auren-research/cyber-sec huggingface dataset:
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--ec0612c5-2644-4c50-bcac-82586974fedd
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0090
external_id: DC0090
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Cloud Service Disable
description: This data component refers to monitoring actions that deactivate or stop a cloud service in a cloud control plane. Examples include disabling essential logging services like AWS CloudTrail (`StopLogging` API call), Microsoft Azure Monitor Logs, or Google Cloud's Operations Suite (formerly Stackdriver). Disabling such services can hinder visibility into adversary activities within the cloud environment. Examples: 

- AWS CloudTrail StopLogging: This action stops logging of API activity for a particular trail, effectively reducing the monitoring and visibility of AWS resources and activities.
- Microsoft Azure Monitor Logs: Disabling these logs hinders the organization’s ability to detect anomalous activities and trace malicious actions.
- Google Cloud Logging: Disabling cloud logging removes visibility into resource activity, preventing monitoring of service access or configuration changes.
- SaaS Applications: Stopping logging removes visibility into user activities, such as email access or file downloads, enabling undetected malicious behavior.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: AWS:CloudTrail
channel: Stop logging for an existing CloudTrail
name: AWS:CloudTrail
channel: Removal of CloudTrail trail
name: azure:activity
channel: az monitor diagnostic-settings delete
name: saas:audit
channel: Log export integration removed or disabled
name: AWS:CloudTrail
channel: StopLogging, DeleteTrail, or DisableSecurityService
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--ec225357-8197-47a4-a9cd-57741d592877
created: 2021-10-20T15:05:19.275Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0095
external_id: DC0095
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Volume Enumeration
description: An extracted list of available volumes within a cloud environment (ex: AWS describe-volumes)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--ed0dd8aa-1677-4551-bb7d-8da767617e1b
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0050
external_id: DC0050
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Windows Registry Key Access
description: The action of opening a specific Windows Registry key, typically to read its associated value. This activity can be used for system configuration, application settings retrieval, and security policies.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: WinEventLog:Security
channel: EventCode=4663, 4670, 4656
name: WinEventLog:Security
channel: EventCode=4657
name: EDR:hunting
channel: Behavioral rule for registry enumeration under credential-related paths
name: Autoruns:RegistryScan
channel: Enumerate Winlogon subkeys for unknown or unsigned binaries
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--f1eb6ea9-f3ab-414f-af35-2d5427199984
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0058
external_id: DC0058
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:14:39.957Z
name: Snapshot Modification
description: Changes made to a cloud snapshot's metadata, attributes, or control settings. These modifications may involve adjusting access permissions, changing retention policies, or altering encryption settings. 

*Data Collection Measures:*

- AWS CloudTrail
 - Tracks API calls such as `ModifySnapshotAttribute`, `ResetSnapshotAttribute`, and `ModifySnapshotTier`.
- Azure Monitor Logs
 - Logs changes via `Microsoft.Compute/snapshots/write`.
- Google Cloud Logging
 - Captures modifications through `compute.snapshots.setIamPolicy` and `compute.snapshots.patch`.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: AWS:CloudTrail
channel: ModifySnapshotAttribute
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--f42df6f0-6395-4f0c-9376-525a031f00c3
created: 2021-10-20T15:05:19.271Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0001
external_id: DC0001
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Scheduled Job Creation
description: The establishment of a task or job that will execute at a predefined time or based on specific triggers.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Scheduled Job
channel: None
name: WinEventLog:Security
channel: EventCode=4698
name: linux:syslog
channel: Execution of non-standard script or binary by cron
name: WinEventLog:TaskScheduler
channel: EventCode=106
name: linux:osquery
channel: crontab, systemd_timers
name: macos:osquery
channel: launchd_jobs
name: esxi:vmkernel
channel: Startup script and task execution logs
name: kubernetes:apiserver
channel: verb=create, resource=cronjobs, group=batch
name: linux:osquery
channel: file_events
name: macos:unifiedlog
channel: process: crontab edits, launch of cron job
name: macos:osquery
channel: file_events - cron, launchd
name: esxi:cron
channel: execution of scheduled job
name: esxi:hostd
channel: task creation events
name: macos:cron
channel: cron/launchd
name: WinEventLog:Security
channel: EventCode=4699
name: linux:cron
channel: Scheduled execution of unknown or unusual script/binary
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--f5468e67-51c7-4756-9b4f-65707708e7fa
created: 2021-10-20T15:05:19.275Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0102
external_id: DC0102
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Network Share Access
description: Opening a network share, which makes the contents available to the requestor (ex: Windows EID 5140 or 5145)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Network Share
channel: None
name: WinEventLog:Microsoft-Windows-SMBClient/Security
channel: EventCode=31001
name: WinEventLog:Security
channel: EventCode=5140
name: WinEventLog:Security
channel: EventCode=5145
name: WinEventLog:Microsoft-Windows-SMBServer
channel: Access to SYSVOL share from non-admin user or unusual endpoints
name: NSM:Flow
channel: smb_files.log
name: m365:unified
channel: FileUploaded, FileAccessed
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--f5a9a1dd-82f9-41a3-85b8-13e5b9cd6c79
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0074
external_id: DC0074
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Driver Metadata
description: to contextual data about a driver, including its attributes, functionality, and activity. This can involve details such as the driver's origin, integrity, cryptographic signature, issues reported during its use, and runtime behavior. Examples include metadata captured during driver integrity checks, hash validation, or error reporting. Examples: 

- Driver Signature Validation: A driver is validated to ensure it is signed by a trusted Certificate Authority (CA).
- Driver Hash Verification: The hash of a driver is compared to a known good hash stored in a database.
- Driver Compatibility Issues: A driver error is logged due to compatibility issues with a particular version of the operating system.
- Vulnerable Driver Identification: Metadata indicates the driver version is outdated or contains a known vulnerability.
- Monitoring Driver Integrity: Drivers are monitored for any unauthorized modifications to their binary or associated files.

This data component can be collected through the following measures:

Windows

- Windows Event Logs:
 - Event ID 3000-3006: Logs metadata about driver signature validation.
 - Event ID 2000-2011 (Windows Defender Application Control): Tracks driver integrity and policy enforcement.
- Sysmon Logs: Configure Sysmon to capture driver loading metadata (Event ID 6).
- Driver Verifier: Use Driver Verifier to collect diagnostic and performance data about drivers, including stability and compatibility metrics.
- PowerShell: Use commands to retrieve metadata about installed drivers:
`Get-WindowsDriver -Online | Select-Object Driver, ProviderName, Version`

Linux

- Auditd: Configure audit rules to monitor driver interactions and collect metadata: `auditctl -w /lib/modules/ -p rwxa -k driver_metadata`
- dmesg: Use `dmesg` to extract kernel logs with driver metadata: `dmesg | grep "module"`
- lsmod and modinfo: Commands to list loaded modules and retrieve metadata about drivers: `lsmod` | `modinfo `

macOS

- Unified Logs: Collect metadata from system logs about kernel extensions (kexts): `log show --predicate 'eventMessage contains "kext load"' --info`
- kextstat: Command to retrieve information about loaded kernel extensions: `kextstat`

SIEM Tools

- Ingest Driver Metadata: Collect driver metadata logs from Sysmon, Auditd, or macOS logs into SIEMs like Splunk or Elastic.

Vulnerability Management Tools

- Use these tools to collect metadata about vulnerable drivers across enterprise systems.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--f8213cde-6b3a-420d-9ab7-41c9af1a919f
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0080
external_id: DC0080
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Instance Start
description: The initiation or activation of a virtual machine instance within a cloud infrastructure. This action typically involves starting an existing instance that had been stopped or paused, allowing it to resume operation. Examples: 

- Google Cloud Platform (GCP): Starting an instance through `instance.start` API activity.
- AWS: Logging of `StartInstances` in AWS CloudTrail for EC2 instances.
- Azure: `Microsoft.Compute/virtualMachines/start` entries indicate a VM instance being started.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: AWS:CloudTrail
channel: StartInstances
name: AWS:CloudTrail
channel: RunInstances
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--faa34cf6-cf32-4dc9-bd6a-8f7a606ff65b
created: 2021-10-20T15:05:19.271Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0012
external_id: DC0012
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:14:38.292Z
name: Scheduled Job Modification
description: Changes made to an existing scheduled job, including modifications to its execution parameters, command payload, or execution timing.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Scheduled Job
channel: None
name: auditd:CONFIG_CHANGE
channel: /var/log/audit/audit.log
name: m365:exchange
channel: Remove-InboxRule, Clear-Mailbox
name: WinEventLog:Security
channel: EventCode=4702
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--fafaa705-ec08-4405-ac62-288c252e520d
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0120
external_id: DC0120
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Cluster Metadata
description: Contextual data about a cluster and activity around it such as name, namespace, age, or status
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.3.0
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--fcc4811f-9cc8-4db5-8097-4d8242a380de
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0017
external_id: DC0017
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Cloud Storage Enumeration
description: Cloud Storage Enumeration involves retrieving a list of available cloud storage infrastructure, such as buckets, containers, or objects, within a cloud environment. This activity may be performed for legitimate administrative purposes or malicious reconnaissance by adversaries seeking to identify accessible storage resources.Examples:

- AWS S3 Bucket Enumeration: An AWS user lists all buckets using the `ListBuckets` API call.
- Azure Blob Storage Container Enumeration: A user retrieves a list of all containers within a storage account using the Azure Storage SDK or API.
- Google Cloud Storage Bucket Enumeration: A Google Cloud user lists all buckets within a project using the `storage.buckets.list` API.
- OpenStack Swift Container Enumeration: A user retrieves a list of containers in OpenStack Swift using the `GET` method on the storage endpoint.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: AWS:CloudTrail
channel: ListBuckets
name: AWS:CloudTrail
channel: ListObjectsV2
name: azure:activity
channel: List Blobs
name: gcp:storage
channel: storage.objects.list
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--ff93f688-d7a4-49cf-9c79-a14454da8428
created: 2021-10-20T15:05:19.271Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0007
external_id: DC0007
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Web Credential Usage
description: An attempt by a user to gain access to a network or computing resource by providing web credentials (ex: Windows EID 1202)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: AWS:CloudTrail
channel: SessionToken used without preceding MFA or login event
name: m365:unified
channel: SessionId reused from different device/browser fingerprint
name: AWS:CloudTrail
channel: AssumeRoleWithSAML
name: saas:access
channel: SAML token accepted without preceding login challenge
name: m365:exchange
channel: Mailbox access using SAML token without corresponding MFA event
name: AWS:CloudTrail
channel: GetSessionToken, AssumeRoleWithWebIdentity
name: macos:unifiedlog
channel: New session initiated using cookies without normal MFA or password validation
name: m365:unified
channel: Session activity without correlated login event
name: AWS:CloudTrail
channel: AssumeRole, GetFederationToken, GetSessionToken
name: azure:signinlogs
channel: TokenIssued, RefreshTokenUsed
name: saas:googleworkspace
channel: OAuthTokenGranted, APIRequest
name: m365:unified
channel: OAuthTokenIssued, FileAccessed, MailItemsAccessed
name: kubernetes:apiserver
channel: serviceAccount token used in API requests not tied to workload identity
name: NSM:Connections
channel: Pre-authentication keys generated or token signing anomalies
name: macos:unifiedlog
channel: Web sessions initiated with newly forged tokens
name: saas:auth
channel: API requests made with tokens not associated with expected user logins
name: azure:signinlogs
channel: TokenIssuanceStart, TokenIssuanceSuccess
name: saas:googleworkspace
channel: access_token issued
name: m365:unified
channel: TokenIssued, FileAccessed
name: AWS:CloudTrail
channel: GetCallerIdentity
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--ff9b665a-598b-4bcb-8b2a-a87566aa1256
created: 2021-10-20T15:05:19.275Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0101
external_id: DC0101
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:14:40.288Z
name: Domain Registration
description: "Domain Name: Domain Registration" data component captures information about the assignment, ownership, and metadata of domain names. This information is often sourced from registries like WHOIS and includes details such as registrant names, contact information, registration dates, expiration dates, and registrar details. This data is invaluable for tracking domain ownership, detecting malicious domain registrations, and identifying trends in adversary behavior. Examples: 

- Registrant Information: WHOIS lookup of example.com 
- Registration and Expiration Dates: A domain registered a week before being used in phishing attacks.
- Domain Status: Status codes like clientTransferProhibited or serverHold indicate domain restrictions or potential hijacking activity.
- Name Server Information: Name servers point to a public DNS provider often associated with malicious campaigns.
- Privacy Protection: A domain uses WHOIS privacy protection to hide registrant details.

This data component can be collected through the following measures:

- WHOIS Services: Use tools or services to perform WHOIS lookups:
- WHOIS APIs: Automate domain registration lookups with APIs:
- Registrar Platforms: Directly query domain registrars (e.g., GoDaddy, Namecheap) for detailed registration data.
- Threat Intelligence Platforms: Integrate domain registration data from services like Recorded Future, RiskIQ, or PassiveTotal for enriched analysis.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Domain Name
channel: None
name: dns:query
channel: Excessive lookups for domains with suspicious WHOIS or short TTL values
name: esxi:vmkernel
channel: DNS lookups resolving to domains with rapid changes in registration metadata
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--ffd73905-2e51-4f2d-8549-e72fb0eb6c38
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0047
external_id: DC0047
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Snapshot Enumeration
description: The process of listing or retrieving metadata about existing snapshots in a cloud environment.

*Data Collection Measures:*

- AWS CloudTrail
 - Logs API calls such as `DescribeSnapshots`, `ListSnapshots`, and `GetSnapshotAttributes`.
- Azure Monitor Logs
 - Tracks snapshot enumeration via `Microsoft.Compute/snapshots/read`.
- Google Cloud Logging
 - Detects snapshot listing through `compute.disks.listSnapshots`.

x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--06bb1e05-533b-4de3-ae87-9b99910465cf
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0014
external_id: DS0014
source_name: Kube Kubectl
description: kubernetes. (n.d.). kubectl. Retrieved October 13, 2021.
url: https://kubernetes.io/docs/reference/kubectl/kubectl/
source_name: Kube Pod
description: kubenetes. (n.d.). Pod v1 core. Retrieved October 13, 2021.
url: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#pod-v1-core
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Pod
description: A single unit of shared resources within a cluster, comprised of one or more containers(Citation: Kube Kubectl)(Citation: Kube Pod)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Containers
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Container