry)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_collection_layers: Host
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--12c1e727-7fa4-49b6-af81-366ed2ce231e
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0012
external_id: DS0012
source_name: FireEye PowerShell Logging
description: Dunwoody, M. (2016, February 11). Greater Visibility Through PowerShell Logging. Retrieved September 28, 2021.
url: https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html
source_name: Microsoft AMSI
description: Microsoft. (2019, April 19). Antimalware Scan Interface (AMSI). Retrieved September 28, 2021.
url: https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal
source_name: Microsoft PowerShell Logging
description: Microsoft. (2020, March 30). about_Logging_Windows. Retrieved September 28, 2021.
url: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Script
description: A file or stream containing a list of commands, allowing them to be launched in sequence(Citation: Microsoft PowerShell Logging)(Citation: FireEye PowerShell Logging)(Citation: Microsoft AMSI)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
ESXi
x_mitre_deprecated: yes
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Host
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--1ac0ca69-e07e-4b34-9061-e4588e146c52
created: 2021-10-20T15:05:19.271Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0007
external_id: DS0007
source_name: Microsoft Image
description: Microsoft. (2021, August 23). Create a managed image of a generalized VM in Azure. Retrieved October 13, 2021.
url: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/capture-image-resource
source_name: Amazon AMI
description: Amazon. (n.d.). Amazon Machine Images (AMI). Retrieved October 13, 2021.
url: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Image
description: A single file used to deploy a virtual machine/bootable disk into an on-premise or third-party cloud environment(Citation: Microsoft Image)(Citation: Amazon AMI)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: IaaS
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Cloud Control Plane
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--1e26f222-e27e-4bfa-830c-fa4b4f18b5e4
created: 2021-10-20T15:05:19.271Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0006
external_id: DS0006
source_name: Medium Authentication Tokens
description: Hsu, S. (2018, June 30). Session vs Token Based Authentication. Retrieved September 29, 2021.
url: https://medium.com/@sherryhsu/session-vs-token-based-authentication-11a6c5ac45e4
source_name: Auth0 Access Tokens
description: Auth0. (n.d.). Access Tokens. Retrieved September 29, 2021.
url: https://auth0.com/docs/tokens/access-tokens
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Web Credential
description: Credential material, such as session cookies or tokens, used to authenticate to web applications and services(Citation: Medium Authentication Tokens)(Citation: Auth0 Access Tokens)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
SaaS
Windows
macOS
Office Suite
Identity Provider
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_collection_layers: Cloud Control Plane
Host
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--221adcd5-cccf-44df-9be6-ef607a6e1c3c
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0023
external_id: DS0023
source_name: Microsoft Named Pipes
description: Microsoft. (2018, May 31). Named Pipes. Retrieved September 28, 2021.
url: https://docs.microsoft.com/en-us/windows/win32/ipc/named-pipes
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Named Pipe
description: Mechanisms that allow inter-process communication locally or over the network. A named pipe is usually found as a file and processes attach to it(Citation: Microsoft Named Pipes)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
Windows
macOS
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Host
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--29aa4e0e-4a26-4f79-a9bc-1ae66df1c923
created: 2021-10-20T15:05:19.275Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0037
external_id: DS0037
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Certificate
description: A digital document, which highlights information such as the owner's identity, used to instill trust in public keys used while encrypting network communications
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: PRE
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_collection_layers: OSINT
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--2cd6cc81-d86e-4595-a4f0-43f5519f14e6
created: 2021-10-20T15:05:19.271Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0005
external_id: DS0005
source_name: Microsoft WMI System Classes
description: Microsoft. (2018, May 31). WMI System Classes. Retrieved September 29, 2021.
url: https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmi-system-classes
source_name: Microsoft WMI Architecture
description: Microsoft. (2018, May 31). WMI Architecture. Retrieved September 29, 2021.
url: https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmi-architecture
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: WMI
description: The infrastructure for management data and operations that enables local and remote management of Windows personal computers and servers(Citation: Microsoft WMI System Classes)(Citation: Microsoft WMI Architecture)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Host
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--2ce537a2-3b30-4374-9397-31d6460ec0bc
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0010
external_id: DS0010
source_name: Amazon S3
description: Amazon. (n.d.). Amazon S3. Retrieved October 13, 2021.
url: https://aws.amazon.com/s3/
source_name: Google Cloud Storage
description: Google. (n.d.). Cloud Storage. Retrieved October 13, 2021.
url: https://cloud.google.com/storage
source_name: Azure Blob Storage
description: Microsoft. (n.d.). Azure Blob Storage. Retrieved November 17, 2024.
url: https://azure.microsoft.com/en-us/products/storage/blobs/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Cloud Storage
description: Data object storage infrastructure hosted on-premise or by third-party providers, made available to users through network connections and/or APIs(Citation: Amazon S3)(Citation: Azure Blob Storage)(Citation: Google Cloud Storage)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: IaaS
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Cloud Control Plane
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--38fe306c-bdec-4f3d-8521-b72dd32dbd17
created: 2021-10-20T15:05:19.275Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0035
external_id: DS0035
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Internet Scan
description: Information obtained (commonly via active network traffic probes or web crawling) regarding various types of resources and servers connected to the public Internet
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: PRE
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_collection_layers: OSINT
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--3bef4799-906c-409c-ac00-3fb7a1e352e6
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0021
external_id: DS0021
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Persona
description: A malicious online profile representing a user commonly used by adversaries to social engineer or otherwise target victims
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: PRE
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_collection_layers: OSINT
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--3c07684f-3794-4536-8f70-21efe700c0ec
created: 2021-10-20T15:05:19.275Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0036
external_id: DS0036
source_name: Amazon IAM Groups
description: Amazon. (n.d.). IAM user groups. Retrieved October 13, 2021.
url: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Group
description: A collection of multiple user accounts that share the same access rights to the computer and/or network resources and have common security rights(Citation: Amazon IAM Groups)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: IaaS
SaaS
Windows
Office Suite
Identity Provider
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Cloud Control Plane
Host
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--40269753-26bd-437b-986e-159c66dec5e4
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0015
external_id: DS0015
source_name: Confluence Logs
description: Confluence Support. (2021, April 22). Working with Confluence Logs. Retrieved September 23, 2021.
url: https://confluence.atlassian.com/doc/working-with-confluence-logs-108364721.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Application Log
description: Events collected by third-party services such as mail servers, web applications, or other appliances (not by the native OS or platform)(Citation: Confluence Logs)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: IaaS
Linux
SaaS
Windows
macOS
Office Suite
ESXi
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
ics-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_collection_layers: Cloud Control Plane
Host
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--4358c631-e253-4557-86df-f687d0ef9891
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0028
external_id: DS0028
source_name: Microsoft Audit Logon Events
description: Microsoft. (2021, September 6). Audit logon events. Retrieved September 28, 2021.
url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Logon Session
description: Logon occurring on a system or resource (local, domain, or cloud) to which a user/device is gaining access after successful authentication and authorization(Citation: Microsoft Audit Logon Events)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: IaaS
Linux
SaaS
Windows
macOS
Office Suite
Identity Provider
ESXi
x_mitre_deprecated: yes
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Cloud Control Plane
Host
Network
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--45232bc0-e858-440d-aa93-d48c6cf167f0
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0030
external_id: DS0030
source_name: Google VM
description: Google. (n.d.). Virtual machine instances. Retrieved October 13, 2021.
url: https://cloud.google.com/compute/docs/instances
source_name: Amazon VM
description: Microsoft. (n.d.). What is a virtual machine (VM)?. Retrieved November 17, 2024.
url: https://azure.microsoft.com/en-us/resources/cloud-computing-dictionary/what-is-a-virtual-machine/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Instance
description: A virtual server environment which runs workloads, hosted on-premise or by third-party cloud providers(Citation: Amazon VM)(Citation: Google VM)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: IaaS
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_collection_layers: Cloud Control Plane
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--4523e7f3-8de2-4078-96f8-1227eb537159
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0013
external_id: DS0013
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Sensor Health
description: Information from host telemetry providing insights about system status, errors, or other notable functional activity
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
Windows
macOS
Android
iOS
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
mobile-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Host
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--509ed41e-ca42-461e-9058-24602256daf9
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0022
external_id: DS0022
source_name: Microsoft File Mgmt
description: Microsoft. (2018, May 31). File Management (Local File Systems). Retrieved September 28, 2021.
url: https://docs.microsoft.com/en-us/windows/win32/fileio/file-management
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: File
description: A computer resource object, managed by the I/O system, for storing data (such as images, text, videos, computer programs, or any wide variety of other media).(Citation: Microsoft File Mgmt)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
Network Devices
Windows
macOS
ESXi
x_mitre_deprecated: yes
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Host
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--61bbbf27-f7c3-46ba-a6bc-48ae76928065
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0016
external_id: DS0016
source_name: Sysmon EID 9
description: Russinovich, R. & Garnier, T. (2021, August 18). Sysmon Event ID 9. Retrieved September 24, 2021.
url: https://docs.microsoft.com/sysinternals/downloads/sysmon#event-id-9-rawaccessread
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Drive
description: A non-volatile data storage device (hard drive, floppy disk, USB flash drive) with at least one formatted partition, typically mounted to the file system and/or assigned a drive letter(Citation: Sysmon EID 9)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
Windows
macOS
x_mitre_deprecated: yes
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Host
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--6d7de3b7-283d-48f9-909c-60d123d9d768
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0020
external_id: DS0020
source_name: Microsoft Snapshot
description: Microsoft. (2021, September 16). Create a snapshot of a virtual hard disk. Retrieved October 13, 2021.
url: https://docs.microsoft.com/en-us/azure/virtual-machines/linux/snapshot-copy-managed-disk
source_name: Amazon Snapshots
description: Amazon. (n.d.). Amazon EBS snapshots. Retrieved October 13, 2021.
url: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSSnapshots.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Snapshot
description: A point-in-time copy of cloud volumes (files, settings, etc.) that can be created and/or deployed in cloud environments(Citation: Microsoft Snapshot)(Citation: Amazon Snapshots)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: IaaS
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Cloud Control Plane