{"schema_version":1,"reviewed_on":"2026-09-28","counts":{"total":1126,"attack":918,"atlas":208,"with_collection_fixtures":918,"with_atomic_candidates":336,"with_lab_tool_associations":302,"with_documented_software":675,"with_exact_anomaly_models":51,"live_validated_attacks":0},"scope":"All matrix destinations. Source identity and page completeness are not semantic review of every source claim or execution of every attack.","records":[{"key":"enterprise/T1001","id":"T1001","name":"Data Obfuscation","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1001/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":1,"documented_software":13,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1001.001","id":"T1001.001","name":"Junk Data","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1001.001/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":17,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1001.002","id":"T1001.002","name":"Steganography","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1001.002/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":3,"lab_tools":1,"documented_software":11,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1001.003","id":"T1001.003","name":"Protocol or Service Impersonation","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1001.003/","full_definition":true,"detection_analytics":4,"sigma_sources":2,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":1,"documented_software":18,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1003","id":"T1003","name":"OS Credential Dumping","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1003/","full_definition":true,"detection_analytics":3,"sigma_sources":33,"anomaly_models":1,"collection_contracts":5,"atomic_candidates":7,"lab_tools":0,"documented_software":7,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1003.001","id":"T1003.001","name":"LSASS Memory","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1003.001/","full_definition":true,"detection_analytics":1,"sigma_sources":73,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":14,"lab_tools":12,"documented_software":26,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1003.002","id":"T1003.002","name":"Security Account Manager","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1003.002/","full_definition":true,"detection_analytics":1,"sigma_sources":28,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":8,"lab_tools":8,"documented_software":15,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1003.003","id":"T1003.003","name":"NTDS","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1003.003/","full_definition":true,"detection_analytics":1,"sigma_sources":23,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":11,"lab_tools":4,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1003.004","id":"T1003.004","name":"LSA Secrets","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1003.004/","full_definition":true,"detection_analytics":1,"sigma_sources":12,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":2,"lab_tools":7,"documented_software":9,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1003.005","id":"T1003.005","name":"Cached Domain Credentials","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1003.005/","full_definition":true,"detection_analytics":2,"sigma_sources":8,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":1,"lab_tools":3,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1003.006","id":"T1003.006","name":"DCSync","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1003.006/","full_definition":true,"detection_analytics":1,"sigma_sources":7,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":2,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1003.007","id":"T1003.007","name":"Proc Filesystem","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1003.007/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":4,"lab_tools":2,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1003.008","id":"T1003.008","name":"/etc/passwd and /etc/shadow","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1003.008/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":5,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1005","id":"T1005","name":"Data from Local System","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1005/","full_definition":true,"detection_analytics":5,"sigma_sources":12,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":3,"lab_tools":13,"documented_software":169,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1006","id":"T1006","name":"Direct Volume Access","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1006/","full_definition":true,"detection_analytics":2,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":1,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1007","id":"T1007","name":"System Service Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1007/","full_definition":true,"detection_analytics":3,"sigma_sources":8,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":8,"lab_tools":5,"documented_software":52,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1008","id":"T1008","name":"Fallback Channels","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1008/","full_definition":true,"detection_analytics":4,"sigma_sources":4,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":1,"documented_software":51,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1010","id":"T1010","name":"Application Window Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1010/","full_definition":true,"detection_analytics":3,"sigma_sources":1,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":3,"documented_software":34,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1011","id":"T1011","name":"Exfiltration Over Other Network Medium","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1011/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1011.001","id":"T1011.001","name":"Exfiltration Over Bluetooth","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1011.001/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1012","id":"T1012","name":"Query Registry","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1012/","full_definition":true,"detection_analytics":1,"sigma_sources":9,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":6,"lab_tools":6,"documented_software":99,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1014","id":"T1014","name":"Rootkit","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1014/","full_definition":true,"detection_analytics":3,"sigma_sources":1,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":4,"lab_tools":1,"documented_software":24,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1016","id":"T1016","name":"System Network Configuration Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1016/","full_definition":true,"detection_analytics":5,"sigma_sources":9,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":10,"lab_tools":20,"documented_software":232,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1016.001","id":"T1016.001","name":"Internet Connection Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1016.001/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":5,"lab_tools":0,"documented_software":13,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1016.002","id":"T1016.002","name":"Wi-Fi Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1016.002/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":1,"lab_tools":0,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1018","id":"T1018","name":"Remote System Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1018/","full_definition":true,"detection_analytics":5,"sigma_sources":16,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":23,"lab_tools":11,"documented_software":54,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1020","id":"T1020","name":"Automated Exfiltration","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1020/","full_definition":true,"detection_analytics":3,"sigma_sources":8,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":2,"lab_tools":2,"documented_software":21,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1020.001","id":"T1020.001","name":"Traffic Duplication","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1020.001/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1021","id":"T1021","name":"Remote Services","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1021/","full_definition":true,"detection_analytics":5,"sigma_sources":10,"anomaly_models":1,"collection_contracts":4,"atomic_candidates":0,"lab_tools":1,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1021.001","id":"T1021.001","name":"Remote Desktop Protocol","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1021.001/","full_definition":true,"detection_analytics":1,"sigma_sources":15,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":4,"lab_tools":5,"documented_software":17,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1021.002","id":"T1021.002","name":"SMB/Windows Admin Shares","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1021.002/","full_definition":true,"detection_analytics":1,"sigma_sources":36,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":4,"lab_tools":4,"documented_software":30,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1021.003","id":"T1021.003","name":"Distributed Component Object Model","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1021.003/","full_definition":true,"detection_analytics":1,"sigma_sources":13,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":2,"lab_tools":3,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1021.004","id":"T1021.004","name":"SSH","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1021.004/","full_definition":true,"detection_analytics":3,"sigma_sources":5,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":2,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1021.005","id":"T1021.005","name":"VNC","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1021.005/","full_definition":true,"detection_analytics":3,"sigma_sources":1,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":0,"documented_software":7,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1021.006","id":"T1021.006","name":"Windows Remote Management","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1021.006/","full_definition":true,"detection_analytics":1,"sigma_sources":10,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":3,"lab_tools":3,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1021.007","id":"T1021.007","name":"Cloud Services","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1021.007/","full_definition":true,"detection_analytics":4,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1021.008","id":"T1021.008","name":"Direct Cloud VM Connections","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1021.008/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1025","id":"T1025","name":"Data from Removable Media","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1025/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":1,"lab_tools":0,"documented_software":20,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1027","id":"T1027","name":"Obfuscated Files or Information","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1027/","full_definition":true,"detection_analytics":5,"sigma_sources":87,"anomaly_models":1,"collection_contracts":7,"atomic_candidates":11,"lab_tools":9,"documented_software":138,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1027.001","id":"T1027.001","name":"Binary Padding","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1027.001/","full_definition":true,"detection_analytics":3,"sigma_sources":3,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":2,"lab_tools":0,"documented_software":22,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1027.002","id":"T1027.002","name":"Software Packing","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1027.002/","full_definition":true,"detection_analytics":3,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":4,"lab_tools":2,"documented_software":73,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1027.003","id":"T1027.003","name":"Steganography","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1027.003/","full_definition":true,"detection_analytics":3,"sigma_sources":5,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":1,"documented_software":19,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1027.004","id":"T1027.004","name":"Compile After Delivery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1027.004/","full_definition":true,"detection_analytics":3,"sigma_sources":5,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":5,"lab_tools":1,"documented_software":6,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1027.005","id":"T1027.005","name":"Indicator Removal from Tools","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1027.005/","full_definition":true,"detection_analytics":3,"sigma_sources":4,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":2,"documented_software":9,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1027.006","id":"T1027.006","name":"HTML Smuggling","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1027.006/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1027.007","id":"T1027.007","name":"Dynamic API Resolution","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1027.007/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":1,"lab_tools":1,"documented_software":17,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1027.008","id":"T1027.008","name":"Stripped Payloads","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1027.008/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1027.009","id":"T1027.009","name":"Embedded Payloads","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1027.009/","full_definition":true,"detection_analytics":3,"sigma_sources":1,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":1,"documented_software":19,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1027.010","id":"T1027.010","name":"Command Obfuscation","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1027.010/","full_definition":true,"detection_analytics":3,"sigma_sources":8,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":2,"documented_software":35,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1027.011","id":"T1027.011","name":"Fileless Storage","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1027.011/","full_definition":true,"detection_analytics":2,"sigma_sources":1,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":27,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1027.012","id":"T1027.012","name":"LNK Icon Smuggling","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1027.012/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1027.013","id":"T1027.013","name":"Encrypted/Encoded File","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1027.013/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":4,"lab_tools":6,"documented_software":195,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1027.014","id":"T1027.014","name":"Polymorphic Code","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1027.014/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1027.015","id":"T1027.015","name":"Compression","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1027.015/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":2,"documented_software":25,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1027.016","id":"T1027.016","name":"Junk Code Insertion","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1027.016/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":18,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1027.017","id":"T1027.017","name":"SVG Smuggling","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1027.017/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1027.018","id":"T1027.018","name":"Invisible Unicode","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1027.018/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":8,"atomic_candidates":3,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1029","id":"T1029","name":"Scheduled Transfer","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1029/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":1,"documented_software":17,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1030","id":"T1030","name":"Data Transfer Size Limits","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1030/","full_definition":true,"detection_analytics":3,"sigma_sources":2,"anomaly_models":1,"collection_contracts":2,"atomic_candidates":2,"lab_tools":3,"documented_software":14,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1033","id":"T1033","name":"System Owner/User Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1033/","full_definition":true,"detection_analytics":4,"sigma_sources":29,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":8,"lab_tools":9,"documented_software":196,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1036","id":"T1036","name":"Masquerading","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1036/","full_definition":true,"detection_analytics":5,"sigma_sources":38,"anomaly_models":1,"collection_contracts":8,"atomic_candidates":2,"lab_tools":0,"documented_software":33,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1036.001","id":"T1036.001","name":"Invalid Code Signature","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1036.001/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":1,"documented_software":7,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1036.002","id":"T1036.002","name":"Right-to-Left Override","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1036.002/","full_definition":true,"detection_analytics":3,"sigma_sources":3,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":2,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1036.003","id":"T1036.003","name":"Rename Legitimate Utilities","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1036.003/","full_definition":true,"detection_analytics":3,"sigma_sources":26,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":8,"lab_tools":0,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1036.004","id":"T1036.004","name":"Masquerade Task or Service","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1036.004/","full_definition":true,"detection_analytics":3,"sigma_sources":1,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":4,"lab_tools":2,"documented_software":63,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1036.005","id":"T1036.005","name":"Match Legitimate Resource Name or Location","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1036.005/","full_definition":true,"detection_analytics":5,"sigma_sources":14,"anomaly_models":0,"collection_contracts":10,"atomic_candidates":3,"lab_tools":4,"documented_software":143,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1036.006","id":"T1036.006","name":"Space after Filename","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1036.006/","full_definition":true,"detection_analytics":2,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":2,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1036.007","id":"T1036.007","name":"Double File Extension","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1036.007/","full_definition":true,"detection_analytics":1,"sigma_sources":3,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":1,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1036.008","id":"T1036.008","name":"Masquerade File Type","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1036.008/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":1,"lab_tools":1,"documented_software":13,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1036.009","id":"T1036.009","name":"Break Process Trees","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1036.009/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1036.010","id":"T1036.010","name":"Masquerade Account Name","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1036.010/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1036.011","id":"T1036.011","name":"Overwrite Process Arguments","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1036.011/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1036.012","id":"T1036.012","name":"Browser Fingerprint","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1036.012/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1037","id":"T1037","name":"Boot or Logon Initialization Scripts","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1037/","full_definition":true,"detection_analytics":5,"sigma_sources":0,"anomaly_models":0,"collection_contracts":8,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1037.001","id":"T1037.001","name":"Logon Script (Windows)","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1037.001/","full_definition":true,"detection_analytics":1,"sigma_sources":3,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1037.002","id":"T1037.002","name":"Login Hook","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1037.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":1,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1037.003","id":"T1037.003","name":"Network Logon Script","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1037.003/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1037.004","id":"T1037.004","name":"RC Scripts","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1037.004/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":3,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1037.005","id":"T1037.005","name":"Startup Items","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1037.005/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":3,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1039","id":"T1039","name":"Data from Network Shared Drive","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1039/","full_definition":true,"detection_analytics":3,"sigma_sources":2,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":2,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1040","id":"T1040","name":"Network Sniffing","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1040/","full_definition":true,"detection_analytics":5,"sigma_sources":9,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":16,"lab_tools":5,"documented_software":17,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1041","id":"T1041","name":"Exfiltration Over C2 Channel","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1041/","full_definition":true,"detection_analytics":4,"sigma_sources":2,"anomaly_models":1,"collection_contracts":5,"atomic_candidates":2,"lab_tools":7,"documented_software":166,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1046","id":"T1046","name":"Network Service Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1046/","full_definition":true,"detection_analytics":4,"sigma_sources":19,"anomaly_models":1,"collection_contracts":4,"atomic_candidates":13,"lab_tools":11,"documented_software":35,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1047","id":"T1047","name":"Windows Management Instrumentation","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1047/","full_definition":true,"detection_analytics":1,"sigma_sources":47,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":12,"lab_tools":10,"documented_software":93,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1048","id":"T1048","name":"Exfiltration Over Alternative Protocol","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1048/","full_definition":true,"detection_analytics":5,"sigma_sources":9,"anomaly_models":0,"collection_contracts":9,"atomic_candidates":4,"lab_tools":1,"documented_software":7,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1048.001","id":"T1048.001","name":"Exfiltration Over Symmetric Encrypted Non-C2 Protocol","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1048.001/","full_definition":true,"detection_analytics":4,"sigma_sources":1,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1048.002","id":"T1048.002","name":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1048.002/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":4,"lab_tools":1,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1048.003","id":"T1048.003","name":"Exfiltration Over Unencrypted Non-C2 Protocol","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1048.003/","full_definition":true,"detection_analytics":5,"sigma_sources":8,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":8,"lab_tools":3,"documented_software":22,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1049","id":"T1049","name":"System Network Connections Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1049/","full_definition":true,"detection_analytics":6,"sigma_sources":7,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":7,"lab_tools":12,"documented_software":61,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1052","id":"T1052","name":"Exfiltration Over Physical Medium","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1052/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1052.001","id":"T1052.001","name":"Exfiltration over USB","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1052.001/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1053","id":"T1053","name":"Scheduled Task/Job","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1053/","full_definition":true,"detection_analytics":5,"sigma_sources":9,"anomaly_models":1,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1053.002","id":"T1053.002","name":"At","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1053.002/","full_definition":true,"detection_analytics":3,"sigma_sources":8,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":2,"lab_tools":2,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1053.003","id":"T1053.003","name":"Cron","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1053.003/","full_definition":true,"detection_analytics":3,"sigma_sources":6,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":4,"lab_tools":0,"documented_software":12,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1053.005","id":"T1053.005","name":"Scheduled Task","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1053.005/","full_definition":true,"detection_analytics":1,"sigma_sources":31,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":14,"lab_tools":9,"documented_software":124,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1053.006","id":"T1053.006","name":"Systemd Timers","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1053.006/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":3,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1053.007","id":"T1053.007","name":"Container Orchestration Job","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1053.007/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":2,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1055","id":"T1055","name":"Process Injection","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1055/","full_definition":true,"detection_analytics":3,"sigma_sources":24,"anomaly_models":1,"collection_contracts":7,"atomic_candidates":13,"lab_tools":10,"documented_software":65,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1055.001","id":"T1055.001","name":"Dynamic-link Library Injection","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1055.001/","full_definition":true,"detection_analytics":1,"sigma_sources":6,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":2,"lab_tools":5,"documented_software":56,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1055.002","id":"T1055.002","name":"Portable Executable Injection","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1055.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":1,"documented_software":12,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1055.003","id":"T1055.003","name":"Thread Execution Hijacking","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1055.003/","full_definition":true,"detection_analytics":1,"sigma_sources":2,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1055.004","id":"T1055.004","name":"Asynchronous Procedure Call","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1055.004/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":3,"lab_tools":0,"documented_software":12,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1055.005","id":"T1055.005","name":"Thread Local Storage","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1055.005/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1055.008","id":"T1055.008","name":"Ptrace System Calls","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1055.008/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1055.009","id":"T1055.009","name":"Proc Memory","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1055.009/","full_definition":true,"detection_analytics":1,"sigma_sources":2,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":6,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1055.011","id":"T1055.011","name":"Extra Window Memory Injection","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1055.011/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":1,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1055.012","id":"T1055.012","name":"Process Hollowing","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1055.012/","full_definition":true,"detection_analytics":1,"sigma_sources":4,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":4,"lab_tools":1,"documented_software":35,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1055.013","id":"T1055.013","name":"Process Doppelgänging","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1055.013/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1055.014","id":"T1055.014","name":"VDSO Hijacking","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1055.014/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1055.015","id":"T1055.015","name":"ListPlanting","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1055.015/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1056","id":"T1056","name":"Input Capture","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1056/","full_definition":true,"detection_analytics":4,"sigma_sources":2,"anomaly_models":0,"collection_contracts":8,"atomic_candidates":0,"lab_tools":1,"documented_software":7,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1056.001","id":"T1056.001","name":"Keylogging","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1056.001/","full_definition":true,"detection_analytics":4,"sigma_sources":3,"anomaly_models":0,"collection_contracts":9,"atomic_candidates":8,"lab_tools":12,"documented_software":126,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1056.002","id":"T1056.002","name":"GUI Input Capture","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1056.002/","full_definition":true,"detection_analytics":3,"sigma_sources":3,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":3,"lab_tools":1,"documented_software":13,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1056.003","id":"T1056.003","name":"Web Portal Capture","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1056.003/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1056.004","id":"T1056.004","name":"Credential API Hooking","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1056.004/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":1,"lab_tools":1,"documented_software":11,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1057","id":"T1057","name":"Process Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1057/","full_definition":true,"detection_analytics":5,"sigma_sources":6,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":10,"lab_tools":14,"documented_software":268,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1059/","full_definition":true,"detection_analytics":5,"sigma_sources":75,"anomaly_models":1,"collection_contracts":3,"atomic_candidates":1,"lab_tools":3,"documented_software":23,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1059.001/","full_definition":true,"detection_analytics":1,"sigma_sources":179,"anomaly_models":1,"collection_contracts":4,"atomic_candidates":22,"lab_tools":14,"documented_software":131,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1059.002","id":"T1059.002","name":"AppleScript","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1059.002/","full_definition":true,"detection_analytics":1,"sigma_sources":7,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":1,"lab_tools":0,"documented_software":6,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1059.003","id":"T1059.003","name":"Windows Command Shell","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1059.003/","full_definition":true,"detection_analytics":1,"sigma_sources":27,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":6,"lab_tools":14,"documented_software":295,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1059.004","id":"T1059.004","name":"Unix Shell","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1059.004/","full_definition":true,"detection_analytics":4,"sigma_sources":15,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":17,"lab_tools":0,"documented_software":49,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1059.005","id":"T1059.005","name":"Visual Basic","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1059.005/","full_definition":true,"detection_analytics":3,"sigma_sources":23,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":3,"lab_tools":4,"documented_software":69,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1059.006","id":"T1059.006","name":"Python","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1059.006/","full_definition":true,"detection_analytics":4,"sigma_sources":4,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":4,"lab_tools":6,"documented_software":40,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1059.007","id":"T1059.007","name":"JavaScript","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1059.007/","full_definition":true,"detection_analytics":3,"sigma_sources":21,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":5,"lab_tools":5,"documented_software":42,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1059.008","id":"T1059.008","name":"Network Device CLI","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1059.008/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1059.009","id":"T1059.009","name":"Cloud API","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1059.009/","full_definition":true,"detection_analytics":1,"sigma_sources":3,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":2,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1059.010","id":"T1059.010","name":"AutoHotKey & AutoIT","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1059.010/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":1,"lab_tools":0,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1059.011","id":"T1059.011","name":"Lua","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1059.011/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1059.012","id":"T1059.012","name":"Hypervisor CLI","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1059.012/","full_definition":true,"detection_analytics":1,"sigma_sources":9,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1059.013","id":"T1059.013","name":"Container CLI/API","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1059.013/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1068","id":"T1068","name":"Exploitation for Privilege Escalation","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1068/","full_definition":true,"detection_analytics":4,"sigma_sources":15,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":2,"lab_tools":3,"documented_software":19,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1069","id":"T1069","name":"Permission Groups Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1069/","full_definition":true,"detection_analytics":3,"sigma_sources":3,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":1,"documented_software":6,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1069.001","id":"T1069.001","name":"Local Groups","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1069.001/","full_definition":true,"detection_analytics":3,"sigma_sources":15,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":6,"lab_tools":5,"documented_software":21,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1069.002","id":"T1069.002","name":"Domain Groups","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1069.002/","full_definition":true,"detection_analytics":3,"sigma_sources":14,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":15,"lab_tools":8,"documented_software":23,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1069.003","id":"T1069.003","name":"Cloud Groups","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1069.003/","full_definition":true,"detection_analytics":3,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":3,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1070","id":"T1070","name":"Indicator Removal","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1070/","full_definition":true,"detection_analytics":6,"sigma_sources":20,"anomaly_models":1,"collection_contracts":6,"atomic_candidates":2,"lab_tools":4,"documented_software":27,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1070.003","id":"T1070.003","name":"Clear Command History","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1070.003/","full_definition":true,"detection_analytics":5,"sigma_sources":9,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":14,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1070.004","id":"T1070.004","name":"File Deletion","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1070.004/","full_definition":true,"detection_analytics":4,"sigma_sources":13,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":11,"lab_tools":7,"documented_software":251,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1070.005","id":"T1070.005","name":"Network Share Connection Removal","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1070.005/","full_definition":true,"detection_analytics":1,"sigma_sources":4,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":5,"lab_tools":1,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1070.006","id":"T1070.006","name":"Timestomp","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1070.006/","full_definition":true,"detection_analytics":4,"sigma_sources":5,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":10,"lab_tools":2,"documented_software":44,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1070.007","id":"T1070.007","name":"Clear Network Connection History and Configurations","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1070.007/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1070.008","id":"T1070.008","name":"Clear Mailbox Data","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1070.008/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":6,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1070.009","id":"T1070.009","name":"Clear Persistence","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1070.009/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":1,"documented_software":15,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1070.010","id":"T1070.010","name":"Relocate Malware","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1070.010/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1071","id":"T1071","name":"Application Layer Protocol","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1071/","full_definition":true,"detection_analytics":4,"sigma_sources":5,"anomaly_models":1,"collection_contracts":5,"atomic_candidates":1,"lab_tools":1,"documented_software":10,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1071.001","id":"T1071.001","name":"Web Protocols","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1071.001/","full_definition":true,"detection_analytics":5,"sigma_sources":31,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":3,"lab_tools":18,"documented_software":344,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1071.002","id":"T1071.002","name":"File Transfer Protocols","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1071.002/","full_definition":true,"detection_analytics":5,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":3,"documented_software":20,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1071.003","id":"T1071.003","name":"Mail Protocols","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1071.003/","full_definition":true,"detection_analytics":4,"sigma_sources":1,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":20,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1071.004","id":"T1071.004","name":"DNS","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1071.004/","full_definition":true,"detection_analytics":5,"sigma_sources":10,"anomaly_models":1,"collection_contracts":4,"atomic_candidates":4,"lab_tools":4,"documented_software":43,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1071.005","id":"T1071.005","name":"Publish/Subscribe Protocols","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1071.005/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1072","id":"T1072","name":"Software Deployment Tools","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1072/","full_definition":true,"detection_analytics":5,"sigma_sources":4,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":3,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1074","id":"T1074","name":"Data Staged","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1074/","full_definition":true,"detection_analytics":5,"sigma_sources":2,"anomaly_models":1,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1074.001","id":"T1074.001","name":"Local Data Staging","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1074.001/","full_definition":true,"detection_analytics":4,"sigma_sources":4,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":3,"lab_tools":0,"documented_software":95,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1074.002","id":"T1074.002","name":"Remote Data Staging","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1074.002/","full_definition":true,"detection_analytics":5,"sigma_sources":0,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1078","id":"T1078","name":"Valid Accounts","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1078/","full_definition":true,"detection_analytics":5,"sigma_sources":55,"anomaly_models":1,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":7,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1078.001","id":"T1078.001","name":"Default Accounts","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1078.001/","full_definition":true,"detection_analytics":5,"sigma_sources":3,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":3,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1078.002","id":"T1078.002","name":"Domain Accounts","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1078.002/","full_definition":true,"detection_analytics":4,"sigma_sources":5,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":1,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1078.003","id":"T1078.003","name":"Local Accounts","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1078.003/","full_definition":true,"detection_analytics":3,"sigma_sources":5,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":13,"lab_tools":1,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1078.004","id":"T1078.004","name":"Cloud Accounts","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1078.004/","full_definition":true,"detection_analytics":4,"sigma_sources":40,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":3,"lab_tools":4,"documented_software":6,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1080","id":"T1080","name":"Taint Shared Content","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1080/","full_definition":true,"detection_analytics":5,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":7,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1082","id":"T1082","name":"System Information Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1082/","full_definition":true,"detection_analytics":6,"sigma_sources":31,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":40,"lab_tools":13,"documented_software":355,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1083","id":"T1083","name":"File and Directory Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1083/","full_definition":true,"detection_analytics":5,"sigma_sources":22,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":9,"lab_tools":16,"documented_software":308,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1087","id":"T1087","name":"Account Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1087/","full_definition":true,"detection_analytics":8,"sigma_sources":15,"anomaly_models":1,"collection_contracts":7,"atomic_candidates":0,"lab_tools":1,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1087.001","id":"T1087.001","name":"Local Account","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1087.001/","full_definition":true,"detection_analytics":4,"sigma_sources":12,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":11,"lab_tools":6,"documented_software":45,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1087.002","id":"T1087.002","name":"Domain Account","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1087.002/","full_definition":true,"detection_analytics":3,"sigma_sources":20,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":24,"lab_tools":10,"documented_software":28,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1087.003","id":"T1087.003","name":"Email Account","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1087.003/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":2,"documented_software":9,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1087.004","id":"T1087.004","name":"Cloud Account","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1087.004/","full_definition":true,"detection_analytics":4,"sigma_sources":3,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":3,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1090","id":"T1090","name":"Proxy","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1090/","full_definition":true,"detection_analytics":5,"sigma_sources":21,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":7,"documented_software":47,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1090.001","id":"T1090.001","name":"Internal Proxy","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1090.001/","full_definition":true,"detection_analytics":5,"sigma_sources":6,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":3,"lab_tools":3,"documented_software":23,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1090.002","id":"T1090.002","name":"External Proxy","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1090.002/","full_definition":true,"detection_analytics":5,"sigma_sources":2,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":2,"documented_software":11,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1090.003","id":"T1090.003","name":"Multi-hop Proxy","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1090.003/","full_definition":true,"detection_analytics":5,"sigma_sources":3,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":4,"lab_tools":3,"documented_software":23,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1090.004","id":"T1090.004","name":"Domain Fronting","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1090.004/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":3,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1091","id":"T1091","name":"Replication Through Removable Media","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1091/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":0,"documented_software":20,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1092","id":"T1092","name":"Communication Through Removable Media","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1092/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1095","id":"T1095","name":"Non-Application Layer Protocol","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1095/","full_definition":true,"detection_analytics":5,"sigma_sources":3,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":5,"lab_tools":5,"documented_software":88,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1098","id":"T1098","name":"Account Manipulation","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1098/","full_definition":true,"detection_analytics":6,"sigma_sources":31,"anomaly_models":1,"collection_contracts":4,"atomic_candidates":17,"lab_tools":1,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1098.001","id":"T1098.001","name":"Additional Cloud Credentials","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1098.001/","full_definition":true,"detection_analytics":3,"sigma_sources":3,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":3,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1098.002","id":"T1098.002","name":"Additional Email Delegate Permissions","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1098.002/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1098.003","id":"T1098.003","name":"Additional Cloud Roles","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1098.003/","full_definition":true,"detection_analytics":3,"sigma_sources":7,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":2,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1098.004","id":"T1098.004","name":"SSH Authorized Keys","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1098.004/","full_definition":true,"detection_analytics":5,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":1,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1098.005","id":"T1098.005","name":"Device Registration","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1098.005/","full_definition":true,"detection_analytics":2,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1098.006","id":"T1098.006","name":"Additional Container Cluster Roles","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1098.006/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1098.007","id":"T1098.007","name":"Additional Local or Domain Groups","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1098.007/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":1,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1102","id":"T1102","name":"Web Service","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1102/","full_definition":true,"detection_analytics":4,"sigma_sources":13,"anomaly_models":1,"collection_contracts":3,"atomic_candidates":0,"lab_tools":2,"documented_software":31,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1102.001","id":"T1102.001","name":"Dead Drop Resolver","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1102.001/","full_definition":true,"detection_analytics":4,"sigma_sources":4,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":19,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1102.002","id":"T1102.002","name":"Bidirectional Communication","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1102.002/","full_definition":true,"detection_analytics":3,"sigma_sources":3,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":1,"documented_software":38,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1102.003","id":"T1102.003","name":"One-Way Communication","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1102.003/","full_definition":true,"detection_analytics":4,"sigma_sources":2,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":6,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1104","id":"T1104","name":"Multi-Stage Channels","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1104/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":10,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1105/","full_definition":true,"detection_analytics":5,"sigma_sources":70,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":38,"lab_tools":21,"documented_software":403,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1106","id":"T1106","name":"Native API","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1106/","full_definition":true,"detection_analytics":3,"sigma_sources":11,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":5,"lab_tools":10,"documented_software":203,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1110","id":"T1110","name":"Brute Force","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1110/","full_definition":true,"detection_analytics":5,"sigma_sources":25,"anomaly_models":1,"collection_contracts":1,"atomic_candidates":0,"lab_tools":2,"documented_software":7,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1110.001","id":"T1110.001","name":"Password Guessing","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1110.001/","full_definition":true,"detection_analytics":6,"sigma_sources":3,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":8,"lab_tools":6,"documented_software":9,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1110.002","id":"T1110.002","name":"Password Cracking","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1110.002/","full_definition":true,"detection_analytics":5,"sigma_sources":1,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":1,"lab_tools":3,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1110.003","id":"T1110.003","name":"Password Spraying","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1110.003/","full_definition":true,"detection_analytics":8,"sigma_sources":0,"anomaly_models":1,"collection_contracts":1,"atomic_candidates":9,"lab_tools":2,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1110.004","id":"T1110.004","name":"Credential Stuffing","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1110.004/","full_definition":true,"detection_analytics":9,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":4,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1111","id":"T1111","name":"Multi-Factor Authentication Interception","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1111/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":1,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1112/","full_definition":true,"detection_analytics":1,"sigma_sources":78,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":92,"lab_tools":10,"documented_software":139,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1113","id":"T1113","name":"Screen Capture","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1113/","full_definition":true,"detection_analytics":3,"sigma_sources":9,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":10,"lab_tools":13,"documented_software":151,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1114","id":"T1114","name":"Email Collection","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1114/","full_definition":true,"detection_analytics":4,"sigma_sources":4,"anomaly_models":1,"collection_contracts":7,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1114.001","id":"T1114.001","name":"Local Email Collection","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1114.001/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":3,"documented_software":11,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1114.002","id":"T1114.002","name":"Remote Email Collection","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1114.002/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":1,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1114.003","id":"T1114.003","name":"Email Forwarding Rule","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1114.003/","full_definition":true,"detection_analytics":4,"sigma_sources":2,"anomaly_models":1,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1115","id":"T1115","name":"Clipboard Data","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1115/","full_definition":true,"detection_analytics":3,"sigma_sources":7,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":5,"lab_tools":4,"documented_software":41,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1119","id":"T1119","name":"Automated Collection","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1119/","full_definition":true,"detection_analytics":4,"sigma_sources":4,"anomaly_models":1,"collection_contracts":5,"atomic_candidates":4,"lab_tools":7,"documented_software":48,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1120","id":"T1120","name":"Peripheral Device Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1120/","full_definition":true,"detection_analytics":3,"sigma_sources":2,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":4,"lab_tools":0,"documented_software":47,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1123","id":"T1123","name":"Audio Capture","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1123/","full_definition":true,"detection_analytics":3,"sigma_sources":6,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":3,"lab_tools":4,"documented_software":30,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1124","id":"T1124","name":"System Time Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1124/","full_definition":true,"detection_analytics":5,"sigma_sources":3,"anomaly_models":0,"collection_contracts":11,"atomic_candidates":6,"lab_tools":3,"documented_software":83,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1125","id":"T1125","name":"Video Capture","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1125/","full_definition":true,"detection_analytics":3,"sigma_sources":1,"anomaly_models":0,"collection_contracts":9,"atomic_candidates":1,"lab_tools":9,"documented_software":31,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1127","id":"T1127","name":"Trusted Developer Utilities Proxy Execution","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1127/","full_definition":true,"detection_analytics":1,"sigma_sources":19,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":2,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1127.001","id":"T1127.001","name":"MSBuild","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1127.001/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":8,"atomic_candidates":2,"lab_tools":1,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1127.002","id":"T1127.002","name":"ClickOnce","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1127.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1127.003","id":"T1127.003","name":"JamPlus","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1127.003/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1129","id":"T1129","name":"Shared Modules","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1129/","full_definition":true,"detection_analytics":3,"sigma_sources":1,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":1,"lab_tools":0,"documented_software":21,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1132","id":"T1132","name":"Data Encoding","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1132/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":2,"documented_software":7,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1132.001","id":"T1132.001","name":"Standard Encoding","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1132.001/","full_definition":true,"detection_analytics":4,"sigma_sources":4,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":3,"lab_tools":3,"documented_software":114,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1132.002","id":"T1132.002","name":"Non-Standard Encoding","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1132.002/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":0,"documented_software":17,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1133","id":"T1133","name":"External Remote Services","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1133/","full_definition":true,"detection_analytics":4,"sigma_sources":19,"anomaly_models":1,"collection_contracts":5,"atomic_candidates":1,"lab_tools":0,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1134","id":"T1134","name":"Access Token Manipulation","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1134/","full_definition":true,"detection_analytics":1,"sigma_sources":2,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":4,"documented_software":19,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1134.001","id":"T1134.001","name":"Token Impersonation/Theft","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1134.001/","full_definition":true,"detection_analytics":1,"sigma_sources":9,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":5,"lab_tools":3,"documented_software":17,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1134.002","id":"T1134.002","name":"Create Process with Token","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1134.002/","full_definition":true,"detection_analytics":1,"sigma_sources":6,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":2,"lab_tools":2,"documented_software":11,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1134.003","id":"T1134.003","name":"Make and Impersonate Token","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1134.003/","full_definition":true,"detection_analytics":1,"sigma_sources":3,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":2,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1134.004","id":"T1134.004","name":"Parent PID Spoofing","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1134.004/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":5,"lab_tools":1,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1134.005","id":"T1134.005","name":"SID-History Injection","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1134.005/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":1,"lab_tools":2,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1135","id":"T1135","name":"Network Share Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1135/","full_definition":true,"detection_analytics":3,"sigma_sources":4,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":12,"lab_tools":7,"documented_software":57,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1136","id":"T1136","name":"Create Account","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1136/","full_definition":true,"detection_analytics":5,"sigma_sources":3,"anomaly_models":1,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1136.001","id":"T1136.001","name":"Local Account","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1136.001/","full_definition":true,"detection_analytics":6,"sigma_sources":14,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":10,"lab_tools":3,"documented_software":15,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1136.002","id":"T1136.002","name":"Domain Account","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1136.002/","full_definition":true,"detection_analytics":3,"sigma_sources":3,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":5,"lab_tools":4,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1136.003","id":"T1136.003","name":"Cloud Account","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1136.003/","full_definition":true,"detection_analytics":4,"sigma_sources":3,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":3,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1137","id":"T1137","name":"Office Application Startup","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1137/","full_definition":true,"detection_analytics":2,"sigma_sources":8,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":1,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1137.001","id":"T1137.001","name":"Office Template Macros","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1137.001/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":1,"lab_tools":1,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1137.002","id":"T1137.002","name":"Office Test","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1137.002/","full_definition":true,"detection_analytics":2,"sigma_sources":2,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":1,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1137.003","id":"T1137.003","name":"Outlook Forms","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1137.003/","full_definition":true,"detection_analytics":2,"sigma_sources":1,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1137.004","id":"T1137.004","name":"Outlook Home Page","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1137.004/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1137.005","id":"T1137.005","name":"Outlook Rules","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1137.005/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":5,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1137.006","id":"T1137.006","name":"Add-ins","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1137.006/","full_definition":true,"detection_analytics":2,"sigma_sources":4,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":5,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1140","id":"T1140","name":"Deobfuscate/Decode Files or Information","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1140/","full_definition":true,"detection_analytics":3,"sigma_sources":14,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":11,"lab_tools":7,"documented_software":301,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1176","id":"T1176","name":"Software Extensions","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1176/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":4,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1176.001","id":"T1176.001","name":"Browser Extensions","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1176.001/","full_definition":true,"detection_analytics":3,"sigma_sources":2,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":0,"lab_tools":0,"documented_software":6,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1176.002","id":"T1176.002","name":"IDE Extensions","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1176.002/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1185","id":"T1185","name":"Browser Session Hijacking","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1185/","full_definition":true,"detection_analytics":1,"sigma_sources":2,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":0,"lab_tools":2,"documented_software":15,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1187","id":"T1187","name":"Forced Authentication","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1187/","full_definition":true,"detection_analytics":1,"sigma_sources":7,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":3,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1189","id":"T1189","name":"Drive-by Compromise","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1189/","full_definition":true,"detection_analytics":4,"sigma_sources":3,"anomaly_models":0,"collection_contracts":9,"atomic_candidates":0,"lab_tools":0,"documented_software":10,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1190","id":"T1190","name":"Exploit Public-Facing Application","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1190/","full_definition":true,"detection_analytics":7,"sigma_sources":46,"anomaly_models":1,"collection_contracts":6,"atomic_candidates":0,"lab_tools":2,"documented_software":8,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1195","id":"T1195","name":"Supply Chain Compromise","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1195/","full_definition":true,"detection_analytics":3,"sigma_sources":1,"anomaly_models":1,"collection_contracts":7,"atomic_candidates":1,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1195.001","id":"T1195.001","name":"Compromise Software Dependencies and Development Tools","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1195.001/","full_definition":true,"detection_analytics":3,"sigma_sources":2,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":0,"lab_tools":0,"documented_software":7,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1195.002","id":"T1195.002","name":"Compromise Software Supply Chain","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1195.002/","full_definition":true,"detection_analytics":3,"sigma_sources":3,"anomaly_models":0,"collection_contracts":8,"atomic_candidates":1,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1195.003","id":"T1195.003","name":"Compromise Hardware Supply Chain","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1195.003/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1197","id":"T1197","name":"BITS Jobs","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1197/","full_definition":true,"detection_analytics":1,"sigma_sources":15,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":4,"lab_tools":2,"documented_software":8,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1199","id":"T1199","name":"Trusted Relationship","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1199/","full_definition":true,"detection_analytics":7,"sigma_sources":1,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1200","id":"T1200","name":"Hardware Additions","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1200/","full_definition":true,"detection_analytics":3,"sigma_sources":3,"anomaly_models":0,"collection_contracts":8,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1201","id":"T1201","name":"Password Policy Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1201/","full_definition":true,"detection_analytics":7,"sigma_sources":5,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":12,"lab_tools":3,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1202","id":"T1202","name":"Indirect Command Execution","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1202/","full_definition":true,"detection_analytics":1,"sigma_sources":39,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":5,"lab_tools":1,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1203","id":"T1203","name":"Exploitation for Client Execution","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1203/","full_definition":true,"detection_analytics":3,"sigma_sources":17,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":0,"lab_tools":1,"documented_software":14,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1204","id":"T1204","name":"User Execution","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1204/","full_definition":true,"detection_analytics":5,"sigma_sources":7,"anomaly_models":0,"collection_contracts":11,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1204.001","id":"T1204.001","name":"Malicious Link","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1204.001/","full_definition":true,"detection_analytics":3,"sigma_sources":4,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":30,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1204.002","id":"T1204.002","name":"Malicious File","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1204.002/","full_definition":true,"detection_analytics":3,"sigma_sources":27,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":13,"lab_tools":5,"documented_software":98,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1204.003","id":"T1204.003","name":"Malicious Image","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1204.003/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":8,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1204.004","id":"T1204.004","name":"Malicious Copy and Paste","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1204.004/","full_definition":true,"detection_analytics":3,"sigma_sources":6,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":1,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1204.005","id":"T1204.005","name":"Malicious Library","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1204.005/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1205","id":"T1205","name":"Traffic Signaling","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1205/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":18,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1205.001","id":"T1205.001","name":"Port Knocking","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1205.001/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1205.002","id":"T1205.002","name":"Socket Filters","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1205.002/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1207","id":"T1207","name":"Rogue Domain Controller","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1207/","full_definition":true,"detection_analytics":1,"sigma_sources":2,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":1,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1210","id":"T1210","name":"Exploitation of Remote Services","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1210/","full_definition":true,"detection_analytics":4,"sigma_sources":7,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":0,"lab_tools":2,"documented_software":13,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1211","id":"T1211","name":"Exploitation for Stealth","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1211/","full_definition":true,"detection_analytics":5,"sigma_sources":4,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1212","id":"T1212","name":"Exploitation for Credential Access","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1212/","full_definition":true,"detection_analytics":4,"sigma_sources":4,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1213","id":"T1213","name":"Data from Information Repositories","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1213/","full_definition":true,"detection_analytics":4,"sigma_sources":7,"anomaly_models":0,"collection_contracts":8,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1213.001","id":"T1213.001","name":"Confluence","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1213.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1213.002","id":"T1213.002","name":"Sharepoint","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1213.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":2,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1213.003","id":"T1213.003","name":"Code Repositories","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1213.003/","full_definition":true,"detection_analytics":1,"sigma_sources":5,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":1,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1213.004","id":"T1213.004","name":"Customer Relationship Management Software","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1213.004/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1213.005","id":"T1213.005","name":"Messaging Applications","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1213.005/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1213.006","id":"T1213.006","name":"Databases","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1213.006/","full_definition":true,"detection_analytics":5,"sigma_sources":0,"anomaly_models":0,"collection_contracts":8,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1216","id":"T1216","name":"System Script Proxy Execution","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1216/","full_definition":true,"detection_analytics":1,"sigma_sources":13,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":1,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1216.001","id":"T1216.001","name":"PubPrn","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1216.001/","full_definition":true,"detection_analytics":1,"sigma_sources":2,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1216.002","id":"T1216.002","name":"SyncAppvPublishingServer","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1216.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1217","id":"T1217","name":"Browser Information Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1217/","full_definition":true,"detection_analytics":3,"sigma_sources":4,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":11,"lab_tools":1,"documented_software":18,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1218/","full_definition":true,"detection_analytics":3,"sigma_sources":135,"anomaly_models":1,"collection_contracts":3,"atomic_candidates":16,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1218.001","id":"T1218.001","name":"Compiled HTML File","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1218.001/","full_definition":true,"detection_analytics":1,"sigma_sources":5,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":8,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1218.002","id":"T1218.002","name":"Control Panel","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1218.002/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1218.003","id":"T1218.003","name":"CMSTP","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1218.003/","full_definition":true,"detection_analytics":1,"sigma_sources":7,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":2,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1218.004","id":"T1218.004","name":"InstallUtil","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1218.004/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":8,"lab_tools":1,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1218.005","id":"T1218.005","name":"Mshta","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1218.005/","full_definition":true,"detection_analytics":1,"sigma_sources":7,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":10,"lab_tools":2,"documented_software":11,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1218.007","id":"T1218.007","name":"Msiexec","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1218.007/","full_definition":true,"detection_analytics":1,"sigma_sources":9,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":11,"lab_tools":1,"documented_software":23,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1218.008","id":"T1218.008","name":"Odbcconf","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1218.008/","full_definition":true,"detection_analytics":1,"sigma_sources":8,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":2,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1218.009","id":"T1218.009","name":"Regsvcs/Regasm","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1218.009/","full_definition":true,"detection_analytics":1,"sigma_sources":4,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":2,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1218.010","id":"T1218.010","name":"Regsvr32","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1218.010/","full_definition":true,"detection_analytics":1,"sigma_sources":17,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":5,"lab_tools":2,"documented_software":23,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1218.011","id":"T1218.011","name":"Rundll32","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1218.011/","full_definition":true,"detection_analytics":1,"sigma_sources":27,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":16,"lab_tools":3,"documented_software":69,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1218.012","id":"T1218.012","name":"Verclsid","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1218.012/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1218.013","id":"T1218.013","name":"Mavinject","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1218.013/","full_definition":true,"detection_analytics":1,"sigma_sources":2,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1218.014","id":"T1218.014","name":"MMC","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1218.014/","full_definition":true,"detection_analytics":1,"sigma_sources":2,"anomaly_models":0,"collection_contracts":8,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1218.015","id":"T1218.015","name":"Electron Applications","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1218.015/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1219","id":"T1219","name":"Remote Access Tools","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1219/","full_definition":true,"detection_analytics":3,"sigma_sources":6,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":15,"lab_tools":0,"documented_software":7,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1219.001","id":"T1219.001","name":"IDE Tunneling","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1219.001/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1219.002","id":"T1219.002","name":"Remote Desktop Software","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1219.002/","full_definition":true,"detection_analytics":3,"sigma_sources":41,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1219.003","id":"T1219.003","name":"Remote Access Hardware","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1219.003/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1220","id":"T1220","name":"XSL Script Processing","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1220/","full_definition":true,"detection_analytics":1,"sigma_sources":5,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":4,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1221","id":"T1221","name":"Template Injection","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1221/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":1,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1222","id":"T1222","name":"File and Directory Permissions Modification","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1222/","full_definition":true,"detection_analytics":4,"sigma_sources":2,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":3,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1222.001","id":"T1222.001","name":"Windows Permissions","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1222.001/","full_definition":true,"detection_analytics":1,"sigma_sources":3,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":6,"lab_tools":1,"documented_software":10,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1222.002","id":"T1222.002","name":"Linux and Mac Permissions","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1222.002/","full_definition":true,"detection_analytics":2,"sigma_sources":4,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":14,"lab_tools":0,"documented_software":11,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1480","id":"T1480","name":"Execution Guardrails","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1480/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":11,"atomic_candidates":0,"lab_tools":1,"documented_software":45,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1480.001","id":"T1480.001","name":"Environmental Keying","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1480.001/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":8,"atomic_candidates":0,"lab_tools":0,"documented_software":8,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1480.002","id":"T1480.002","name":"Mutual Exclusion","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1480.002/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":18,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1482","id":"T1482","name":"Domain Trust Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1482/","full_definition":true,"detection_analytics":1,"sigma_sources":17,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":8,"lab_tools":9,"documented_software":20,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1484","id":"T1484","name":"Domain or Tenant Policy Modification","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1484/","full_definition":true,"detection_analytics":2,"sigma_sources":1,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1484.001","id":"T1484.001","name":"Group Policy Modification","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1484.001/","full_definition":true,"detection_analytics":1,"sigma_sources":6,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":2,"lab_tools":1,"documented_software":8,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1484.002","id":"T1484.002","name":"Trust Modification","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1484.002/","full_definition":true,"detection_analytics":2,"sigma_sources":1,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":1,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1485","id":"T1485","name":"Data Destruction","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1485/","full_definition":true,"detection_analytics":6,"sigma_sources":19,"anomaly_models":1,"collection_contracts":7,"atomic_candidates":5,"lab_tools":2,"documented_software":30,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1485.001","id":"T1485.001","name":"Lifecycle-Triggered Deletion","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1485.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1486","id":"T1486","name":"Data Encrypted for Impact","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1486/","full_definition":true,"detection_analytics":5,"sigma_sources":10,"anomaly_models":1,"collection_contracts":5,"atomic_candidates":10,"lab_tools":0,"documented_software":62,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1489","id":"T1489","name":"Service Stop","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1489/","full_definition":true,"detection_analytics":4,"sigma_sources":19,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":9,"lab_tools":0,"documented_software":47,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1490","id":"T1490","name":"Inhibit System Recovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1490/","full_definition":true,"detection_analytics":5,"sigma_sources":23,"anomaly_models":1,"collection_contracts":7,"atomic_candidates":13,"lab_tools":0,"documented_software":48,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1491","id":"T1491","name":"Defacement","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1491/","full_definition":true,"detection_analytics":5,"sigma_sources":0,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1491.001","id":"T1491.001","name":"Internal Defacement","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1491.001/","full_definition":true,"detection_analytics":4,"sigma_sources":4,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":4,"lab_tools":1,"documented_software":11,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1491.002","id":"T1491.002","name":"External Defacement","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1491.002/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1495","id":"T1495","name":"Firmware Corruption","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1495/","full_definition":true,"detection_analytics":4,"sigma_sources":1,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1496","id":"T1496","name":"Resource Hijacking","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1496/","full_definition":true,"detection_analytics":6,"sigma_sources":13,"anomaly_models":1,"collection_contracts":8,"atomic_candidates":2,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1496.001","id":"T1496.001","name":"Compute Hijacking","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1496.001/","full_definition":true,"detection_analytics":5,"sigma_sources":0,"anomaly_models":0,"collection_contracts":8,"atomic_candidates":0,"lab_tools":1,"documented_software":9,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1496.002","id":"T1496.002","name":"Bandwidth Hijacking","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1496.002/","full_definition":true,"detection_analytics":5,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1496.003","id":"T1496.003","name":"SMS Pumping","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1496.003/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1496.004","id":"T1496.004","name":"Cloud Service Hijacking","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1496.004/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1497","id":"T1497","name":"Virtualization/Sandbox Evasion","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1497/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":23,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1497.001","id":"T1497.001","name":"System Checks","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1497.001/","full_definition":true,"detection_analytics":3,"sigma_sources":3,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":9,"lab_tools":4,"documented_software":61,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1497.002","id":"T1497.002","name":"User Activity Based Checks","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1497.002/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":1,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1497.003","id":"T1497.003","name":"Time Based Checks","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1497.003/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":2,"documented_software":48,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1498","id":"T1498","name":"Network Denial of Service","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1498/","full_definition":true,"detection_analytics":2,"sigma_sources":2,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1498.001","id":"T1498.001","name":"Direct Network Flood","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1498.001/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1498.002","id":"T1498.002","name":"Reflection Amplification","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1498.002/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1499","id":"T1499","name":"Endpoint Denial of Service","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1499/","full_definition":true,"detection_analytics":5,"sigma_sources":1,"anomaly_models":1,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1499.001","id":"T1499.001","name":"OS Exhaustion Flood","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1499.001/","full_definition":true,"detection_analytics":3,"sigma_sources":1,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1499.002","id":"T1499.002","name":"Service Exhaustion Flood","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1499.002/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1499.003","id":"T1499.003","name":"Application Exhaustion Flood","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1499.003/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1499.004","id":"T1499.004","name":"Application or System Exploitation","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1499.004/","full_definition":true,"detection_analytics":4,"sigma_sources":3,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1505","id":"T1505","name":"Server Software Component","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1505/","full_definition":true,"detection_analytics":4,"sigma_sources":1,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1505.001","id":"T1505.001","name":"SQL Stored Procedures","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1505.001/","full_definition":true,"detection_analytics":2,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1505.002","id":"T1505.002","name":"Transport Agent","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1505.002/","full_definition":true,"detection_analytics":2,"sigma_sources":3,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":1,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1505.003","id":"T1505.003","name":"Web Shell","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1505.003/","full_definition":true,"detection_analytics":3,"sigma_sources":23,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":1,"lab_tools":0,"documented_software":22,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1505.004","id":"T1505.004","name":"IIS Components","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1505.004/","full_definition":true,"detection_analytics":1,"sigma_sources":5,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":2,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1505.005","id":"T1505.005","name":"Terminal Services DLL","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1505.005/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":2,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1505.006","id":"T1505.006","name":"vSphere Installation Bundles","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1505.006/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1518","id":"T1518","name":"Software Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1518/","full_definition":true,"detection_analytics":5,"sigma_sources":4,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":6,"lab_tools":2,"documented_software":39,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1518.001","id":"T1518.001","name":"Security Software Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1518.001/","full_definition":true,"detection_analytics":3,"sigma_sources":7,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":12,"lab_tools":6,"documented_software":111,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1518.002","id":"T1518.002","name":"Backup Software Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1518.002/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1525","id":"T1525","name":"Implant Internal Image","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1525/","full_definition":true,"detection_analytics":2,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1526","id":"T1526","name":"Cloud Service Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1526/","full_definition":true,"detection_analytics":4,"sigma_sources":3,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":3,"lab_tools":4,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1528","id":"T1528","name":"Steal Application Access Token","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1528/","full_definition":true,"detection_analytics":5,"sigma_sources":14,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":2,"lab_tools":3,"documented_software":8,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1529","id":"T1529","name":"System Shutdown/Reboot","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1529/","full_definition":true,"detection_analytics":5,"sigma_sources":8,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":16,"lab_tools":1,"documented_software":26,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1530","id":"T1530","name":"Data from Cloud Storage","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1530/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":2,"lab_tools":4,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1531","id":"T1531","name":"Account Access Removal","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1531/","full_definition":true,"detection_analytics":6,"sigma_sources":9,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":6,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1534","id":"T1534","name":"Internal Spearphishing","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1534/","full_definition":true,"detection_analytics":5,"sigma_sources":0,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1535","id":"T1535","name":"Unused/Unsupported Cloud Regions","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1535/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1537","id":"T1537","name":"Transfer Data to Cloud Account","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1537/","full_definition":true,"detection_analytics":3,"sigma_sources":6,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1538","id":"T1538","name":"Cloud Service Dashboard","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1538/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1539","id":"T1539","name":"Steal Web Session Cookie","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1539/","full_definition":true,"detection_analytics":5,"sigma_sources":2,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":5,"lab_tools":1,"documented_software":20,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1542","id":"T1542","name":"Pre-OS Boot","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1542/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1542.001","id":"T1542.001","name":"System Firmware","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1542.001/","full_definition":true,"detection_analytics":2,"sigma_sources":2,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":1,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1542.002","id":"T1542.002","name":"Component Firmware","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1542.002/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1542.003","id":"T1542.003","name":"Bootkit","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1542.003/","full_definition":true,"detection_analytics":2,"sigma_sources":1,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":6,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1542.004","id":"T1542.004","name":"ROMMONkit","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1542.004/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1542.005","id":"T1542.005","name":"TFTP Boot","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1542.005/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1543","id":"T1543","name":"Create or Modify System Process","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1543/","full_definition":true,"detection_analytics":4,"sigma_sources":9,"anomaly_models":1,"collection_contracts":6,"atomic_candidates":0,"lab_tools":0,"documented_software":8,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1543.001","id":"T1543.001","name":"Launch Agent","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1543.001/","full_definition":true,"detection_analytics":1,"sigma_sources":2,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":3,"lab_tools":0,"documented_software":22,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1543.002","id":"T1543.002","name":"Systemd Service","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1543.002/","full_definition":true,"detection_analytics":1,"sigma_sources":2,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":4,"lab_tools":1,"documented_software":11,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1543.003","id":"T1543.003","name":"Windows Service","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1543.003/","full_definition":true,"detection_analytics":1,"sigma_sources":38,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":6,"lab_tools":6,"documented_software":109,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1543.004","id":"T1543.004","name":"Launch Daemon","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1543.004/","full_definition":true,"detection_analytics":1,"sigma_sources":2,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":0,"documented_software":10,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1543.005","id":"T1543.005","name":"Container Service","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1543.005/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1546","id":"T1546","name":"Event Triggered Execution","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1546/","full_definition":true,"detection_analytics":6,"sigma_sources":7,"anomaly_models":0,"collection_contracts":10,"atomic_candidates":9,"lab_tools":1,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1546.001","id":"T1546.001","name":"Change Default File Association","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1546.001/","full_definition":true,"detection_analytics":1,"sigma_sources":5,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":1,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1546.002","id":"T1546.002","name":"Screensaver","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1546.002/","full_definition":true,"detection_analytics":1,"sigma_sources":4,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":1,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1546.003","id":"T1546.003","name":"Windows Management Instrumentation Event Subscription","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1546.003/","full_definition":true,"detection_analytics":1,"sigma_sources":11,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":4,"lab_tools":2,"documented_software":13,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1546.004","id":"T1546.004","name":"Unix Shell Configuration Modification","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1546.004/","full_definition":true,"detection_analytics":2,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":7,"lab_tools":0,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1546.005","id":"T1546.005","name":"Trap","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1546.005/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":5,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1546.006","id":"T1546.006","name":"LC_LOAD_DYLIB Addition","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1546.006/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1546.007","id":"T1546.007","name":"Netsh Helper DLL","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1546.007/","full_definition":true,"detection_analytics":1,"sigma_sources":4,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":1,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1546.008","id":"T1546.008","name":"Accessibility Features","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1546.008/","full_definition":true,"detection_analytics":1,"sigma_sources":6,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":10,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1546.009","id":"T1546.009","name":"AppCert DLLs","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1546.009/","full_definition":true,"detection_analytics":1,"sigma_sources":2,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":1,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1546.010","id":"T1546.010","name":"AppInit DLLs","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1546.010/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":1,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1546.011","id":"T1546.011","name":"Application Shimming","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1546.011/","full_definition":true,"detection_analytics":1,"sigma_sources":6,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":3,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1546.012","id":"T1546.012","name":"Image File Execution Options Injection","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1546.012/","full_definition":true,"detection_analytics":1,"sigma_sources":2,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":3,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1546.013","id":"T1546.013","name":"PowerShell Profile","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1546.013/","full_definition":true,"detection_analytics":1,"sigma_sources":3,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":2,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1546.014","id":"T1546.014","name":"Emond","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1546.014/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1546.015","id":"T1546.015","name":"Component Object Model Hijacking","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1546.015/","full_definition":true,"detection_analytics":1,"sigma_sources":8,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":4,"lab_tools":2,"documented_software":11,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1546.016","id":"T1546.016","name":"Installer Packages","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1546.016/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1546.017","id":"T1546.017","name":"Udev Rules","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1546.017/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1546.018","id":"T1546.018","name":"Python Startup Hooks","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1546.018/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":5,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1547","id":"T1547","name":"Boot or Logon Autostart Execution","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1547/","full_definition":true,"detection_analytics":3,"sigma_sources":7,"anomaly_models":1,"collection_contracts":5,"atomic_candidates":3,"lab_tools":0,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1547.001","id":"T1547.001","name":"Registry Run Keys / Startup Folder","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1547.001/","full_definition":true,"detection_analytics":1,"sigma_sources":31,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":21,"lab_tools":8,"documented_software":201,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1547.002","id":"T1547.002","name":"Authentication Package","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1547.002/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":1,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1547.003","id":"T1547.003","name":"Time Providers","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1547.003/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":2,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1547.004","id":"T1547.004","name":"Winlogon Helper DLL","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1547.004/","full_definition":true,"detection_analytics":1,"sigma_sources":3,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":5,"lab_tools":0,"documented_software":10,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1547.005","id":"T1547.005","name":"Security Support Provider","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1547.005/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":2,"lab_tools":3,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1547.006","id":"T1547.006","name":"Kernel Modules and Extensions","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1547.006/","full_definition":true,"detection_analytics":2,"sigma_sources":1,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":3,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1547.007","id":"T1547.007","name":"Re-opened Applications","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1547.007/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":3,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1547.008","id":"T1547.008","name":"LSASS Driver","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1547.008/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":1,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1547.009","id":"T1547.009","name":"Shortcut Modification","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1547.009/","full_definition":true,"detection_analytics":1,"sigma_sources":4,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":2,"lab_tools":1,"documented_software":25,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1547.010","id":"T1547.010","name":"Port Monitors","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1547.010/","full_definition":true,"detection_analytics":1,"sigma_sources":4,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":1,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1547.012","id":"T1547.012","name":"Print Processors","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1547.012/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1547.013","id":"T1547.013","name":"XDG Autostart Entries","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1547.013/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":1,"documented_software":6,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1547.014","id":"T1547.014","name":"Active Setup","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1547.014/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":3,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1547.015","id":"T1547.015","name":"Login Items","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1547.015/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1548","id":"T1548","name":"Abuse Elevation Control Mechanism","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1548/","full_definition":true,"detection_analytics":5,"sigma_sources":22,"anomaly_models":1,"collection_contracts":7,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1548.001","id":"T1548.001","name":"Setuid and Setgid","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1548.001/","full_definition":true,"detection_analytics":2,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":10,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1548.002","id":"T1548.002","name":"Bypass User Account Control","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1548.002/","full_definition":true,"detection_analytics":1,"sigma_sources":56,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":28,"lab_tools":11,"documented_software":51,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1548.003","id":"T1548.003","name":"Sudo and Sudo Caching","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1548.003/","full_definition":true,"detection_analytics":2,"sigma_sources":1,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":6,"lab_tools":1,"documented_software":6,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1548.004","id":"T1548.004","name":"Elevated Execution with Prompt","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1548.004/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1548.005","id":"T1548.005","name":"Temporary Elevated Cloud Access","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1548.005/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1548.006","id":"T1548.006","name":"TCC Manipulation","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1548.006/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1550","id":"T1550","name":"Use Alternate Authentication Material","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1550/","full_definition":true,"detection_analytics":7,"sigma_sources":4,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1550.001","id":"T1550.001","name":"Application Access Token","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1550.001/","full_definition":true,"detection_analytics":5,"sigma_sources":4,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":1,"documented_software":6,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1550.002","id":"T1550.002","name":"Pass the Hash","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1550.002/","full_definition":true,"detection_analytics":1,"sigma_sources":5,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":3,"lab_tools":6,"documented_software":8,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1550.003","id":"T1550.003","name":"Pass the Ticket","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1550.003/","full_definition":true,"detection_analytics":1,"sigma_sources":4,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":2,"lab_tools":3,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1550.004","id":"T1550.004","name":"Web Session Cookie","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1550.004/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1552","id":"T1552","name":"Unsecured Credentials","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1552/","full_definition":true,"detection_analytics":7,"sigma_sources":12,"anomaly_models":1,"collection_contracts":9,"atomic_candidates":2,"lab_tools":2,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1552.001","id":"T1552.001","name":"Credentials In Files","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1552.001/","full_definition":true,"detection_analytics":5,"sigma_sources":20,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":32,"lab_tools":7,"documented_software":23,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1552.002","id":"T1552.002","name":"Credentials in Registry","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1552.002/","full_definition":true,"detection_analytics":1,"sigma_sources":4,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":2,"lab_tools":2,"documented_software":7,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1552.003","id":"T1552.003","name":"Shell History","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1552.003/","full_definition":true,"detection_analytics":2,"sigma_sources":3,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":4,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1552.004","id":"T1552.004","name":"Private Keys","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1552.004/","full_definition":true,"detection_analytics":4,"sigma_sources":6,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":17,"lab_tools":3,"documented_software":14,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1552.005","id":"T1552.005","name":"Cloud Instance Metadata API","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1552.005/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":2,"lab_tools":2,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1552.006","id":"T1552.006","name":"Group Policy Preferences","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1552.006/","full_definition":true,"detection_analytics":1,"sigma_sources":5,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":2,"lab_tools":2,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1552.007","id":"T1552.007","name":"Container API","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1552.007/","full_definition":true,"detection_analytics":1,"sigma_sources":4,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":2,"lab_tools":1,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1552.008","id":"T1552.008","name":"Chat Messages","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1552.008/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1553","id":"T1553","name":"Subvert Trust Controls","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1553/","full_definition":true,"detection_analytics":3,"sigma_sources":2,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1553.001","id":"T1553.001","name":"Gatekeeper Bypass","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1553.001/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":1,"lab_tools":0,"documented_software":6,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1553.002","id":"T1553.002","name":"Code Signing","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1553.002/","full_definition":true,"detection_analytics":2,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":3,"documented_software":53,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1553.003","id":"T1553.003","name":"SIP and Trust Provider Hijacking","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1553.003/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":1,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1553.004","id":"T1553.004","name":"Install Root Certificate","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1553.004/","full_definition":true,"detection_analytics":3,"sigma_sources":10,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":7,"lab_tools":2,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1553.005","id":"T1553.005","name":"Mark-of-the-Web Bypass","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1553.005/","full_definition":true,"detection_analytics":1,"sigma_sources":6,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":4,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1553.006","id":"T1553.006","name":"Code Signing Policy Modification","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1553.006/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":1,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1554","id":"T1554","name":"Compromise Host Software Binary","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1554/","full_definition":true,"detection_analytics":4,"sigma_sources":5,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":19,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1555","id":"T1555","name":"Credentials from Password Stores","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1555/","full_definition":true,"detection_analytics":4,"sigma_sources":8,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":9,"lab_tools":5,"documented_software":26,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1555.001","id":"T1555.001","name":"Keychain","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1555.001/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":4,"lab_tools":2,"documented_software":11,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1555.002","id":"T1555.002","name":"Securityd Memory","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1555.002/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1555.003","id":"T1555.003","name":"Credentials from Web Browsers","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1555.003/","full_definition":true,"detection_analytics":3,"sigma_sources":7,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":18,"lab_tools":7,"documented_software":64,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1555.004","id":"T1555.004","name":"Windows Credential Manager","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1555.004/","full_definition":true,"detection_analytics":1,"sigma_sources":4,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":2,"lab_tools":4,"documented_software":9,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1555.005","id":"T1555.005","name":"Password Managers","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1555.005/","full_definition":true,"detection_analytics":3,"sigma_sources":1,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1555.006","id":"T1555.006","name":"Cloud Secrets Management Stores","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1555.006/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":1,"lab_tools":2,"documented_software":6,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1556","id":"T1556","name":"Modify Authentication Process","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1556/","full_definition":true,"detection_analytics":5,"sigma_sources":12,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":0,"lab_tools":1,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1556.001","id":"T1556.001","name":"Domain Controller Authentication","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1556.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1556.002","id":"T1556.002","name":"Password Filter DLL","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1556.002/","full_definition":true,"detection_analytics":1,"sigma_sources":3,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":2,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1556.003","id":"T1556.003","name":"Pluggable Authentication Modules","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1556.003/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":3,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1556.004","id":"T1556.004","name":"Network Device Authentication","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1556.004/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1556.005","id":"T1556.005","name":"Reversible Encryption","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1556.005/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1556.006","id":"T1556.006","name":"Multi-Factor Authentication","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1556.006/","full_definition":true,"detection_analytics":7,"sigma_sources":3,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":0,"lab_tools":1,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1556.007","id":"T1556.007","name":"Hybrid Identity","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1556.007/","full_definition":true,"detection_analytics":5,"sigma_sources":0,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1556.008","id":"T1556.008","name":"Network Provider DLL","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1556.008/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1556.009","id":"T1556.009","name":"Conditional Access Policies","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1556.009/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1557","id":"T1557","name":"Adversary-in-the-Middle","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1557/","full_definition":true,"detection_analytics":4,"sigma_sources":9,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":2,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1557.001","id":"T1557.001","name":"Name Resolution Poisoning and SMB Relay","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1557.001/","full_definition":true,"detection_analytics":1,"sigma_sources":10,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":5,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1557.002","id":"T1557.002","name":"ARP Cache Poisoning","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1557.002/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1557.003","id":"T1557.003","name":"DHCP Spoofing","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1557.003/","full_definition":true,"detection_analytics":3,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1557.004","id":"T1557.004","name":"Evil Twin","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1557.004/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1558","id":"T1558","name":"Steal or Forge Kerberos Tickets","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1558/","full_definition":true,"detection_analytics":3,"sigma_sources":5,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1558.001","id":"T1558.001","name":"Golden Ticket","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1558.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":2,"lab_tools":4,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1558.002","id":"T1558.002","name":"Silver Ticket","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1558.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":1,"lab_tools":4,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1558.003","id":"T1558.003","name":"Kerberoasting","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1558.003/","full_definition":true,"detection_analytics":1,"sigma_sources":15,"anomaly_models":1,"collection_contracts":4,"atomic_candidates":7,"lab_tools":6,"documented_software":6,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1558.004","id":"T1558.004","name":"AS-REP Roasting","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1558.004/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":3,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1558.005","id":"T1558.005","name":"Ccache Files","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1558.005/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1559","id":"T1559","name":"Inter-Process Communication","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1559/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":7,"lab_tools":0,"documented_software":16,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1559.001","id":"T1559.001","name":"Component Object Model","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1559.001/","full_definition":true,"detection_analytics":1,"sigma_sources":3,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":1,"documented_software":18,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1559.002","id":"T1559.002","name":"Dynamic Data Exchange","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1559.002/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":3,"lab_tools":0,"documented_software":8,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1559.003","id":"T1559.003","name":"XPC Services","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1559.003/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1560","id":"T1560","name":"Archive Collected Data","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1560/","full_definition":true,"detection_analytics":3,"sigma_sources":2,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":3,"documented_software":44,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1560.001","id":"T1560.001","name":"Archive via Utility","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1560.001/","full_definition":true,"detection_analytics":3,"sigma_sources":13,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":13,"lab_tools":5,"documented_software":36,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1560.002","id":"T1560.002","name":"Archive via Library","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1560.002/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":4,"lab_tools":0,"documented_software":13,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1560.003","id":"T1560.003","name":"Archive via Custom Method","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1560.003/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":31,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1561","id":"T1561","name":"Disk Wipe","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1561/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1561.001","id":"T1561.001","name":"Disk Content Wipe","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1561.001/","full_definition":true,"detection_analytics":4,"sigma_sources":1,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":0,"lab_tools":2,"documented_software":13,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1561.002","id":"T1561.002","name":"Disk Structure Wipe","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1561.002/","full_definition":true,"detection_analytics":4,"sigma_sources":1,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":0,"lab_tools":2,"documented_software":13,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1563","id":"T1563","name":"Remote Service Session Hijacking","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1563/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1563.001","id":"T1563.001","name":"SSH Hijacking","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1563.001/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1563.002","id":"T1563.002","name":"RDP Hijacking","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1563.002/","full_definition":true,"detection_analytics":1,"sigma_sources":2,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1564","id":"T1564","name":"Hide Artifacts","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1564/","full_definition":true,"detection_analytics":5,"sigma_sources":10,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":5,"lab_tools":1,"documented_software":7,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1564.001","id":"T1564.001","name":"Hidden Files and Directories","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1564.001/","full_definition":true,"detection_analytics":3,"sigma_sources":7,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":10,"lab_tools":3,"documented_software":46,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1564.002","id":"T1564.002","name":"Hidden Users","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1564.002/","full_definition":true,"detection_analytics":3,"sigma_sources":4,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":3,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1564.003","id":"T1564.003","name":"Hidden Window","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1564.003/","full_definition":true,"detection_analytics":3,"sigma_sources":8,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":3,"lab_tools":6,"documented_software":43,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1564.004","id":"T1564.004","name":"NTFS File Attributes","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1564.004/","full_definition":true,"detection_analytics":1,"sigma_sources":22,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":5,"lab_tools":2,"documented_software":15,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1564.005","id":"T1564.005","name":"Hidden File System","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1564.005/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1564.006","id":"T1564.006","name":"Run Virtual Instance","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1564.006/","full_definition":true,"detection_analytics":4,"sigma_sources":2,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":3,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1564.007","id":"T1564.007","name":"VBA Stomping","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1564.007/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1564.008","id":"T1564.008","name":"Email Hiding Rules","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1564.008/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1564.009","id":"T1564.009","name":"Resource Forking","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1564.009/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1564.010","id":"T1564.010","name":"Process Argument Spoofing","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1564.010/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":1,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1564.011","id":"T1564.011","name":"Ignore Process Interrupts","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1564.011/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":6,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1564.012","id":"T1564.012","name":"File/Path Exclusions","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1564.012/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1564.013","id":"T1564.013","name":"Bind Mounts","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1564.013/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1564.014","id":"T1564.014","name":"Extended Attributes","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1564.014/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1565","id":"T1565","name":"Data Manipulation","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1565/","full_definition":true,"detection_analytics":3,"sigma_sources":3,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1565.001","id":"T1565.001","name":"Stored Data Manipulation","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1565.001/","full_definition":true,"detection_analytics":3,"sigma_sources":6,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1565.002","id":"T1565.002","name":"Transmitted Data Manipulation","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1565.002/","full_definition":true,"detection_analytics":3,"sigma_sources":2,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1565.003","id":"T1565.003","name":"Runtime Data Manipulation","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1565.003/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1566","id":"T1566","name":"Phishing","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1566/","full_definition":true,"detection_analytics":6,"sigma_sources":11,"anomaly_models":2,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1566.001","id":"T1566.001","name":"Spearphishing Attachment","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1566.001/","full_definition":true,"detection_analytics":3,"sigma_sources":19,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":2,"lab_tools":2,"documented_software":61,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1566.002","id":"T1566.002","name":"Spearphishing Link","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1566.002/","full_definition":true,"detection_analytics":4,"sigma_sources":3,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":1,"lab_tools":1,"documented_software":31,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1566.003","id":"T1566.003","name":"Spearphishing via Service","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1566.003/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1566.004","id":"T1566.004","name":"Spearphishing Voice","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1566.004/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1567","id":"T1567","name":"Exfiltration Over Web Service","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1567/","full_definition":true,"detection_analytics":5,"sigma_sources":11,"anomaly_models":1,"collection_contracts":8,"atomic_candidates":0,"lab_tools":1,"documented_software":7,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1567.001","id":"T1567.001","name":"Exfiltration to Code Repository","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1567.001/","full_definition":true,"detection_analytics":4,"sigma_sources":2,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":1,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1567.002","id":"T1567.002","name":"Exfiltration to Cloud Storage","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1567.002/","full_definition":true,"detection_analytics":4,"sigma_sources":13,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":2,"lab_tools":2,"documented_software":16,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1567.003","id":"T1567.003","name":"Exfiltration to Text Storage Sites","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1567.003/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":1,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1567.004","id":"T1567.004","name":"Exfiltration Over Webhook","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1567.004/","full_definition":true,"detection_analytics":5,"sigma_sources":0,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":4,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1568","id":"T1568","name":"Dynamic Resolution","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1568/","full_definition":true,"detection_analytics":4,"sigma_sources":1,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":2,"documented_software":10,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1568.001","id":"T1568.001","name":"Fast Flux DNS","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1568.001/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1568.002","id":"T1568.002","name":"Domain Generation Algorithms","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1568.002/","full_definition":true,"detection_analytics":4,"sigma_sources":2,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":2,"documented_software":22,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1568.003","id":"T1568.003","name":"DNS Calculation","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1568.003/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1569","id":"T1569","name":"System Services","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1569/","full_definition":true,"detection_analytics":3,"sigma_sources":1,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1569.001","id":"T1569.001","name":"Launchctl","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1569.001/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":0,"documented_software":6,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1569.002","id":"T1569.002","name":"Service Execution","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1569.002/","full_definition":true,"detection_analytics":1,"sigma_sources":39,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":7,"lab_tools":11,"documented_software":51,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1569.003","id":"T1569.003","name":"Systemctl","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1569.003/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":8,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1570","id":"T1570","name":"Lateral Tool Transfer","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1570/","full_definition":true,"detection_analytics":4,"sigma_sources":4,"anomaly_models":1,"collection_contracts":5,"atomic_candidates":2,"lab_tools":7,"documented_software":27,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1571","id":"T1571","name":"Non-Standard Port","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1571/","full_definition":true,"detection_analytics":4,"sigma_sources":5,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":2,"lab_tools":2,"documented_software":41,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1572","id":"T1572","name":"Protocol Tunneling","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1572/","full_definition":true,"detection_analytics":4,"sigma_sources":23,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":9,"lab_tools":5,"documented_software":21,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1573","id":"T1573","name":"Encrypted Channel","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1573/","full_definition":true,"detection_analytics":5,"sigma_sources":4,"anomaly_models":1,"collection_contracts":6,"atomic_candidates":1,"lab_tools":0,"documented_software":11,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1573.001","id":"T1573.001","name":"Symmetric Cryptography","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1573.001/","full_definition":true,"detection_analytics":5,"sigma_sources":0,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":4,"documented_software":167,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1573.002","id":"T1573.002","name":"Asymmetric Cryptography","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1573.002/","full_definition":true,"detection_analytics":5,"sigma_sources":0,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":11,"documented_software":80,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1574","id":"T1574","name":"Hijack Execution Flow","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1574/","full_definition":true,"detection_analytics":3,"sigma_sources":5,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":0,"documented_software":9,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1574.001","id":"T1574.001","name":"DLL","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1574.001/","full_definition":true,"detection_analytics":1,"sigma_sources":80,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":7,"lab_tools":3,"documented_software":75,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1574.004","id":"T1574.004","name":"Dylib Hijacking","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1574.004/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1574.005","id":"T1574.005","name":"Executable Installer File Permissions Weakness","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1574.005/","full_definition":true,"detection_analytics":1,"sigma_sources":2,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1574.006","id":"T1574.006","name":"Dynamic Linker Hijacking","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1574.006/","full_definition":true,"detection_analytics":2,"sigma_sources":2,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":3,"lab_tools":0,"documented_software":7,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1574.007","id":"T1574.007","name":"Path Interception by PATH Environment Variable","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1574.007/","full_definition":true,"detection_analytics":3,"sigma_sources":2,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":2,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1574.008","id":"T1574.008","name":"Path Interception by Search Order Hijacking","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1574.008/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":1,"lab_tools":2,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1574.009","id":"T1574.009","name":"Path Interception by Unquoted Path","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1574.009/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":1,"lab_tools":2,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1574.010","id":"T1574.010","name":"Services File Permissions Weakness","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1574.010/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1574.011","id":"T1574.011","name":"Services Registry Permissions Weakness","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1574.011/","full_definition":true,"detection_analytics":1,"sigma_sources":11,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":2,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1574.012","id":"T1574.012","name":"COR_PROFILER","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1574.012/","full_definition":true,"detection_analytics":1,"sigma_sources":2,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":3,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1574.013","id":"T1574.013","name":"KernelCallbackTable","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1574.013/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1574.014","id":"T1574.014","name":"AppDomainManager","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1574.014/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1578","id":"T1578","name":"Modify Cloud Compute Infrastructure","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1578/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":9,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1578.001","id":"T1578.001","name":"Create Snapshot","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1578.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":3,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1578.002","id":"T1578.002","name":"Create Cloud Instance","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1578.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":2,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1578.003","id":"T1578.003","name":"Delete Cloud Instance","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1578.003/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1578.004","id":"T1578.004","name":"Revert Cloud Instance","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1578.004/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1578.005","id":"T1578.005","name":"Modify Cloud Compute Configurations","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1578.005/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1580","id":"T1580","name":"Cloud Infrastructure Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1580/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":1,"collection_contracts":3,"atomic_candidates":2,"lab_tools":2,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1583","id":"T1583","name":"Acquire Infrastructure","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1583/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1583.001","id":"T1583.001","name":"Domains","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1583.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1583.002","id":"T1583.002","name":"DNS Server","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1583.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1583.003","id":"T1583.003","name":"Virtual Private Server","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1583.003/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1583.004","id":"T1583.004","name":"Server","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1583.004/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1583.005","id":"T1583.005","name":"Botnet","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1583.005/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1583.006","id":"T1583.006","name":"Web Services","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1583.006/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1583.007","id":"T1583.007","name":"Serverless","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1583.007/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1583.008","id":"T1583.008","name":"Malvertising","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1583.008/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1584","id":"T1584","name":"Compromise Infrastructure","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1584/","full_definition":true,"detection_analytics":1,"sigma_sources":3,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1584.001","id":"T1584.001","name":"Domains","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1584.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1584.002","id":"T1584.002","name":"DNS Server","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1584.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1584.003","id":"T1584.003","name":"Virtual Private Server","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1584.003/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1584.004","id":"T1584.004","name":"Server","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1584.004/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1584.005","id":"T1584.005","name":"Botnet","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1584.005/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1584.006","id":"T1584.006","name":"Web Services","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1584.006/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1584.007","id":"T1584.007","name":"Serverless","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1584.007/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1584.008","id":"T1584.008","name":"Network Devices","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1584.008/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1585","id":"T1585","name":"Establish Accounts","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1585/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1585.001","id":"T1585.001","name":"Social Media Accounts","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1585.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1585.002","id":"T1585.002","name":"Email Accounts","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1585.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1585.003","id":"T1585.003","name":"Cloud Accounts","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1585.003/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1586","id":"T1586","name":"Compromise Accounts","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1586/","full_definition":true,"detection_analytics":1,"sigma_sources":2,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1586.001","id":"T1586.001","name":"Social Media Accounts","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1586.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1586.002","id":"T1586.002","name":"Email Accounts","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1586.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1586.003","id":"T1586.003","name":"Cloud Accounts","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1586.003/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1587","id":"T1587","name":"Develop Capabilities","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1587/","full_definition":true,"detection_analytics":1,"sigma_sources":3,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1587.001","id":"T1587.001","name":"Malware","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1587.001/","full_definition":true,"detection_analytics":1,"sigma_sources":7,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1587.002","id":"T1587.002","name":"Code Signing Certificates","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1587.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1587.003","id":"T1587.003","name":"Digital Certificates","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1587.003/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1587.004","id":"T1587.004","name":"Exploits","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1587.004/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1588","id":"T1588","name":"Obtain Capabilities","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1588/","full_definition":true,"detection_analytics":1,"sigma_sources":2,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1588.001","id":"T1588.001","name":"Malware","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1588.001/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1588.002","id":"T1588.002","name":"Tool","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1588.002/","full_definition":true,"detection_analytics":1,"sigma_sources":9,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1588.003","id":"T1588.003","name":"Code Signing Certificates","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1588.003/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1588.004","id":"T1588.004","name":"Digital Certificates","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1588.004/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1588.005","id":"T1588.005","name":"Exploits","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1588.005/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1588.006","id":"T1588.006","name":"Vulnerabilities","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1588.006/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1588.007","id":"T1588.007","name":"Artificial Intelligence","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1588.007/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1589","id":"T1589","name":"Gather Victim Identity Information","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1589/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1589.001","id":"T1589.001","name":"Credentials","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1589.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1589.002","id":"T1589.002","name":"Email Addresses","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1589.002/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1589.003","id":"T1589.003","name":"Employee Names","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1589.003/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1590","id":"T1590","name":"Gather Victim Network Information","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1590/","full_definition":true,"detection_analytics":1,"sigma_sources":2,"anomaly_models":1,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1590.001","id":"T1590.001","name":"Domain Properties","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1590.001/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1590.002","id":"T1590.002","name":"DNS","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1590.002/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1590.003","id":"T1590.003","name":"Network Trust Dependencies","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1590.003/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1590.004","id":"T1590.004","name":"Network Topology","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1590.004/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1590.005","id":"T1590.005","name":"IP Addresses","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1590.005/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1590.006","id":"T1590.006","name":"Network Security Appliances","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1590.006/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1591","id":"T1591","name":"Gather Victim Org Information","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1591/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1591.001","id":"T1591.001","name":"Determine Physical Locations","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1591.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1591.002","id":"T1591.002","name":"Business Relationships","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1591.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1591.003","id":"T1591.003","name":"Identify Business Tempo","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1591.003/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1591.004","id":"T1591.004","name":"Identify Roles","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1591.004/","full_definition":true,"detection_analytics":1,"sigma_sources":2,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1592","id":"T1592","name":"Gather Victim Host Information","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1592/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1592.001","id":"T1592.001","name":"Hardware","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1592.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1592.002","id":"T1592.002","name":"Software","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1592.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1592.003","id":"T1592.003","name":"Firmware","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1592.003/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1592.004","id":"T1592.004","name":"Client Configurations","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1592.004/","full_definition":true,"detection_analytics":1,"sigma_sources":3,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1593","id":"T1593","name":"Search Open Websites/Domains","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1593/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1593.001","id":"T1593.001","name":"Social Media","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1593.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1593.002","id":"T1593.002","name":"Search Engines","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1593.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1593.003","id":"T1593.003","name":"Code Repositories","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1593.003/","full_definition":true,"detection_analytics":1,"sigma_sources":2,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1594","id":"T1594","name":"Search Victim-Owned Websites","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1594/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1595","id":"T1595","name":"Active Scanning","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1595/","full_definition":true,"detection_analytics":1,"sigma_sources":3,"anomaly_models":1,"collection_contracts":2,"atomic_candidates":0,"lab_tools":1,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1595.001","id":"T1595.001","name":"Scanning IP Blocks","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1595.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":1,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1595.002","id":"T1595.002","name":"Vulnerability Scanning","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1595.002/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":3,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1595.003","id":"T1595.003","name":"Wordlist Scanning","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1595.003/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":1,"collection_contracts":1,"atomic_candidates":0,"lab_tools":1,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1596","id":"T1596","name":"Search Open Technical Databases","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1596/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1596.001","id":"T1596.001","name":"DNS/Passive DNS","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1596.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":2,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1596.002","id":"T1596.002","name":"WHOIS","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1596.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1596.003","id":"T1596.003","name":"Digital Certificates","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1596.003/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1596.004","id":"T1596.004","name":"CDNs","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1596.004/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1596.005","id":"T1596.005","name":"Scan Databases","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1596.005/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":1,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1597","id":"T1597","name":"Search Closed Sources","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1597/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1597.001","id":"T1597.001","name":"Threat Intel Vendors","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1597.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1597.002","id":"T1597.002","name":"Purchase Technical Data","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1597.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1598","id":"T1598","name":"Phishing for Information","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1598/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1598.001","id":"T1598.001","name":"Spearphishing Service","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1598.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1598.002","id":"T1598.002","name":"Spearphishing Attachment","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1598.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1598.003","id":"T1598.003","name":"Spearphishing Link","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1598.003/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":2,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1598.004","id":"T1598.004","name":"Spearphishing Voice","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1598.004/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1599","id":"T1599","name":"Network Boundary Bridging","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1599/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1599.001","id":"T1599.001","name":"Network Address Translation Traversal","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1599.001/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1600","id":"T1600","name":"Weaken Encryption","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1600/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1600.001","id":"T1600.001","name":"Reduce Key Space","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1600.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1600.002","id":"T1600.002","name":"Disable Crypto Hardware","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1600.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1601","id":"T1601","name":"Modify System Image","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1601/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1601.001","id":"T1601.001","name":"Patch System Image","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1601.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1601.002","id":"T1601.002","name":"Downgrade System Image","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1601.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1602","id":"T1602","name":"Data from Configuration Repository","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1602/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1602.001","id":"T1602.001","name":"SNMP (MIB Dump)","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1602.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1602.002","id":"T1602.002","name":"Network Device Configuration Dump","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1602.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1606","id":"T1606","name":"Forge Web Credentials","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1606/","full_definition":true,"detection_analytics":7,"sigma_sources":1,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1606.001","id":"T1606.001","name":"Web Cookies","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1606.001/","full_definition":true,"detection_analytics":5,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1606.002","id":"T1606.002","name":"SAML Tokens","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1606.002/","full_definition":true,"detection_analytics":5,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":1,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1608","id":"T1608","name":"Stage Capabilities","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1608/","full_definition":true,"detection_analytics":1,"sigma_sources":2,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1608.001","id":"T1608.001","name":"Upload Malware","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1608.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1608.002","id":"T1608.002","name":"Upload Tool","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1608.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1608.003","id":"T1608.003","name":"Install Digital Certificate","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1608.003/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1608.004","id":"T1608.004","name":"Drive-by Target","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1608.004/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1608.005","id":"T1608.005","name":"Link Target","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1608.005/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1608.006","id":"T1608.006","name":"SEO Poisoning","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1608.006/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1609","id":"T1609","name":"Container Administration Command","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1609/","full_definition":true,"detection_analytics":1,"sigma_sources":3,"anomaly_models":1,"collection_contracts":2,"atomic_candidates":2,"lab_tools":1,"documented_software":7,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1610","id":"T1610","name":"Deploy Container","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1610/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":1,"collection_contracts":4,"atomic_candidates":1,"lab_tools":1,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1611","id":"T1611","name":"Escape to Host","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1611/","full_definition":true,"detection_analytics":4,"sigma_sources":2,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":3,"lab_tools":1,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1612","id":"T1612","name":"Build Image on Host","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1612/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":1,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1613","id":"T1613","name":"Container and Resource Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1613/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":2,"lab_tools":1,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1614","id":"T1614","name":"System Location Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1614/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":2,"lab_tools":2,"documented_software":25,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1614.001","id":"T1614.001","name":"System Language Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1614.001/","full_definition":true,"detection_analytics":3,"sigma_sources":2,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":10,"lab_tools":0,"documented_software":35,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1615","id":"T1615","name":"Group Policy Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1615/","full_definition":true,"detection_analytics":1,"sigma_sources":5,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":5,"lab_tools":2,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1619","id":"T1619","name":"Cloud Storage Object Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1619/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":4,"lab_tools":3,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1620","id":"T1620","name":"Reflective Code Loading","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1620/","full_definition":true,"detection_analytics":3,"sigma_sources":2,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":3,"lab_tools":5,"documented_software":26,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1621","id":"T1621","name":"Multi-Factor Authentication Request Generation","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1621/","full_definition":true,"detection_analytics":6,"sigma_sources":2,"anomaly_models":1,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1622","id":"T1622","name":"Debugger Evasion","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1622/","full_definition":true,"detection_analytics":3,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":1,"lab_tools":1,"documented_software":24,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1647","id":"T1647","name":"Plist File Modification","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1647/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":1,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1648","id":"T1648","name":"Serverless Execution","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1648/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":1,"collection_contracts":2,"atomic_candidates":1,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1649","id":"T1649","name":"Steal or Forge Authentication Certificates","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1649/","full_definition":true,"detection_analytics":4,"sigma_sources":4,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":1,"lab_tools":2,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1650","id":"T1650","name":"Acquire Access","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1650/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1651","id":"T1651","name":"Cloud Administration Command","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1651/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":1,"lab_tools":2,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1652","id":"T1652","name":"Device Driver Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1652/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":5,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1653","id":"T1653","name":"Power Settings","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1653/","full_definition":true,"detection_analytics":3,"sigma_sources":1,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1654","id":"T1654","name":"Log Enumeration","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1654/","full_definition":true,"detection_analytics":5,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":2,"lab_tools":1,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1657","id":"T1657","name":"Financial Theft","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1657/","full_definition":true,"detection_analytics":5,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":8,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1659","id":"T1659","name":"Content Injection","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1659/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":2,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1665","id":"T1665","name":"Hide Infrastructure","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1665/","full_definition":true,"detection_analytics":5,"sigma_sources":0,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1666","id":"T1666","name":"Modify Cloud Resource Hierarchy","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1666/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1667","id":"T1667","name":"Email Bombing","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1667/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1668","id":"T1668","name":"Exclusive Control","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1668/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1669","id":"T1669","name":"Wi-Fi Networks","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1669/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1671","id":"T1671","name":"Cloud Application Integration","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1671/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1673","id":"T1673","name":"Virtual Machine Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1673/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1674","id":"T1674","name":"Input Injection","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1674/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1675","id":"T1675","name":"ESXi Administration Command","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1675/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1677","id":"T1677","name":"Poisoned Pipeline Execution","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1677/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1678","id":"T1678","name":"Delay Execution","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1678/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":17,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1679","id":"T1679","name":"Selective Exclusion","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1679/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":6,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1680","id":"T1680","name":"Local Storage Discovery","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1680/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":2,"lab_tools":3,"documented_software":88,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1681","id":"T1681","name":"Search Threat Vendor Data","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1681/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1682","id":"T1682","name":"Query Public AI Services","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1682/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1683","id":"T1683","name":"Generate Content","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1683/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1683.001","id":"T1683.001","name":"Written Content","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1683.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1683.002","id":"T1683.002","name":"Audio-Visual Content","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1683.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1684","id":"T1684","name":"Social Engineering","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1684/","full_definition":true,"detection_analytics":5,"sigma_sources":0,"anomaly_models":0,"collection_contracts":9,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1684.001","id":"T1684.001","name":"Impersonation","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1684.001/","full_definition":true,"detection_analytics":5,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":1,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1684.002","id":"T1684.002","name":"Email Spoofing","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1684.002/","full_definition":true,"detection_analytics":4,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1685/","full_definition":true,"detection_analytics":7,"sigma_sources":156,"anomaly_models":0,"collection_contracts":9,"atomic_candidates":77,"lab_tools":6,"documented_software":87,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1685.001","id":"T1685.001","name":"Disable or Modify Windows Event Log","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1685.001/","full_definition":true,"detection_analytics":1,"sigma_sources":26,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":10,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1685.002","id":"T1685.002","name":"Disable or Modify Cloud Log","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1685.002/","full_definition":true,"detection_analytics":4,"sigma_sources":3,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":9,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1685.003","id":"T1685.003","name":"Modify or Spoof Tool UI","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1685.003/","full_definition":true,"detection_analytics":3,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1685.004","id":"T1685.004","name":"Disable or Modify Linux Audit System Log","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1685.004/","full_definition":true,"detection_analytics":1,"sigma_sources":1,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":2,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1685.005","id":"T1685.005","name":"Clear Windows Event Logs","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1685.005/","full_definition":true,"detection_analytics":1,"sigma_sources":6,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":4,"lab_tools":2,"documented_software":26,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1685.006","id":"T1685.006","name":"Clear Linux or Mac System Logs","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1685.006/","full_definition":true,"detection_analytics":2,"sigma_sources":4,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":20,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1686","id":"T1686","name":"Disable or Modify System Firewall","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1686/","full_definition":true,"detection_analytics":5,"sigma_sources":7,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":25,"lab_tools":1,"documented_software":15,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1686.001","id":"T1686.001","name":"Cloud Firewall","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1686.001/","full_definition":true,"detection_analytics":1,"sigma_sources":5,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":1,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1686.002","id":"T1686.002","name":"Network Device Firewall","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1686.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1686.003","id":"T1686.003","name":"Windows Host Firewall","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1686.003/","full_definition":true,"detection_analytics":1,"sigma_sources":17,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":2,"lab_tools":0,"documented_software":9,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1687","id":"T1687","name":"Exploitation for Defense Impairment","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1687/","full_definition":true,"detection_analytics":5,"sigma_sources":0,"anomaly_models":0,"collection_contracts":11,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1688","id":"T1688","name":"Safe Mode Boot","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1688/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":1,"lab_tools":0,"documented_software":7,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1689","id":"T1689","name":"Downgrade Attack","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1689/","full_definition":true,"detection_analytics":3,"sigma_sources":1,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":3,"lab_tools":1,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"enterprise/T1690","id":"T1690","name":"Prevent Command History Logging","domain":"enterprise","page":"/ttp-simulation/techniques/enterprise/T1690/","full_definition":true,"detection_analytics":5,"sigma_sources":1,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":12,"lab_tools":1,"documented_software":6,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0800","id":"T0800","name":"Activate Firmware Update Mode","domain":"ics","page":"/ttp-simulation/techniques/ics/T0800/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0801","id":"T0801","name":"Monitor Process State","domain":"ics","page":"/ttp-simulation/techniques/ics/T0801/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0802","id":"T0802","name":"Automated Collection","domain":"ics","page":"/ttp-simulation/techniques/ics/T0802/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0806","id":"T0806","name":"Brute Force I/O","domain":"ics","page":"/ttp-simulation/techniques/ics/T0806/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0807","id":"T0807","name":"Command-Line Interface","domain":"ics","page":"/ttp-simulation/techniques/ics/T0807/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0809","id":"T0809","name":"Data Destruction","domain":"ics","page":"/ttp-simulation/techniques/ics/T0809/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0811","id":"T0811","name":"Data from Information Repositories","domain":"ics","page":"/ttp-simulation/techniques/ics/T0811/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0813","id":"T0813","name":"Denial of Control","domain":"ics","page":"/ttp-simulation/techniques/ics/T0813/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0814","id":"T0814","name":"Denial of Service","domain":"ics","page":"/ttp-simulation/techniques/ics/T0814/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0815","id":"T0815","name":"Denial of View","domain":"ics","page":"/ttp-simulation/techniques/ics/T0815/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0816","id":"T0816","name":"Device Restart/Shutdown","domain":"ics","page":"/ttp-simulation/techniques/ics/T0816/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0817","id":"T0817","name":"Drive-by Compromise","domain":"ics","page":"/ttp-simulation/techniques/ics/T0817/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0819","id":"T0819","name":"Exploit Public-Facing Application","domain":"ics","page":"/ttp-simulation/techniques/ics/T0819/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0820","id":"T0820","name":"Exploitation for Evasion","domain":"ics","page":"/ttp-simulation/techniques/ics/T0820/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0821","id":"T0821","name":"Modify Controller Tasking","domain":"ics","page":"/ttp-simulation/techniques/ics/T0821/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0822","id":"T0822","name":"External Remote Services","domain":"ics","page":"/ttp-simulation/techniques/ics/T0822/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0823","id":"T0823","name":"Graphical User Interface","domain":"ics","page":"/ttp-simulation/techniques/ics/T0823/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0826","id":"T0826","name":"Loss of Availability","domain":"ics","page":"/ttp-simulation/techniques/ics/T0826/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0827","id":"T0827","name":"Loss of Control","domain":"ics","page":"/ttp-simulation/techniques/ics/T0827/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0828","id":"T0828","name":"Loss of Productivity and Revenue","domain":"ics","page":"/ttp-simulation/techniques/ics/T0828/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":7,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0829","id":"T0829","name":"Loss of View","domain":"ics","page":"/ttp-simulation/techniques/ics/T0829/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0830","id":"T0830","name":"Adversary-in-the-Middle","domain":"ics","page":"/ttp-simulation/techniques/ics/T0830/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0831","id":"T0831","name":"Manipulation of Control","domain":"ics","page":"/ttp-simulation/techniques/ics/T0831/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0832","id":"T0832","name":"Manipulation of View","domain":"ics","page":"/ttp-simulation/techniques/ics/T0832/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0834","id":"T0834","name":"Native API","domain":"ics","page":"/ttp-simulation/techniques/ics/T0834/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0835","id":"T0835","name":"Manipulate I/O Image","domain":"ics","page":"/ttp-simulation/techniques/ics/T0835/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0836","id":"T0836","name":"Modify Parameter","domain":"ics","page":"/ttp-simulation/techniques/ics/T0836/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0837","id":"T0837","name":"Loss of Protection","domain":"ics","page":"/ttp-simulation/techniques/ics/T0837/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0838","id":"T0838","name":"Modify Alarm Settings","domain":"ics","page":"/ttp-simulation/techniques/ics/T0838/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0840","id":"T0840","name":"Network Connection Enumeration","domain":"ics","page":"/ttp-simulation/techniques/ics/T0840/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0842","id":"T0842","name":"Network Sniffing","domain":"ics","page":"/ttp-simulation/techniques/ics/T0842/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0843","id":"T0843","name":"Program Download","domain":"ics","page":"/ttp-simulation/techniques/ics/T0843/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0843.001","id":"T0843.001","name":"Download All","domain":"ics","page":"/ttp-simulation/techniques/ics/T0843.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0843.002","id":"T0843.002","name":"Online Edit","domain":"ics","page":"/ttp-simulation/techniques/ics/T0843.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0843.003","id":"T0843.003","name":"Program Append","domain":"ics","page":"/ttp-simulation/techniques/ics/T0843.003/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0845","id":"T0845","name":"Program Upload","domain":"ics","page":"/ttp-simulation/techniques/ics/T0845/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0846","id":"T0846","name":"Remote System Discovery","domain":"ics","page":"/ttp-simulation/techniques/ics/T0846/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0846.001","id":"T0846.001","name":"Port Scan","domain":"ics","page":"/ttp-simulation/techniques/ics/T0846.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0846.002","id":"T0846.002","name":"Broadcast Discovery","domain":"ics","page":"/ttp-simulation/techniques/ics/T0846.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0846.003","id":"T0846.003","name":"Multicast Discovery","domain":"ics","page":"/ttp-simulation/techniques/ics/T0846.003/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0847","id":"T0847","name":"Replication Through Removable Media","domain":"ics","page":"/ttp-simulation/techniques/ics/T0847/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0848","id":"T0848","name":"Rogue Master","domain":"ics","page":"/ttp-simulation/techniques/ics/T0848/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0849","id":"T0849","name":"Masquerading","domain":"ics","page":"/ttp-simulation/techniques/ics/T0849/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":8,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0851","id":"T0851","name":"Rootkit","domain":"ics","page":"/ttp-simulation/techniques/ics/T0851/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0852","id":"T0852","name":"Screen Capture","domain":"ics","page":"/ttp-simulation/techniques/ics/T0852/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0853","id":"T0853","name":"Scripting","domain":"ics","page":"/ttp-simulation/techniques/ics/T0853/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0858","id":"T0858","name":"Change Operating Mode","domain":"ics","page":"/ttp-simulation/techniques/ics/T0858/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0859","id":"T0859","name":"Valid Accounts","domain":"ics","page":"/ttp-simulation/techniques/ics/T0859/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0860","id":"T0860","name":"Wireless Compromise","domain":"ics","page":"/ttp-simulation/techniques/ics/T0860/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0861","id":"T0861","name":"Point & Tag Identification","domain":"ics","page":"/ttp-simulation/techniques/ics/T0861/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0862","id":"T0862","name":"Supply Chain Compromise","domain":"ics","page":"/ttp-simulation/techniques/ics/T0862/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0863","id":"T0863","name":"User Execution","domain":"ics","page":"/ttp-simulation/techniques/ics/T0863/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0864","id":"T0864","name":"Transient Cyber Asset","domain":"ics","page":"/ttp-simulation/techniques/ics/T0864/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0865","id":"T0865","name":"Spearphishing Attachment","domain":"ics","page":"/ttp-simulation/techniques/ics/T0865/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0866","id":"T0866","name":"Exploitation of Remote Services","domain":"ics","page":"/ttp-simulation/techniques/ics/T0866/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0867","id":"T0867","name":"Lateral Tool Transfer","domain":"ics","page":"/ttp-simulation/techniques/ics/T0867/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":0,"lab_tools":0,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0868","id":"T0868","name":"Detect Operating Mode","domain":"ics","page":"/ttp-simulation/techniques/ics/T0868/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0869","id":"T0869","name":"Standard Application Layer Protocol","domain":"ics","page":"/ttp-simulation/techniques/ics/T0869/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":6,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0871","id":"T0871","name":"Execution through API","domain":"ics","page":"/ttp-simulation/techniques/ics/T0871/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0872","id":"T0872","name":"Indicator Removal on Host","domain":"ics","page":"/ttp-simulation/techniques/ics/T0872/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":8,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0873","id":"T0873","name":"Project File Infection","domain":"ics","page":"/ttp-simulation/techniques/ics/T0873/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0873.001","id":"T0873.001","name":"Siemens Project File Format","domain":"ics","page":"/ttp-simulation/techniques/ics/T0873.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0874","id":"T0874","name":"Hooking","domain":"ics","page":"/ttp-simulation/techniques/ics/T0874/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0877","id":"T0877","name":"I/O Image","domain":"ics","page":"/ttp-simulation/techniques/ics/T0877/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0878","id":"T0878","name":"Alarm Suppression","domain":"ics","page":"/ttp-simulation/techniques/ics/T0878/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0879","id":"T0879","name":"Damage to Property","domain":"ics","page":"/ttp-simulation/techniques/ics/T0879/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0880","id":"T0880","name":"Loss of Safety","domain":"ics","page":"/ttp-simulation/techniques/ics/T0880/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0881","id":"T0881","name":"Service Stop","domain":"ics","page":"/ttp-simulation/techniques/ics/T0881/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":0,"lab_tools":0,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0882","id":"T0882","name":"Theft of Operational Information","domain":"ics","page":"/ttp-simulation/techniques/ics/T0882/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0883","id":"T0883","name":"Internet Accessible Device","domain":"ics","page":"/ttp-simulation/techniques/ics/T0883/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0884","id":"T0884","name":"Connection Proxy","domain":"ics","page":"/ttp-simulation/techniques/ics/T0884/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0885","id":"T0885","name":"Commonly Used Port","domain":"ics","page":"/ttp-simulation/techniques/ics/T0885/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0886","id":"T0886","name":"Remote Services","domain":"ics","page":"/ttp-simulation/techniques/ics/T0886/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0887","id":"T0887","name":"Wireless Sniffing","domain":"ics","page":"/ttp-simulation/techniques/ics/T0887/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0888","id":"T0888","name":"Remote System Information Discovery","domain":"ics","page":"/ttp-simulation/techniques/ics/T0888/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0889","id":"T0889","name":"Modify Program","domain":"ics","page":"/ttp-simulation/techniques/ics/T0889/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0890","id":"T0890","name":"Exploitation for Privilege Escalation","domain":"ics","page":"/ttp-simulation/techniques/ics/T0890/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0892","id":"T0892","name":"Change Credential","domain":"ics","page":"/ttp-simulation/techniques/ics/T0892/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0893","id":"T0893","name":"Data from Local System","domain":"ics","page":"/ttp-simulation/techniques/ics/T0893/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0894","id":"T0894","name":"System Binary Proxy Execution","domain":"ics","page":"/ttp-simulation/techniques/ics/T0894/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T0895","id":"T0895","name":"Autorun Image","domain":"ics","page":"/ttp-simulation/techniques/ics/T0895/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T1691","id":"T1691","name":"Block Operational Technology Message","domain":"ics","page":"/ttp-simulation/techniques/ics/T1691/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T1691.001","id":"T1691.001","name":"Command Message","domain":"ics","page":"/ttp-simulation/techniques/ics/T1691.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T1691.002","id":"T1691.002","name":"Reporting Message","domain":"ics","page":"/ttp-simulation/techniques/ics/T1691.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T1692","id":"T1692","name":"Unauthorized Message","domain":"ics","page":"/ttp-simulation/techniques/ics/T1692/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T1692.001","id":"T1692.001","name":"Command Message","domain":"ics","page":"/ttp-simulation/techniques/ics/T1692.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T1692.002","id":"T1692.002","name":"Reporting Message","domain":"ics","page":"/ttp-simulation/techniques/ics/T1692.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T1693","id":"T1693","name":"Modify Firmware","domain":"ics","page":"/ttp-simulation/techniques/ics/T1693/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T1693.001","id":"T1693.001","name":"System Firmware","domain":"ics","page":"/ttp-simulation/techniques/ics/T1693.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T1693.002","id":"T1693.002","name":"Module Firmware","domain":"ics","page":"/ttp-simulation/techniques/ics/T1693.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T1694","id":"T1694","name":"Insecure Credentials","domain":"ics","page":"/ttp-simulation/techniques/ics/T1694/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T1694.001","id":"T1694.001","name":"Default Credentials","domain":"ics","page":"/ttp-simulation/techniques/ics/T1694.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T1694.002","id":"T1694.002","name":"Hardcoded Credentials","domain":"ics","page":"/ttp-simulation/techniques/ics/T1694.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T1695","id":"T1695","name":"Block Communications","domain":"ics","page":"/ttp-simulation/techniques/ics/T1695/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T1695.001","id":"T1695.001","name":"Serial COM","domain":"ics","page":"/ttp-simulation/techniques/ics/T1695.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T1695.002","id":"T1695.002","name":"Ethernet","domain":"ics","page":"/ttp-simulation/techniques/ics/T1695.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"ics/T1695.003","id":"T1695.003","name":"Wi-Fi","domain":"ics","page":"/ttp-simulation/techniques/ics/T1695.003/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1398","id":"T1398","name":"Boot or Logon Initialization Scripts","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1398/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1404","id":"T1404","name":"Exploitation for Privilege Escalation","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1404/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":18,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1406","id":"T1406","name":"Obfuscated Files or Information","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1406/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":1,"documented_software":46,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1406.001","id":"T1406.001","name":"Steganography","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1406.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1406.002","id":"T1406.002","name":"Software Packing","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1406.002/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":6,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1407","id":"T1407","name":"Download New Code at Runtime","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1407/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":39,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1409","id":"T1409","name":"Stored Application Data","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1409/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":1,"documented_software":30,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1414","id":"T1414","name":"Clipboard Data","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1414/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1417","id":"T1417","name":"Input Capture","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1417/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1417.001","id":"T1417.001","name":"Keylogging","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1417.001/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":1,"documented_software":19,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1417.002","id":"T1417.002","name":"GUI Input Capture","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1417.002/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":6,"atomic_candidates":0,"lab_tools":1,"documented_software":29,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1418","id":"T1418","name":"Software Discovery","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1418/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":1,"documented_software":50,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1418.001","id":"T1418.001","name":"Security Software Discovery","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1418.001/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1420","id":"T1420","name":"File and Directory Discovery","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1420/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":17,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1421","id":"T1421","name":"System Network Connections Discovery","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1421/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":1,"documented_software":8,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1422","id":"T1422","name":"System Network Configuration Discovery","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1422/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":46,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1422.001","id":"T1422.001","name":"Internet Connection Discovery","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1422.001/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":19,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1422.002","id":"T1422.002","name":"Wi-Fi Discovery","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1422.002/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":12,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1423","id":"T1423","name":"Network Service Scanning","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1423/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1424","id":"T1424","name":"Process Discovery","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1424/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":12,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1426","id":"T1426","name":"System Information Discovery","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1426/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":55,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1428","id":"T1428","name":"Exploitation of Remote Services","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1428/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1429","id":"T1429","name":"Audio Capture","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1429/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":1,"documented_software":51,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1430","id":"T1430","name":"Location Tracking","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1430/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":1,"documented_software":57,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1430.001","id":"T1430.001","name":"Remote Device Management Services","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1430.001/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1430.002","id":"T1430.002","name":"Impersonate SS7 Nodes","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1430.002/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1437","id":"T1437","name":"Application Layer Protocol","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1437/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1437.001","id":"T1437.001","name":"Web Protocols","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1437.001/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":48,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1451","id":"T1451","name":"SIM Card Swap","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1451/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1453","id":"T1453","name":"Abuse Accessibility Features","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1453/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":8,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1456","id":"T1456","name":"Drive-By Compromise","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1456/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1458","id":"T1458","name":"Replication Through Removable Media","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1458/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":7,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1461","id":"T1461","name":"Lockscreen Bypass","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1461/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1464","id":"T1464","name":"Network Denial of Service","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1464/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1471","id":"T1471","name":"Data Encrypted for Impact","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1471/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":1,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1474","id":"T1474","name":"Supply Chain Compromise","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1474/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1474.001","id":"T1474.001","name":"Compromise Software Dependencies and Development Tools","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1474.001/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1474.002","id":"T1474.002","name":"Compromise Hardware Supply Chain","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1474.002/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1474.003","id":"T1474.003","name":"Compromise Software Supply Chain","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1474.003/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1481","id":"T1481","name":"Web Service","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1481/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1481.001","id":"T1481.001","name":"Dead Drop Resolver","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1481.001/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1481.002","id":"T1481.002","name":"Bidirectional Communication","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1481.002/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1481.003","id":"T1481.003","name":"One-Way Communication","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1481.003/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1509","id":"T1509","name":"Non-Standard Port","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1509/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":1,"documented_software":8,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1512","id":"T1512","name":"Video Capture","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1512/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":1,"documented_software":41,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1513","id":"T1513","name":"Screen Capture","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1513/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":1,"documented_software":27,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1516","id":"T1516","name":"Input Injection","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1516/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":14,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1517","id":"T1517","name":"Access Notifications","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1517/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":14,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1521","id":"T1521","name":"Encrypted Channel","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1521/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1521.001","id":"T1521.001","name":"Symmetric Cryptography","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1521.001/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1521.002","id":"T1521.002","name":"Asymmetric Cryptography","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1521.002/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":7,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1521.003","id":"T1521.003","name":"SSL Pinning","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1521.003/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1532","id":"T1532","name":"Archive Collected Data","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1532/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":13,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1533","id":"T1533","name":"Data from Local System","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1533/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":1,"documented_software":52,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1541","id":"T1541","name":"Foreground Persistence","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1541/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":6,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1544","id":"T1544","name":"Ingress Tool Transfer","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1544/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":15,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1575","id":"T1575","name":"Native API","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1575/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":10,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1577","id":"T1577","name":"Compromise Application Executable","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1577/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1582","id":"T1582","name":"SMS Control","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1582/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":33,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1603","id":"T1603","name":"Scheduled Task/Job","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1603/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1604","id":"T1604","name":"Proxy Through Victim","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1604/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":4,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1616","id":"T1616","name":"Call Control","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1616/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":17,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1617","id":"T1617","name":"Hooking","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1617/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1623","id":"T1623","name":"Command and Scripting Interpreter","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1623/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1623.001","id":"T1623.001","name":"Unix Shell","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1623.001/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":7,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1624","id":"T1624","name":"Event Triggered Execution","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1624/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1624.001","id":"T1624.001","name":"Broadcast Receivers","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1624.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":1,"documented_software":21,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1625","id":"T1625","name":"Hijack Execution Flow","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1625/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1625.001","id":"T1625.001","name":"System Runtime API Hijacking","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1625.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":1,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1626","id":"T1626","name":"Abuse Elevation Control Mechanism","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1626/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1626.001","id":"T1626.001","name":"Device Administrator Permissions","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1626.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":9,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1627","id":"T1627","name":"Execution Guardrails","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1627/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1627.001","id":"T1627.001","name":"Geofencing","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1627.001/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1628","id":"T1628","name":"Hide Artifacts","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1628/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1628.001","id":"T1628.001","name":"Suppress Application Icon","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1628.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":1,"documented_software":21,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1628.002","id":"T1628.002","name":"User Evasion","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1628.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":6,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1628.003","id":"T1628.003","name":"Conceal Multimedia Files","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1628.003/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1629","id":"T1629","name":"Impair Defenses","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1629/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1629.001","id":"T1629.001","name":"Prevent Application Removal","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1629.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":9,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1629.002","id":"T1629.002","name":"Device Lockout","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1629.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1629.003","id":"T1629.003","name":"Disable or Modify Tools","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1629.003/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":12,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1630","id":"T1630","name":"Indicator Removal on Host","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1630/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1630.001","id":"T1630.001","name":"Uninstall Malicious Application","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1630.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":7,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1630.002","id":"T1630.002","name":"File Deletion","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1630.002/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":1,"documented_software":19,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1630.003","id":"T1630.003","name":"Disguise Root/Jailbreak Indicators","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1630.003/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1631","id":"T1631","name":"Process Injection","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1631/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1631.001","id":"T1631.001","name":"Ptrace System Calls","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1631.001/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1632","id":"T1632","name":"Subvert Trust Controls","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1632/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1632.001","id":"T1632.001","name":"Code Signing Policy Modification","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1632.001/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":8,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1633","id":"T1633","name":"Virtualization/Sandbox Evasion","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1633/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1633.001","id":"T1633.001","name":"System Checks","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1633.001/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":15,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1634","id":"T1634","name":"Credentials from Password Store","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1634/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1634.001","id":"T1634.001","name":"Keychain","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1634.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1635","id":"T1635","name":"Steal Application Access Token","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1635/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1635.001","id":"T1635.001","name":"URI Hijacking","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1635.001/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1636","id":"T1636","name":"Protected User Data","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1636/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1636.001","id":"T1636.001","name":"Calendar Entries","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1636.001/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":1,"documented_software":6,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1636.002","id":"T1636.002","name":"Call Log","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1636.002/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":40,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1636.003","id":"T1636.003","name":"Contact List","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1636.003/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":1,"documented_software":56,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1636.004","id":"T1636.004","name":"SMS Messages","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1636.004/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":2,"documented_software":71,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1636.005","id":"T1636.005","name":"Accounts","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1636.005/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1637","id":"T1637","name":"Dynamic Resolution","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1637/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1637.001","id":"T1637.001","name":"Domain Generation Algorithms","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1637.001/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1638","id":"T1638","name":"Adversary-in-the-Middle","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1638/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1639","id":"T1639","name":"Exfiltration Over Alternative Protocol","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1639/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1639.001","id":"T1639.001","name":"Exfiltration Over Unencrypted Non-C2 Protocol","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1639.001/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":3,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1640","id":"T1640","name":"Account Access Removal","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1640/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1641","id":"T1641","name":"Data Manipulation","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1641/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1641.001","id":"T1641.001","name":"Transmitted Data Manipulation","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1641.001/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1642","id":"T1642","name":"Endpoint Denial of Service","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1642/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":1,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1643","id":"T1643","name":"Generate Traffic from Victim","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1643/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":16,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1644","id":"T1644","name":"Out of Band Data","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1644/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":18,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1645","id":"T1645","name":"Compromise Client Software Binary","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1645/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":8,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1646","id":"T1646","name":"Exfiltration Over C2 Channel","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1646/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":28,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1655","id":"T1655","name":"Masquerading","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1655/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":5,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1655.001","id":"T1655.001","name":"Match Legitimate Name or Location","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1655.001/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":41,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1658","id":"T1658","name":"Exploitation for Client Execution","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1658/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1660","id":"T1660","name":"Phishing","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1660/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":2,"atomic_candidates":0,"lab_tools":0,"documented_software":11,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1661","id":"T1661","name":"Application Versioning","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1661/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":1,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1662","id":"T1662","name":"Data Destruction","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1662/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":5,"atomic_candidates":0,"lab_tools":0,"documented_software":4,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1663","id":"T1663","name":"Remote Access Software","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1663/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1664","id":"T1664","name":"Exploitation for Initial Access","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1664/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1670","id":"T1670","name":"Virtualization Solution","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1670/","full_definition":true,"detection_analytics":1,"sigma_sources":0,"anomaly_models":0,"collection_contracts":3,"atomic_candidates":0,"lab_tools":0,"documented_software":2,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"mobile/T1676","id":"T1676","name":"Linked Devices","domain":"mobile","page":"/ttp-simulation/techniques/mobile/T1676/","full_definition":true,"detection_analytics":2,"sigma_sources":0,"anomaly_models":0,"collection_contracts":1,"atomic_candidates":0,"lab_tools":0,"documented_software":0,"source_identity_checked":true,"synthetic_collection_fixture":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0000","id":"AML.T0000","name":"Search Open Technical Databases","domain":"atlas","page":"/attack-matrix/atlas/AML.T0000/","full_definition":true,"explicit_mitigations":2,"case_studies":8,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0000.000","id":"AML.T0000.000","name":"Journals and Conference Proceedings","domain":"atlas","page":"/attack-matrix/atlas/AML.T0000.000/","full_definition":true,"explicit_mitigations":0,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0000.001","id":"AML.T0000.001","name":"Pre-Print Repositories","domain":"atlas","page":"/attack-matrix/atlas/AML.T0000.001/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0000.002","id":"AML.T0000.002","name":"Technical Blogs","domain":"atlas","page":"/attack-matrix/atlas/AML.T0000.002/","full_definition":true,"explicit_mitigations":0,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0000.003","id":"AML.T0000.003","name":"Scan Databases","domain":"atlas","page":"/attack-matrix/atlas/AML.T0000.003/","full_definition":true,"explicit_mitigations":1,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0001","id":"AML.T0001","name":"Search Open AI Vulnerability Analysis","domain":"atlas","page":"/attack-matrix/atlas/AML.T0001/","full_definition":true,"explicit_mitigations":1,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0002","id":"AML.T0002","name":"Acquire Public AI Artifacts","domain":"atlas","page":"/attack-matrix/atlas/AML.T0002/","full_definition":true,"explicit_mitigations":1,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0002.000","id":"AML.T0002.000","name":"Datasets","domain":"atlas","page":"/attack-matrix/atlas/AML.T0002.000/","full_definition":true,"explicit_mitigations":1,"case_studies":6,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0002.001","id":"AML.T0002.001","name":"Models","domain":"atlas","page":"/attack-matrix/atlas/AML.T0002.001/","full_definition":true,"explicit_mitigations":2,"case_studies":5,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0002.002","id":"AML.T0002.002","name":"AI Agent Configuration","domain":"atlas","page":"/attack-matrix/atlas/AML.T0002.002/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0003","id":"AML.T0003","name":"Search Victim-Owned Websites","domain":"atlas","page":"/attack-matrix/atlas/AML.T0003/","full_definition":true,"explicit_mitigations":1,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0004","id":"AML.T0004","name":"Search Application Repositories","domain":"atlas","page":"/attack-matrix/atlas/AML.T0004/","full_definition":true,"explicit_mitigations":1,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0005","id":"AML.T0005","name":"Create Proxy AI Model","domain":"atlas","page":"/attack-matrix/atlas/AML.T0005/","full_definition":true,"explicit_mitigations":5,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0005.000","id":"AML.T0005.000","name":"Train Proxy via Gathered AI Artifacts","domain":"atlas","page":"/attack-matrix/atlas/AML.T0005.000/","full_definition":true,"explicit_mitigations":2,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0005.001","id":"AML.T0005.001","name":"Train Proxy via Replication","domain":"atlas","page":"/attack-matrix/atlas/AML.T0005.001/","full_definition":true,"explicit_mitigations":3,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0005.002","id":"AML.T0005.002","name":"Use Pre-Trained Model","domain":"atlas","page":"/attack-matrix/atlas/AML.T0005.002/","full_definition":true,"explicit_mitigations":1,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0006","id":"AML.T0006","name":"Active Scanning","domain":"atlas","page":"/attack-matrix/atlas/AML.T0006/","full_definition":true,"explicit_mitigations":3,"case_studies":5,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0006.000","id":"AML.T0006.000","name":"Enumerate Hosted AI Resources","domain":"atlas","page":"/attack-matrix/atlas/AML.T0006.000/","full_definition":true,"explicit_mitigations":1,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0006.001","id":"AML.T0006.001","name":"Query Platform Metadata APIs","domain":"atlas","page":"/attack-matrix/atlas/AML.T0006.001/","full_definition":true,"explicit_mitigations":1,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0006.002","id":"AML.T0006.002","name":"Scan for Exposed AI Infrastructure","domain":"atlas","page":"/attack-matrix/atlas/AML.T0006.002/","full_definition":true,"explicit_mitigations":1,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0006.003","id":"AML.T0006.003","name":"Probe AI Agent Trigger Channels","domain":"atlas","page":"/attack-matrix/atlas/AML.T0006.003/","full_definition":true,"explicit_mitigations":1,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0007","id":"AML.T0007","name":"Discover AI Artifacts","domain":"atlas","page":"/attack-matrix/atlas/AML.T0007/","full_definition":true,"explicit_mitigations":2,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0008","id":"AML.T0008","name":"Acquire Infrastructure","domain":"atlas","page":"/attack-matrix/atlas/AML.T0008/","full_definition":true,"explicit_mitigations":0,"case_studies":4,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0008.000","id":"AML.T0008.000","name":"AI Development Workspaces","domain":"atlas","page":"/attack-matrix/atlas/AML.T0008.000/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0008.001","id":"AML.T0008.001","name":"Consumer Hardware","domain":"atlas","page":"/attack-matrix/atlas/AML.T0008.001/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0008.002","id":"AML.T0008.002","name":"Domains","domain":"atlas","page":"/attack-matrix/atlas/AML.T0008.002/","full_definition":true,"explicit_mitigations":0,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0008.003","id":"AML.T0008.003","name":"Physical Countermeasures","domain":"atlas","page":"/attack-matrix/atlas/AML.T0008.003/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0008.004","id":"AML.T0008.004","name":"Serverless","domain":"atlas","page":"/attack-matrix/atlas/AML.T0008.004/","full_definition":true,"explicit_mitigations":0,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0008.005","id":"AML.T0008.005","name":"AI Service Proxies","domain":"atlas","page":"/attack-matrix/atlas/AML.T0008.005/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0010","id":"AML.T0010","name":"AI Supply Chain Compromise","domain":"atlas","page":"/attack-matrix/atlas/AML.T0010/","full_definition":true,"explicit_mitigations":4,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0010.000","id":"AML.T0010.000","name":"Hardware","domain":"atlas","page":"/attack-matrix/atlas/AML.T0010.000/","full_definition":true,"explicit_mitigations":0,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0010.001","id":"AML.T0010.001","name":"AI Software","domain":"atlas","page":"/attack-matrix/atlas/AML.T0010.001/","full_definition":true,"explicit_mitigations":3,"case_studies":5,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0010.002","id":"AML.T0010.002","name":"Data","domain":"atlas","page":"/attack-matrix/atlas/AML.T0010.002/","full_definition":true,"explicit_mitigations":5,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0010.003","id":"AML.T0010.003","name":"Model","domain":"atlas","page":"/attack-matrix/atlas/AML.T0010.003/","full_definition":true,"explicit_mitigations":6,"case_studies":6,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0010.004","id":"AML.T0010.004","name":"Container Registry","domain":"atlas","page":"/attack-matrix/atlas/AML.T0010.004/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0010.005","id":"AML.T0010.005","name":"AI Agent Tool","domain":"atlas","page":"/attack-matrix/atlas/AML.T0010.005/","full_definition":true,"explicit_mitigations":1,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0011","id":"AML.T0011","name":"User Execution","domain":"atlas","page":"/attack-matrix/atlas/AML.T0011/","full_definition":true,"explicit_mitigations":5,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0011.000","id":"AML.T0011.000","name":"Unsafe AI Artifacts","domain":"atlas","page":"/attack-matrix/atlas/AML.T0011.000/","full_definition":true,"explicit_mitigations":6,"case_studies":4,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0011.001","id":"AML.T0011.001","name":"Malicious Package","domain":"atlas","page":"/attack-matrix/atlas/AML.T0011.001/","full_definition":true,"explicit_mitigations":5,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0011.002","id":"AML.T0011.002","name":"Poisoned AI Agent Tool","domain":"atlas","page":"/attack-matrix/atlas/AML.T0011.002/","full_definition":true,"explicit_mitigations":0,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0011.003","id":"AML.T0011.003","name":"Malicious Link","domain":"atlas","page":"/attack-matrix/atlas/AML.T0011.003/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0012","id":"AML.T0012","name":"Valid Accounts","domain":"atlas","page":"/attack-matrix/atlas/AML.T0012/","full_definition":true,"explicit_mitigations":2,"case_studies":12,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0013","id":"AML.T0013","name":"Discover AI Model Ontology","domain":"atlas","page":"/attack-matrix/atlas/AML.T0013/","full_definition":true,"explicit_mitigations":2,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0014","id":"AML.T0014","name":"Discover AI Model Family","domain":"atlas","page":"/attack-matrix/atlas/AML.T0014/","full_definition":true,"explicit_mitigations":3,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0015","id":"AML.T0015","name":"Evade AI Model","domain":"atlas","page":"/attack-matrix/atlas/AML.T0015/","full_definition":true,"explicit_mitigations":7,"case_studies":18,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0016","id":"AML.T0016","name":"Obtain Capabilities","domain":"atlas","page":"/attack-matrix/atlas/AML.T0016/","full_definition":true,"explicit_mitigations":1,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0016.000","id":"AML.T0016.000","name":"Adversarial AI Attack Implementations","domain":"atlas","page":"/attack-matrix/atlas/AML.T0016.000/","full_definition":true,"explicit_mitigations":0,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0016.001","id":"AML.T0016.001","name":"Software Tools","domain":"atlas","page":"/attack-matrix/atlas/AML.T0016.001/","full_definition":true,"explicit_mitigations":0,"case_studies":5,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0016.002","id":"AML.T0016.002","name":"Generative AI","domain":"atlas","page":"/attack-matrix/atlas/AML.T0016.002/","full_definition":true,"explicit_mitigations":3,"case_studies":4,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0016.003","id":"AML.T0016.003","name":"Exploits","domain":"atlas","page":"/attack-matrix/atlas/AML.T0016.003/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0016.004","id":"AML.T0016.004","name":"AI Agent Tools","domain":"atlas","page":"/attack-matrix/atlas/AML.T0016.004/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0017","id":"AML.T0017","name":"Develop Capabilities","domain":"atlas","page":"/attack-matrix/atlas/AML.T0017/","full_definition":true,"explicit_mitigations":0,"case_studies":10,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0017.000","id":"AML.T0017.000","name":"Adversarial AI Attacks","domain":"atlas","page":"/attack-matrix/atlas/AML.T0017.000/","full_definition":true,"explicit_mitigations":0,"case_studies":5,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0017.001","id":"AML.T0017.001","name":"Autonomous Exploit Development","domain":"atlas","page":"/attack-matrix/atlas/AML.T0017.001/","full_definition":true,"explicit_mitigations":0,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0017.002","id":"AML.T0017.002","name":"AI Agent Tools","domain":"atlas","page":"/attack-matrix/atlas/AML.T0017.002/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0018","id":"AML.T0018","name":"Manipulate AI Model","domain":"atlas","page":"/attack-matrix/atlas/AML.T0018/","full_definition":true,"explicit_mitigations":4,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0018.000","id":"AML.T0018.000","name":"Poison AI Model","domain":"atlas","page":"/attack-matrix/atlas/AML.T0018.000/","full_definition":true,"explicit_mitigations":6,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0018.001","id":"AML.T0018.001","name":"Modify AI Model Architecture","domain":"atlas","page":"/attack-matrix/atlas/AML.T0018.001/","full_definition":true,"explicit_mitigations":4,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0018.002","id":"AML.T0018.002","name":"Embed Malware","domain":"atlas","page":"/attack-matrix/atlas/AML.T0018.002/","full_definition":true,"explicit_mitigations":1,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0018.003","id":"AML.T0018.003","name":"Modify Prompt Construction Logic","domain":"atlas","page":"/attack-matrix/atlas/AML.T0018.003/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0020","id":"AML.T0020","name":"Training Data Poisoning","domain":"atlas","page":"/attack-matrix/atlas/AML.T0020/","full_definition":true,"explicit_mitigations":7,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0021","id":"AML.T0021","name":"Establish Accounts","domain":"atlas","page":"/attack-matrix/atlas/AML.T0021/","full_definition":true,"explicit_mitigations":2,"case_studies":6,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0024","id":"AML.T0024","name":"Exfiltration via AI Inference API","domain":"atlas","page":"/attack-matrix/atlas/AML.T0024/","full_definition":true,"explicit_mitigations":4,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0024.000","id":"AML.T0024.000","name":"Infer Training Data Membership","domain":"atlas","page":"/attack-matrix/atlas/AML.T0024.000/","full_definition":true,"explicit_mitigations":4,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0024.001","id":"AML.T0024.001","name":"Invert AI Model","domain":"atlas","page":"/attack-matrix/atlas/AML.T0024.001/","full_definition":true,"explicit_mitigations":4,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0024.002","id":"AML.T0024.002","name":"Extract AI Model","domain":"atlas","page":"/attack-matrix/atlas/AML.T0024.002/","full_definition":true,"explicit_mitigations":4,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0025","id":"AML.T0025","name":"Exfiltration via Cyber Means","domain":"atlas","page":"/attack-matrix/atlas/AML.T0025/","full_definition":true,"explicit_mitigations":1,"case_studies":14,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0029","id":"AML.T0029","name":"Denial of AI Service","domain":"atlas","page":"/attack-matrix/atlas/AML.T0029/","full_definition":true,"explicit_mitigations":5,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0031","id":"AML.T0031","name":"Erode AI Model Integrity","domain":"atlas","page":"/attack-matrix/atlas/AML.T0031/","full_definition":true,"explicit_mitigations":4,"case_studies":6,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0034","id":"AML.T0034","name":"Cost Harvesting","domain":"atlas","page":"/attack-matrix/atlas/AML.T0034/","full_definition":true,"explicit_mitigations":4,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0034.000","id":"AML.T0034.000","name":"Excessive Queries","domain":"atlas","page":"/attack-matrix/atlas/AML.T0034.000/","full_definition":true,"explicit_mitigations":1,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0034.001","id":"AML.T0034.001","name":"Resource-Intensive Queries","domain":"atlas","page":"/attack-matrix/atlas/AML.T0034.001/","full_definition":true,"explicit_mitigations":2,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0034.002","id":"AML.T0034.002","name":"Agentic Resource Consumption","domain":"atlas","page":"/attack-matrix/atlas/AML.T0034.002/","full_definition":true,"explicit_mitigations":2,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0035","id":"AML.T0035","name":"AI Artifact Collection","domain":"atlas","page":"/attack-matrix/atlas/AML.T0035/","full_definition":true,"explicit_mitigations":4,"case_studies":4,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0036","id":"AML.T0036","name":"Data from Information Repositories","domain":"atlas","page":"/attack-matrix/atlas/AML.T0036/","full_definition":true,"explicit_mitigations":0,"case_studies":4,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0037","id":"AML.T0037","name":"Data from Local System","domain":"atlas","page":"/attack-matrix/atlas/AML.T0037/","full_definition":true,"explicit_mitigations":0,"case_studies":6,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0040","id":"AML.T0040","name":"AI Model Inference API Access","domain":"atlas","page":"/attack-matrix/atlas/AML.T0040/","full_definition":true,"explicit_mitigations":3,"case_studies":10,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0041","id":"AML.T0041","name":"Physical Environment Access","domain":"atlas","page":"/attack-matrix/atlas/AML.T0041/","full_definition":true,"explicit_mitigations":1,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0042","id":"AML.T0042","name":"Verify Attack","domain":"atlas","page":"/attack-matrix/atlas/AML.T0042/","full_definition":true,"explicit_mitigations":4,"case_studies":7,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0043","id":"AML.T0043","name":"Craft Adversarial Data","domain":"atlas","page":"/attack-matrix/atlas/AML.T0043/","full_definition":true,"explicit_mitigations":8,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0043.000","id":"AML.T0043.000","name":"White-Box Optimization","domain":"atlas","page":"/attack-matrix/atlas/AML.T0043.000/","full_definition":true,"explicit_mitigations":6,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0043.001","id":"AML.T0043.001","name":"Black-Box Optimization","domain":"atlas","page":"/attack-matrix/atlas/AML.T0043.001/","full_definition":true,"explicit_mitigations":7,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0043.002","id":"AML.T0043.002","name":"Black-Box Transfer","domain":"atlas","page":"/attack-matrix/atlas/AML.T0043.002/","full_definition":true,"explicit_mitigations":4,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0043.003","id":"AML.T0043.003","name":"Manual Modification","domain":"atlas","page":"/attack-matrix/atlas/AML.T0043.003/","full_definition":true,"explicit_mitigations":5,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0043.004","id":"AML.T0043.004","name":"Insert Backdoor Trigger","domain":"atlas","page":"/attack-matrix/atlas/AML.T0043.004/","full_definition":true,"explicit_mitigations":5,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0044","id":"AML.T0044","name":"Full AI Model Access","domain":"atlas","page":"/attack-matrix/atlas/AML.T0044/","full_definition":true,"explicit_mitigations":2,"case_studies":4,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0046","id":"AML.T0046","name":"Spamming AI System with Chaff Data","domain":"atlas","page":"/attack-matrix/atlas/AML.T0046/","full_definition":true,"explicit_mitigations":2,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0047","id":"AML.T0047","name":"AI-Enabled Product or Service","domain":"atlas","page":"/attack-matrix/atlas/AML.T0047/","full_definition":true,"explicit_mitigations":1,"case_studies":16,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0048","id":"AML.T0048","name":"External Harms","domain":"atlas","page":"/attack-matrix/atlas/AML.T0048/","full_definition":true,"explicit_mitigations":0,"case_studies":6,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0048.000","id":"AML.T0048.000","name":"Financial Harm","domain":"atlas","page":"/attack-matrix/atlas/AML.T0048.000/","full_definition":true,"explicit_mitigations":0,"case_studies":11,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0048.001","id":"AML.T0048.001","name":"Reputational Harm","domain":"atlas","page":"/attack-matrix/atlas/AML.T0048.001/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0048.002","id":"AML.T0048.002","name":"Societal Harm","domain":"atlas","page":"/attack-matrix/atlas/AML.T0048.002/","full_definition":true,"explicit_mitigations":0,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0048.003","id":"AML.T0048.003","name":"User Harm","domain":"atlas","page":"/attack-matrix/atlas/AML.T0048.003/","full_definition":true,"explicit_mitigations":0,"case_studies":14,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0048.004","id":"AML.T0048.004","name":"AI Intellectual Property Theft","domain":"atlas","page":"/attack-matrix/atlas/AML.T0048.004/","full_definition":true,"explicit_mitigations":3,"case_studies":6,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0049","id":"AML.T0049","name":"Exploit Public-Facing Application","domain":"atlas","page":"/attack-matrix/atlas/AML.T0049/","full_definition":true,"explicit_mitigations":1,"case_studies":8,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0050","id":"AML.T0050","name":"Command and Scripting Interpreter","domain":"atlas","page":"/attack-matrix/atlas/AML.T0050/","full_definition":true,"explicit_mitigations":1,"case_studies":6,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0051","id":"AML.T0051","name":"LLM Prompt Injection","domain":"atlas","page":"/attack-matrix/atlas/AML.T0051/","full_definition":true,"explicit_mitigations":7,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0051.000","id":"AML.T0051.000","name":"Direct","domain":"atlas","page":"/attack-matrix/atlas/AML.T0051.000/","full_definition":true,"explicit_mitigations":3,"case_studies":11,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0051.001","id":"AML.T0051.001","name":"Indirect","domain":"atlas","page":"/attack-matrix/atlas/AML.T0051.001/","full_definition":true,"explicit_mitigations":3,"case_studies":18,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0051.002","id":"AML.T0051.002","name":"Triggered","domain":"atlas","page":"/attack-matrix/atlas/AML.T0051.002/","full_definition":true,"explicit_mitigations":3,"case_studies":5,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0052","id":"AML.T0052","name":"Phishing","domain":"atlas","page":"/attack-matrix/atlas/AML.T0052/","full_definition":true,"explicit_mitigations":2,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0052.000","id":"AML.T0052.000","name":"Spearphishing via Social Engineering LLM","domain":"atlas","page":"/attack-matrix/atlas/AML.T0052.000/","full_definition":true,"explicit_mitigations":2,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0052.001","id":"AML.T0052.001","name":"Deepfake-Assisted Phishing","domain":"atlas","page":"/attack-matrix/atlas/AML.T0052.001/","full_definition":true,"explicit_mitigations":2,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0053","id":"AML.T0053","name":"AI Agent Tool Invocation","domain":"atlas","page":"/attack-matrix/atlas/AML.T0053/","full_definition":true,"explicit_mitigations":12,"case_studies":19,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0054","id":"AML.T0054","name":"LLM Jailbreak","domain":"atlas","page":"/attack-matrix/atlas/AML.T0054/","full_definition":true,"explicit_mitigations":4,"case_studies":9,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0055","id":"AML.T0055","name":"Unsecured Credentials","domain":"atlas","page":"/attack-matrix/atlas/AML.T0055/","full_definition":true,"explicit_mitigations":0,"case_studies":9,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0056","id":"AML.T0056","name":"Extract LLM System Prompt","domain":"atlas","page":"/attack-matrix/atlas/AML.T0056/","full_definition":true,"explicit_mitigations":4,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0057","id":"AML.T0057","name":"LLM Data Leakage","domain":"atlas","page":"/attack-matrix/atlas/AML.T0057/","full_definition":true,"explicit_mitigations":5,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0059","id":"AML.T0059","name":"Erode Dataset Integrity","domain":"atlas","page":"/attack-matrix/atlas/AML.T0059/","full_definition":true,"explicit_mitigations":2,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0060","id":"AML.T0060","name":"Publish Hallucinated Entities","domain":"atlas","page":"/attack-matrix/atlas/AML.T0060/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0061","id":"AML.T0061","name":"LLM Prompt Self-Replication","domain":"atlas","page":"/attack-matrix/atlas/AML.T0061/","full_definition":true,"explicit_mitigations":3,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0062","id":"AML.T0062","name":"Discover LLM Hallucinations","domain":"atlas","page":"/attack-matrix/atlas/AML.T0062/","full_definition":true,"explicit_mitigations":4,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0063","id":"AML.T0063","name":"Discover AI Model Outputs","domain":"atlas","page":"/attack-matrix/atlas/AML.T0063/","full_definition":true,"explicit_mitigations":4,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0064","id":"AML.T0064","name":"Gather RAG-Indexed Targets","domain":"atlas","page":"/attack-matrix/atlas/AML.T0064/","full_definition":true,"explicit_mitigations":1,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0065","id":"AML.T0065","name":"LLM Prompt Crafting","domain":"atlas","page":"/attack-matrix/atlas/AML.T0065/","full_definition":true,"explicit_mitigations":0,"case_studies":25,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0066","id":"AML.T0066","name":"Retrieval Content Crafting","domain":"atlas","page":"/attack-matrix/atlas/AML.T0066/","full_definition":true,"explicit_mitigations":1,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0067","id":"AML.T0067","name":"LLM Trusted Output Components Manipulation","domain":"atlas","page":"/attack-matrix/atlas/AML.T0067/","full_definition":true,"explicit_mitigations":0,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0067.000","id":"AML.T0067.000","name":"Citations","domain":"atlas","page":"/attack-matrix/atlas/AML.T0067.000/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0068","id":"AML.T0068","name":"LLM Prompt Obfuscation","domain":"atlas","page":"/attack-matrix/atlas/AML.T0068/","full_definition":true,"explicit_mitigations":2,"case_studies":10,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0069","id":"AML.T0069","name":"Discover LLM System Information","domain":"atlas","page":"/attack-matrix/atlas/AML.T0069/","full_definition":true,"explicit_mitigations":4,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0069.000","id":"AML.T0069.000","name":"Special Character Sets","domain":"atlas","page":"/attack-matrix/atlas/AML.T0069.000/","full_definition":true,"explicit_mitigations":3,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0069.001","id":"AML.T0069.001","name":"System Instruction Keywords","domain":"atlas","page":"/attack-matrix/atlas/AML.T0069.001/","full_definition":true,"explicit_mitigations":2,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0069.002","id":"AML.T0069.002","name":"System Prompt","domain":"atlas","page":"/attack-matrix/atlas/AML.T0069.002/","full_definition":true,"explicit_mitigations":3,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0070","id":"AML.T0070","name":"RAG Poisoning","domain":"atlas","page":"/attack-matrix/atlas/AML.T0070/","full_definition":true,"explicit_mitigations":2,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0071","id":"AML.T0071","name":"False RAG Entry Injection","domain":"atlas","page":"/attack-matrix/atlas/AML.T0071/","full_definition":true,"explicit_mitigations":1,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0072","id":"AML.T0072","name":"Cyber Communication Channel","domain":"atlas","page":"/attack-matrix/atlas/AML.T0072/","full_definition":true,"explicit_mitigations":0,"case_studies":5,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0073","id":"AML.T0073","name":"Impersonation","domain":"atlas","page":"/attack-matrix/atlas/AML.T0073/","full_definition":true,"explicit_mitigations":0,"case_studies":5,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0074","id":"AML.T0074","name":"Masquerading","domain":"atlas","page":"/attack-matrix/atlas/AML.T0074/","full_definition":true,"explicit_mitigations":2,"case_studies":6,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0075","id":"AML.T0075","name":"Enterprise Resource Discovery","domain":"atlas","page":"/attack-matrix/atlas/AML.T0075/","full_definition":true,"explicit_mitigations":0,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0076","id":"AML.T0076","name":"Corrupt AI Model","domain":"atlas","page":"/attack-matrix/atlas/AML.T0076/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0077","id":"AML.T0077","name":"LLM Response Rendering","domain":"atlas","page":"/attack-matrix/atlas/AML.T0077/","full_definition":true,"explicit_mitigations":0,"case_studies":5,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0078","id":"AML.T0078","name":"Drive-by Compromise","domain":"atlas","page":"/attack-matrix/atlas/AML.T0078/","full_definition":true,"explicit_mitigations":1,"case_studies":4,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0079","id":"AML.T0079","name":"Stage Capabilities","domain":"atlas","page":"/attack-matrix/atlas/AML.T0079/","full_definition":true,"explicit_mitigations":0,"case_studies":11,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0080","id":"AML.T0080","name":"AI Agent Context Poisoning","domain":"atlas","page":"/attack-matrix/atlas/AML.T0080/","full_definition":true,"explicit_mitigations":2,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0080.000","id":"AML.T0080.000","name":"Memory","domain":"atlas","page":"/attack-matrix/atlas/AML.T0080.000/","full_definition":true,"explicit_mitigations":2,"case_studies":4,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0080.001","id":"AML.T0080.001","name":"Thread","domain":"atlas","page":"/attack-matrix/atlas/AML.T0080.001/","full_definition":true,"explicit_mitigations":1,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0081","id":"AML.T0081","name":"Modify AI Agent Configuration","domain":"atlas","page":"/attack-matrix/atlas/AML.T0081/","full_definition":true,"explicit_mitigations":1,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0082","id":"AML.T0082","name":"RAG Credential Harvesting","domain":"atlas","page":"/attack-matrix/atlas/AML.T0082/","full_definition":true,"explicit_mitigations":2,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0083","id":"AML.T0083","name":"Credentials from AI Agent Configuration","domain":"atlas","page":"/attack-matrix/atlas/AML.T0083/","full_definition":true,"explicit_mitigations":0,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0084","id":"AML.T0084","name":"Discover AI Agent Configuration","domain":"atlas","page":"/attack-matrix/atlas/AML.T0084/","full_definition":true,"explicit_mitigations":2,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0084.000","id":"AML.T0084.000","name":"Embedded Knowledge","domain":"atlas","page":"/attack-matrix/atlas/AML.T0084.000/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0084.001","id":"AML.T0084.001","name":"Tool Definitions","domain":"atlas","page":"/attack-matrix/atlas/AML.T0084.001/","full_definition":true,"explicit_mitigations":1,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0084.002","id":"AML.T0084.002","name":"Activation Triggers","domain":"atlas","page":"/attack-matrix/atlas/AML.T0084.002/","full_definition":true,"explicit_mitigations":1,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0084.003","id":"AML.T0084.003","name":"Call Chains","domain":"atlas","page":"/attack-matrix/atlas/AML.T0084.003/","full_definition":true,"explicit_mitigations":1,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0085","id":"AML.T0085","name":"Data from AI Services","domain":"atlas","page":"/attack-matrix/atlas/AML.T0085/","full_definition":true,"explicit_mitigations":5,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0085.000","id":"AML.T0085.000","name":"RAG Databases","domain":"atlas","page":"/attack-matrix/atlas/AML.T0085.000/","full_definition":true,"explicit_mitigations":4,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0085.001","id":"AML.T0085.001","name":"AI Agent Tools","domain":"atlas","page":"/attack-matrix/atlas/AML.T0085.001/","full_definition":true,"explicit_mitigations":5,"case_studies":5,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0086","id":"AML.T0086","name":"Exfiltration via AI Agent Tool Invocation","domain":"atlas","page":"/attack-matrix/atlas/AML.T0086/","full_definition":true,"explicit_mitigations":8,"case_studies":10,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0087","id":"AML.T0087","name":"Gather Victim Identity Information","domain":"atlas","page":"/attack-matrix/atlas/AML.T0087/","full_definition":true,"explicit_mitigations":0,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0088","id":"AML.T0088","name":"Generate Deepfakes","domain":"atlas","page":"/attack-matrix/atlas/AML.T0088/","full_definition":true,"explicit_mitigations":2,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0089","id":"AML.T0089","name":"Enterprise Environment Discovery","domain":"atlas","page":"/attack-matrix/atlas/AML.T0089/","full_definition":true,"explicit_mitigations":0,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0090","id":"AML.T0090","name":"OS Credential Dumping","domain":"atlas","page":"/attack-matrix/atlas/AML.T0090/","full_definition":true,"explicit_mitigations":1,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0091","id":"AML.T0091","name":"Use Alternate Authentication Material","domain":"atlas","page":"/attack-matrix/atlas/AML.T0091/","full_definition":true,"explicit_mitigations":1,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0091.000","id":"AML.T0091.000","name":"Application Access Token","domain":"atlas","page":"/attack-matrix/atlas/AML.T0091.000/","full_definition":true,"explicit_mitigations":1,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0091.001","id":"AML.T0091.001","name":"Web Session Cookie","domain":"atlas","page":"/attack-matrix/atlas/AML.T0091.001/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0092","id":"AML.T0092","name":"Manipulate User LLM Chat History","domain":"atlas","page":"/attack-matrix/atlas/AML.T0092/","full_definition":true,"explicit_mitigations":0,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0093","id":"AML.T0093","name":"Prompt Infiltration via Public-Facing Application","domain":"atlas","page":"/attack-matrix/atlas/AML.T0093/","full_definition":true,"explicit_mitigations":1,"case_studies":13,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0094","id":"AML.T0094","name":"Delay Execution of LLM Instructions","domain":"atlas","page":"/attack-matrix/atlas/AML.T0094/","full_definition":true,"explicit_mitigations":0,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0095","id":"AML.T0095","name":"Search Open Websites/Domains","domain":"atlas","page":"/attack-matrix/atlas/AML.T0095/","full_definition":true,"explicit_mitigations":2,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0095.000","id":"AML.T0095.000","name":"Code Repositories","domain":"atlas","page":"/attack-matrix/atlas/AML.T0095.000/","full_definition":true,"explicit_mitigations":1,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0096","id":"AML.T0096","name":"AI Service API","domain":"atlas","page":"/attack-matrix/atlas/AML.T0096/","full_definition":true,"explicit_mitigations":1,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0097","id":"AML.T0097","name":"Virtualization/Sandbox Evasion","domain":"atlas","page":"/attack-matrix/atlas/AML.T0097/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0098","id":"AML.T0098","name":"AI Agent Tool Credential Harvesting","domain":"atlas","page":"/attack-matrix/atlas/AML.T0098/","full_definition":true,"explicit_mitigations":1,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0099","id":"AML.T0099","name":"AI Agent Tool Data Poisoning","domain":"atlas","page":"/attack-matrix/atlas/AML.T0099/","full_definition":true,"explicit_mitigations":1,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0100","id":"AML.T0100","name":"AI Agent Clickbait","domain":"atlas","page":"/attack-matrix/atlas/AML.T0100/","full_definition":true,"explicit_mitigations":2,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0101","id":"AML.T0101","name":"Data Destruction via AI Agent Tool Invocation","domain":"atlas","page":"/attack-matrix/atlas/AML.T0101/","full_definition":true,"explicit_mitigations":6,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0102","id":"AML.T0102","name":"Generate Malicious Commands","domain":"atlas","page":"/attack-matrix/atlas/AML.T0102/","full_definition":true,"explicit_mitigations":2,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0103","id":"AML.T0103","name":"Deploy AI Agent","domain":"atlas","page":"/attack-matrix/atlas/AML.T0103/","full_definition":true,"explicit_mitigations":0,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0105","id":"AML.T0105","name":"Escape to Host","domain":"atlas","page":"/attack-matrix/atlas/AML.T0105/","full_definition":true,"explicit_mitigations":0,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0106","id":"AML.T0106","name":"Exploitation for Credential Access","domain":"atlas","page":"/attack-matrix/atlas/AML.T0106/","full_definition":true,"explicit_mitigations":1,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0107","id":"AML.T0107","name":"Exploitation for Defense Evasion","domain":"atlas","page":"/attack-matrix/atlas/AML.T0107/","full_definition":true,"explicit_mitigations":1,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0108","id":"AML.T0108","name":"AI Agent","domain":"atlas","page":"/attack-matrix/atlas/AML.T0108/","full_definition":true,"explicit_mitigations":1,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0109","id":"AML.T0109","name":"AI Supply Chain Rug Pull","domain":"atlas","page":"/attack-matrix/atlas/AML.T0109/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0110","id":"AML.T0110","name":"AI Agent Tool Poisoning","domain":"atlas","page":"/attack-matrix/atlas/AML.T0110/","full_definition":true,"explicit_mitigations":0,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0110.000","id":"AML.T0110.000","name":"Definition and Instructions","domain":"atlas","page":"/attack-matrix/atlas/AML.T0110.000/","full_definition":true,"explicit_mitigations":0,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0110.001","id":"AML.T0110.001","name":"Implementation","domain":"atlas","page":"/attack-matrix/atlas/AML.T0110.001/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0110.002","id":"AML.T0110.002","name":"Runtime Response","domain":"atlas","page":"/attack-matrix/atlas/AML.T0110.002/","full_definition":true,"explicit_mitigations":0,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0111","id":"AML.T0111","name":"AI Supply Chain Reputation Inflation","domain":"atlas","page":"/attack-matrix/atlas/AML.T0111/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0112","id":"AML.T0112","name":"Machine Compromise","domain":"atlas","page":"/attack-matrix/atlas/AML.T0112/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0112.000","id":"AML.T0112.000","name":"Local AI Agent","domain":"atlas","page":"/attack-matrix/atlas/AML.T0112.000/","full_definition":true,"explicit_mitigations":1,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0112.001","id":"AML.T0112.001","name":"AI Artifacts","domain":"atlas","page":"/attack-matrix/atlas/AML.T0112.001/","full_definition":true,"explicit_mitigations":1,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0113","id":"AML.T0113","name":"Steal Web Session Cookie","domain":"atlas","page":"/attack-matrix/atlas/AML.T0113/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0114","id":"AML.T0114","name":"AI Service Web Interface","domain":"atlas","page":"/attack-matrix/atlas/AML.T0114/","full_definition":true,"explicit_mitigations":1,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0115","id":"AML.T0115","name":"Publish Poisoned AI Artifacts","domain":"atlas","page":"/attack-matrix/atlas/AML.T0115/","full_definition":true,"explicit_mitigations":3,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0115.000","id":"AML.T0115.000","name":"Datasets","domain":"atlas","page":"/attack-matrix/atlas/AML.T0115.000/","full_definition":true,"explicit_mitigations":1,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0115.001","id":"AML.T0115.001","name":"Models","domain":"atlas","page":"/attack-matrix/atlas/AML.T0115.001/","full_definition":true,"explicit_mitigations":2,"case_studies":5,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0115.002","id":"AML.T0115.002","name":"AI Agent Tools","domain":"atlas","page":"/attack-matrix/atlas/AML.T0115.002/","full_definition":true,"explicit_mitigations":1,"case_studies":3,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0116","id":"AML.T0116","name":"Autonomous Reconnaissance","domain":"atlas","page":"/attack-matrix/atlas/AML.T0116/","full_definition":true,"explicit_mitigations":2,"case_studies":4,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0117","id":"AML.T0117","name":"Autonomous Attack-Path Adaptation","domain":"atlas","page":"/attack-matrix/atlas/AML.T0117/","full_definition":true,"explicit_mitigations":2,"case_studies":4,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0118","id":"AML.T0118","name":"Autonomous AI Agent Communication","domain":"atlas","page":"/attack-matrix/atlas/AML.T0118/","full_definition":true,"explicit_mitigations":0,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0118.000","id":"AML.T0118.000","name":"Communication via Shared Artifacts","domain":"atlas","page":"/attack-matrix/atlas/AML.T0118.000/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0118.001","id":"AML.T0118.001","name":"Direct Agent Communication","domain":"atlas","page":"/attack-matrix/atlas/AML.T0118.001/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0119","id":"AML.T0119","name":"Exploit Automated Artifact Processing Pipeline","domain":"atlas","page":"/attack-matrix/atlas/AML.T0119/","full_definition":true,"explicit_mitigations":1,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0120","id":"AML.T0120","name":"AI Artifact Repository","domain":"atlas","page":"/attack-matrix/atlas/AML.T0120/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0121","id":"AML.T0121","name":"AI Agent Environment Reconstruction","domain":"atlas","page":"/attack-matrix/atlas/AML.T0121/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0122","id":"AML.T0122","name":"Exploitation of Remote Services","domain":"atlas","page":"/attack-matrix/atlas/AML.T0122/","full_definition":true,"explicit_mitigations":1,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0123","id":"AML.T0123","name":"Obfuscated Files or Information","domain":"atlas","page":"/attack-matrix/atlas/AML.T0123/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0124","id":"AML.T0124","name":"Autonomous Attack Orchestration","domain":"atlas","page":"/attack-matrix/atlas/AML.T0124/","full_definition":true,"explicit_mitigations":2,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0125","id":"AML.T0125","name":"Create Account","domain":"atlas","page":"/attack-matrix/atlas/AML.T0125/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0126","id":"AML.T0126","name":"Automated Collection","domain":"atlas","page":"/attack-matrix/atlas/AML.T0126/","full_definition":true,"explicit_mitigations":0,"case_studies":2,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0127","id":"AML.T0127","name":"Data Staged","domain":"atlas","page":"/attack-matrix/atlas/AML.T0127/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0128","id":"AML.T0128","name":"Compromise Infrastructure","domain":"atlas","page":"/attack-matrix/atlas/AML.T0128/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0129","id":"AML.T0129","name":"Triggers in Multimodal Inputs","domain":"atlas","page":"/attack-matrix/atlas/AML.T0129/","full_definition":true,"explicit_mitigations":0,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0130","id":"AML.T0130","name":"AI Agent Response Biasing","domain":"atlas","page":"/attack-matrix/atlas/AML.T0130/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0131","id":"AML.T0131","name":"Crafted AI Assistant Links","domain":"atlas","page":"/attack-matrix/atlas/AML.T0131/","full_definition":true,"explicit_mitigations":0,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0132","id":"AML.T0132","name":"Misconfigured or Publicly Exposed AI Services","domain":"atlas","page":"/attack-matrix/atlas/AML.T0132/","full_definition":true,"explicit_mitigations":1,"case_studies":1,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0133","id":"AML.T0133","name":"Discover AI Agent Runtime Capabilities","domain":"atlas","page":"/attack-matrix/atlas/AML.T0133/","full_definition":true,"explicit_mitigations":1,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false},{"key":"atlas/AML.T0134","id":"AML.T0134","name":"AI Targeted Cloaking","domain":"atlas","page":"/attack-matrix/atlas/AML.T0134/","full_definition":true,"explicit_mitigations":0,"case_studies":0,"source_identity_checked":true,"live_attack_validation":false,"production_detector_validation":false}]}