auren-research/cyber-sec huggingface dataset:
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--8b4ca854-ac08-47da-b24f-601b28a39aff
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0026
external_id: DC0026
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Image Deletion
description: Removal of a virtual machine image in a cloud infrastructure (ex: Azure Compute Service Images DELETE) Examples: 

- Azure Compute Service Image Deletion
 - Example: Deleting a virtual machine image using Azure CLI: `az image delete --name MyImage --resource-group MyResourceGroup`
- AWS EC2 AMI (Amazon Machine Image) Deletion
 - Example: Deregistering an AMI in AWS: `aws ec2 deregister-image --image-id ami-1234567890abcdef0`
- Google Cloud Compute Engine Image Deletion
 - Example: Deleting a custom image in Google Cloud: `gcloud compute images delete my-custom-image`
- VMware vSphere
 - Example: Deleting a VM image/template from a vSphere environment:

This data component can be collected through the following measures:

Enable Cloud Platform Logging

- Azure: Enable "Activity Logs" to capture DELETE requests to `Microsoft.Compute/images`.
- AWS: Use AWS CloudTrail to monitor `DeregisterImage` or `DeleteSnapshot` API calls.
- Google Cloud: Enable "Cloud Audit Logs" to track image deletion events under `compute.googleapis.com/images`.

API Monitoring

- Monitor API activity to track the deletion of images using:
 - AWS SDK/CLI `DeregisterImage` or `DeleteSnapshot`.
 - Azure REST API DELETE operations for images.
 - Google Cloud Compute Engine APIs for image deletion.

Cloud SIEM Integration

- Ingest logs into a centralized SIEM platform for monitoring and alerting:

Event Correlation

- Correlate image deletion events with unusual account activity or concurrent unauthorized operations.

x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--8bc66f94-54a9-4be4-bdd1-fe90df643774
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0062
external_id: DC0062
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:14:40.482Z
name: Snapshot Metadata
description: Contextual data about a snapshot, which may include information such as ID, type, and status
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: AWS:CloudTrail
channel: DescribeSnapshots
name: gcp:audit
channel: compute.disks.insert with sourceSnapshot parameter
name: AWS:CloudTrail
channel: CopySnapshot
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--8c826308-2760-492f-9e36-4f0f7e23bcac
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0083
external_id: DC0083
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Cloud Service Enumeration
description: Cloud service enumeration involves listing or querying available cloud services in a cloud control plane. This activity is often performed to identify resources such as virtual machines, storage buckets, compute clusters, or other services within a cloud environment. Examples include API calls like `AWS ECS ListServices`, `Azure ListAllResources`, or `Google Cloud ListInstances`. Examples: 

AWS Cloud Service Enumeration: The adversary gathers details about existing ECS services to identify opportunities for privilege escalation or exfiltration.
- Azure Resource Enumeration: The adversary collects information about virtual machines, resource groups, and other Azure assets for reconnaissance purposes.
- Google Cloud Resource Enumeration: The attacker seeks to map the environment and find misconfigured or underutilized resources for exploitation.
- Office 365 Service Enumeration: The attacker may look for data repositories or collaboration tools to exfiltrate sensitive information.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: AWS:CloudTrail
channel: GetSecretValue
name: gcp:secrets
channel: accessSecretVersion
name: azure:ad
channel: SecretGet
name: AWS:CloudTrail
channel: ssm:ListInventoryEntries
name: AWS:CloudTrail
channel: DescribeInstances, DescribeServices, ListFunctions: High frequency enumeration calls or unusual user agents performing discovery
name: azure:audit
channel: ListApplications, ListServicePrincipals: Large-scale queries against identity or application objects
name: m365:unified
channel: Get-MsolServicePrincipal, ListAppRoles: Service discovery operations executed by accounts not normally performing administrative tasks
name: saas:adminapi
channel: ListIntegrations, ListServices: Repeated service discovery requests from accounts without administrative responsibilities
name: AWS:CloudTrail
channel: GetInstanceIdentityDocument or IMDSv2 token requests
name: AWS:CloudTrail
channel: DescribeUsers / ListUsers / GetUser
name: azure:signinlogs
channel: Graph API Query
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--8d8c7cac-94cf-4726-8989-cab33851168c
created: 2021-10-20T15:05:19.275Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0105
external_id: DC0105
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:14:39.577Z
name: Group Metadata
description: Group metadata includes attributes like name, permissions, purpose, and associated user accounts or roles, which adversaries may exploit for privilege escalation. Examples:

- Active Directory: `Get-ADGroup -Identity "Domain Admins" -Properties Members, Description`
- Azure AD: `Get-AzureADGroup -ObjectId `
- Google Workspace: `GET https://admin.googleapis.com/admin/directory/v1/groups/`
- AWS IAM: `aws iam list-group-policies --group-name `
- Office 365: `GET https://graph.microsoft.com/v1.0/groups/`

*Data Collection Measures:*

- Cloud Logging:
 - AWS CloudTrail for IAM group-related activities.
 - Azure AD Sign-In/Audit logs for metadata changes.
 - Google Admin Activity logs for API calls.
- Directory Logging: Log metadata access (e.g., Windows Event ID 4662).
- API Monitoring: Log API calls to modify group metadata (e.g., Microsoft Graph API).
- SIEM Integration: Centralize group metadata logs for analysis.

x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: m365:sharepoint
channel: Enumerate ACLs/role bindings
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--8e44412e-3238-4d64-8878-4f11e27784fe
created: 2021-10-20T15:05:19.275Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0099
external_id: DC0099
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:14:39.499Z
name: Group Enumeration
description: Extracting group lists from identity systems identifies permissions, roles, or configurations. Adversaries may exploit high-privilege groups or misconfigurations. Examples:

- AWS CLI: `aws iam list-groups`
- PowerShell: `Get-ADGroup -Filter *`
- (Saas) Google Workspace: Admin SDK Directory API
- Azure: `Get-AzureADGroup`
- Microsoft 365: Graph API `GET https://graph.microsoft.com/v1.0/groups`

*Data Collection Measures:*

- Cloud Logging: Enable AWS CloudTrail, Azure Activity Logs, and Google Workspace Admin Logs for group-related actions.
- Directory Monitoring: Track logs like AD Event ID 4662 (object operations).
- API Monitoring: Log API activity like AWS IAM queries.
- SaaS Monitoring: Use platform logs (e.g., Office 365 Unified Audit Logs).
- SIEM Integration: Centralize group query tracking.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: AWS:CloudTrail
channel: ListGroups, ListAttachedRolePolicies
name: azure:audit
channel: az ad user get-member-groups, Get-AzRoleAssignment
name: gcp:audit
channel: cloudidentity.groups.list
name: saas:salesforce
channel: GET /services/data/vXX.X/groups
name: saas:github
channel: GET /orgs/:org/teams, GET /teams/:team/members
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--8fb2f315-1aca-4cef-ae0d-8105e1f95985
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0052
external_id: DC0052
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Social Media
description: Established, compromised, or otherwise acquired by adversaries to conduct reconnaissance, influence operations, social engineering, or other cyber threats.

*Data Collection Measures:*

- API Monitoring	
 - Social media APIs (e.g., Twitter API, Facebook Graph API) can extract behavioral patterns of accounts.
- Web Scraping
 - Extracts public profile data, friend lists, or interactions to identify impersonation attempts.
- Threat Intelligence Feeds	
 - External feeds track malicious personas linked to disinformation campaigns or phishing.
- OSINT Tools
 - Maltego, SpiderFoot, and OpenCTI can map social media persona relationships.
- Endpoint Detection	
 - EDR logs user behavior and alerts on suspicious social media interactions.
- SIEM Logging
 - Detects access to known phishing pages or social media abuse via proxy logs.
- Dark Web Monitoring	
 - Identifies compromised social media credentials being sold.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Persona
channel: None
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--9085a576-636a-455b-91d2-c2921bbe6d1d
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0068
external_id: DC0068
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Active Directory Object Deletion
description: Object deletion in AD (e.g., user accounts, groups, OUs) is logged as Event ID 5141. Examples:

- User Account: Deleted user.
- Group: Deleted security/distribution group.
- Organizational Unit (OU): Loss of configurations or policies.
- Service Account: Disrupted operations or cover tracks.
- Trust Object: Removed domain trust, disrupting connectivity.

*Data Collection Measures:*

- Audit Policy:
 - Enable "Audit Directory Service Changes" (Success and Failure).
 - Path: `Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Directory Service Changes`.
 - Key Event: Event ID 5141.
- Log Forwarding: Use WEF to centralize logs for SIEM tools (e.g., Splunk).
- Enable EDR Monitoring:
 - Detect processes or users that initiate unauthorized object deletions.
 - Monitor tools and scripts that may delete key directory objects.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: WinEventLog:Security
channel: EventCode=4929
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--91b3ed33-d1b5-4c4b-a896-76c55eb3cfd8
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0091
external_id: DC0091
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Container Enumeration
description: "Container Enumeration" data component captures events and actions related to listing and identifying active or available containers within a containerized environment. This includes information about running, stopped, or configured containers, such as their names, IDs, statuses, or associated images. Monitoring this activity is crucial for detecting unauthorized discovery or reconnaissance efforts. Examples: 

- Docker Example: `docker ps`, `docker ps -a`
- Kubernetes Example: `kubectl get pods`, `kubectl get deployments`
- Cloud Container Services Example
 - AWS ECS: API Call: ListTasks or ListContainers
 - Azure Kubernetes Service: API Call: List pod or container instances.
 - Google Kubernetes Engine (GKE): API Call: Retrieve deployments and their associated containers.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: docker:daemon
channel: docker ps, docker inspect, or docker images commands
name: AWS:CloudTrail
channel: DescribeCluster, ListClusters, ListNodegroups
name: containerd:runtime
channel: e.g., containerd, Docker events
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--93a6e38c-02a5-44d8-9035-b2e08459f31f
created: 2021-10-20T15:05:19.271Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0003
external_id: DC0003
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Malware Metadata
description: Contextual data about a malicious payload, such as compilation times, file hashes, as well as watermarks or other identifiable configuration information
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Malware Repository
channel: None
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--a5ae90ca-0c4b-481c-959f-0eb18a7ff953
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0072
external_id: DC0072
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Container Creation
description: "Container Creation" data component captures details about the initial construction of a container in a containerized environment. This includes events where a new container is instantiated, such as through Docker, Kubernetes, or other container orchestration platforms. Monitoring these events helps detect unauthorized or potentially malicious container creation. Examples:

- Docker Example: `docker create my-container`, `docker run --name=my-container nginx:latest`
- Kubernetes Example: `kubectl run my-pod --image=nginx`, `kubectl create deployment my-deployment --image=nginx`
- Cloud Container Services Example
 - AWS ECS: Task or service creation (`RunTask` or `CreateService`).
 - Azure Container Instances: Deployment of a container group.
 - Google Kubernetes Engine (GKE): Creation of new pods via GCP APIs.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: kubernetes:apiserver
channel: create/exec: Kubernetes API calls to exec into containers or create pods from curl, kubectl, or SDK clients
name: kubernetes:events
channel: container start/stop activity via Docker, containerd, or CRI-O
name: docker:daemon
channel: container create/start with privileged flag or host volume mount
name: kubernetes:audit
channel: create: Pod/Container created with image tag 'latest' or mutable tag; imagePullPolicy=Always; noDigest=true
name: systemd:unit
channel: container run with restart policy set to 'always' or 'unless-stopped'
name: docker:events
channel: created,started: new container from untrusted registry or unexpected entrypoint
name: containerd:events
channel: create
name: docker:events
channel: docker run with restart=always or modifying init
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--b008766d-f34f-4ded-b712-659f59aaed6e
created: 2021-10-20T15:05:19.271Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0015
external_id: DC0015
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Image Creation
description: Initial construction of a virtual machine image within a cloud environment. Virtual machine images are templates containing an operating system and installed applications, which can be deployed to create new virtual machines. Monitoring the creation of these images is important because adversaries may create custom images to include malicious software or misconfigurations for later exploitation. Examples: 

- Azure Compute Service Image Creation
 - Example: Creating a virtual machine image in Azure using Azure CLI: `az image create --resource-group MyResourceGroup --name MyImage --source MyVM`
- AWS EC2 AMI (Amazon Machine Image) Creation
 - Example: Creating an AMI from an EC2 instance: `aws ec2 create-image --instance-id i-1234567890abcdef0 --name "MyAMI" --description "An AMI for my app"`
- Google Cloud Compute Engine Image Creation
 - Example: Creating a custom image using gcloud: `gcloud compute images create my-custom-image --source-disk my-disk --source-disk-zone us-central1-a`
- VMware vSphere
 - Example: Exporting a VM to create an OVF (Open Virtualization Format) template: This could later be imported into other environments with potential tampering.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: containerd:events
channel: Image pull from untrusted registry (name NOT IN allowlist) or new digest never seen before
name: docker:daemon
channel: docker build or docker commit commands followed by docker push to internal registry
name: kubernetes:audit
channel: create
name: AWS:CloudTrail
channel: RegisterImage
name: docker:daemon
channel: docker build or POST /build API request
name: kubernetes:apiserver
channel: Pod spec triggering build or custom controller activity invoking image builds
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--b33d36e3-d7ea-4895-8eed-19a08a8f7c4f
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0070
external_id: DC0070
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Cloud Service Metadata
description: Cloud service metadata refers to the contextual and descriptive information about cloud services, including their name, type, purpose, configuration, and activity around them. This metadata is essential for understanding the roles and functions of cloud services, their operational status, and their potential misuse. Examples: 

- Azure Service Metadata: Metadata describing a resource in Azure, such as an Azure Storage Account or a Virtual Machine.
- AWS Cloud Service Metadata: Metadata for an AWS EC2 instance collected using the `DescribeInstances` API call.
- Google Cloud Service Metadata: Metadata for a Google Compute Engine instance collected using `gcloud compute instances describe`.
- Office 365 Metadata: Metadata about an Office 365 SharePoint site.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: AWS:CloudTrail
channel: GetInstanceIdentityDocument
name: AWS:CloudTrail
channel: rds:ExecuteStatement: Large data access via RDS or Aurora with unknown session context
name: saas:github
channel: repo.download, repo.clone, oauth.authorize, repo.getContent
name: AWS:CloudWatch
channel: unexpected IAM user or role assuming privileges for instance/snapshot operations
name: AWS:CloudTrail
channel: GetSecretValue
name: AWS:CloudTrail
channel: InvokeFunction
name: m365:sharepoint
channel: Multiple file download operations on a site by a privileged account in a short time window
name: saas:github
channel: CI/CD secret accessed or exported
name: m365:exchange
channel: Cmdlet - New-InboxRule
name: m365:unified
channel: New-InboxRule, Set-InboxRule
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--b597a220-6510-4397-b0d8-342cd2c58827
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0028
external_id: DC0028
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Image Metadata
description: contextual information associated with a virtual machine image, such as its name, resource group, status (active or inactive), type (custom or prebuilt), size, creation date, and permissions. This metadata is critical for understanding the state and configuration of virtual machine images in cloud environments. Examples: 

- Azure Compute Service Image Metadata Example:
 - Name: MyCustomImage
 - Resource Group: MyResourceGroup
 - State: Available
 - Type: Managed Image
- AWS EC2 AMI Metadata Example:
 - Image ID: ami-1234567890abcdef0
 - Name: ProdImage
 - State: Available
 - Platform: Windows
- Google Cloud Compute Engine Image Metadata Example:
 - Image Name: webserver-image
 - Project: my-project-id
 - Family: webserver
 - Source Disk: my-disk-id
- VMware vSphere Template Metadata Example:
 - Name: LinuxTemplate
 - Disk Size: 40GB
 - Network Adapter: VM Network
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: docker:events
channel: docker.events.json
name: esxi:vmkernel
channel: VMX startup messages without associated vCenter inventory records
name: kubernetes:apiserver
channel: Resource creation and update logs