File size: 2,641 Bytes
5fe70fd |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 |
{
"type": "bundle",
"id": "bundle--ac1fb54e-10f0-4921-a591-fe3c06db82cd",
"spec_version": "2.0",
"objects": [
{
"id": "attack-pattern--0c592c79-29a7-4a94-81a4-c87eae3aead6",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"name": "Common, high volume protocols and software",
"description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1321).\n\nCertain types of traffic (e.g., Twitter14, HTTP) are more commonly used than others. Utilizing more common protocols and software may make an adversary's traffic more difficult to distinguish from legitimate traffic. (Citation: symantecNITRO)",
"external_references": [
{
"source_name": "mitre-pre-attack",
"url": "https://attack.mitre.org/techniques/T1321",
"external_id": "T1321"
},
{
"source_name": "symantecNITRO",
"description": "Eric Chien and Gavin O\u2019Gorman. (n.d.). The Nitro Attacks: Stealing Secrets from the Chemical Industry. Retrieved March 1, 2017."
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_detectable_by_common_defenses": "No",
"x_mitre_detectable_by_common_defenses_explanation": "High level of entropy in communications. High volume of communications makes it extremely hard for a defender to distinguish between legitimate and adversary communications.",
"x_mitre_difficulty_for_adversary": "Yes",
"x_mitre_difficulty_for_adversary_explanation": "Communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to decipher or to make the communication less conspicuous.",
"x_mitre_version": "1.0",
"x_mitre_old_attack_id": "PRE-T1098",
"type": "attack-pattern",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-pre-attack",
"phase_name": "adversary-opsec"
}
],
"modified": "2020-10-26T13:42:49.342Z",
"created": "2017-12-14T16:46:06.044Z",
"x_mitre_deprecated": true
}
]
} |