{"off_to_def":{"head":{"vars":["def_tactic_label","def_tactic_rel_label","def_tech_parent_is_toplevel","def_tech_parent_label","def_tech_label","def_tech_id","def_artifact_rel_label","def_artifact_label","sc","off_artifact_label","off_artifact_rel_label","off_tech_label","framework_root_iri","off_tactic_rel_label","off_tactic_label","def_tactic","def_tactic_rel","def_tech","def_artifact_rel","def_artifact","off_artifact","off_artifact_rel","off_tech","off_tech_id","off_tactic_rel","off_tactic"]},"results":{"bindings":[{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Operating System Monitoring"},"def_tech_label":{"type":"literal","value":"Scheduled Job Analysis"},"def_tech_id":{"type":"literal","value":"D3-SJA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Job Schedule"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Job Schedule"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Masquerade Task or Service"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Stealth"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJobAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.004"},"off_tech_id":{"type":"literal","value":"T1036.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Job Schedule"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Masquerade Task or Service"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Stealth"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1036.004"},"off_tech_id":{"type":"literal","value":"T1036.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]}},"description":{"@context":{"rdfs":"http://www.w3.org/2000/01/rdf-schema#","owl":"http://www.w3.org/2002/07/owl#","d3f":"http://d3fend.mitre.org/ontologies/d3fend.owl#","skos":"http://www.w3.org/2004/02/skos/core#"},"@graph":[{"@id":"d3f:T1036.004","@type":["owl:NamedIndividual","owl:Class"],"d3f:attack-id":"T1036.004","d3f:definition":"Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.(Citation: TechNet Schtasks)(Citation: Systemd Service Units) Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones.","d3f:modifies":{"@id":"d3f:JobSchedule"},"rdfs:label":"Masquerade Task or Service","rdfs:subClassOf":{"@id":"d3f:T1036"}}]},"subtechniques":{"@context":{"rdfs":"http://www.w3.org/2000/01/rdf-schema#","owl":"http://www.w3.org/2002/07/owl#","d3f":"http://d3fend.mitre.org/ontologies/d3fend.owl#","skos":"http://www.w3.org/2004/02/skos/core#"},"@graph":[{"@id":"d3f:T1036","d3f:attack-id":["T1036"],"d3f:top-level":["true"],"rdfs:hasSubClass":[{"@id":"d3f:T1036.009"},{"@id":"d3f:T1036.006"},{"@id":"d3f:T1036.010"},{"@id":"d3f:T1036.012"},{"@id":"d3f:T1036.011"},{"@id":"d3f:T1036.008"},{"@id":"d3f:T1036.002"},{"@id":"d3f:T1036.004"},{"@id":"d3f:T1036.001"},{"@id":"d3f:T1036.007"},{"@id":"d3f:T1036.003"},{"@id":"d3f:T1036.005"}],"rdfs:label":["Masquerading"]},{"@id":"d3f:T1036.001","d3f:attack-id":["T1036.001"],"rdfs:label":["Invalid Code Signature"],"rdfs:subClassOf":[{"@id":"d3f:T1036"}]},{"@id":"d3f:T1036.002","d3f:attack-id":["T1036.002"],"rdfs:label":["Right-to-Left Override"],"rdfs:subClassOf":[{"@id":"d3f:T1036"}]},{"@id":"d3f:T1036.003","d3f:attack-id":["T1036.003"],"rdfs:label":["Rename Legitimate Utilities"],"rdfs:subClassOf":[{"@id":"d3f:T1036"}]},{"@id":"d3f:T1036.004","d3f:attack-id":["T1036.004"],"rdfs:label":["Masquerade Task or Service"],"rdfs:subClassOf":[{"@id":"d3f:T1036"}]},{"@id":"d3f:T1036.005","d3f:attack-id":["T1036.005"],"rdfs:label":["Match Legitimate Resource Name or Location"],"rdfs:subClassOf":[{"@id":"d3f:T1036"}]},{"@id":"d3f:T1036.006","d3f:attack-id":["T1036.006"],"rdfs:label":["Space after Filename"],"rdfs:subClassOf":[{"@id":"d3f:T1036"}]},{"@id":"d3f:T1036.007","d3f:attack-id":["T1036.007"],"rdfs:label":["Double File Extension"],"rdfs:subClassOf":[{"@id":"d3f:T1036"}]},{"@id":"d3f:T1036.008","d3f:attack-id":["T1036.008"],"rdfs:label":["Masquerade File Type"],"rdfs:subClassOf":[{"@id":"d3f:T1036"}]},{"@id":"d3f:T1036.009","d3f:attack-id":["T1036.009"],"rdfs:label":["Break Process Trees"],"rdfs:subClassOf":[{"@id":"d3f:T1036"}]},{"@id":"d3f:T1036.010","d3f:attack-id":["T1036.010"],"rdfs:label":["Masquerade Account Name"],"rdfs:subClassOf":[{"@id":"d3f:T1036"}]},{"@id":"d3f:T1036.011","d3f:attack-id":["T1036.011"],"rdfs:label":["Overwrite Process Arguments"],"rdfs:subClassOf":[{"@id":"d3f:T1036"}]},{"@id":"d3f:T1036.012","d3f:attack-id":["T1036.012"],"rdfs:label":["Browser Fingerprint"],"rdfs:subClassOf":[{"@id":"d3f:T1036"}]}]},"framework":{"framework_key":"enterprise","framework_label":"Enterprise","framework_root":"d3f:ATTACKEnterpriseTechnique","label_key":"rdfs:label"}}