{"off_to_def":{"head":{"vars":["def_tactic_label","def_tactic_rel_label","def_tech_parent_is_toplevel","def_tech_parent_label","def_tech_label","def_tech_id","def_artifact_rel_label","def_artifact_label","sc","off_artifact_label","off_artifact_rel_label","off_tech_label","framework_root_iri","off_tactic_rel_label","off_tactic_label","def_tactic","def_tactic_rel","def_tech","def_artifact_rel","def_artifact","off_artifact","off_artifact_rel","off_tech","off_tech_id","off_tactic_rel","off_tactic"]},"results":{"bindings":[{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Operating System Monitoring"},"def_tech_label":{"type":"literal","value":"Scheduled Job Analysis"},"def_tech_id":{"type":"literal","value":"D3-SJA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Job Schedule"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Job Schedule"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJobAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Job Schedule"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Job Schedule"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Job Schedule"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Analysis"},"def_tech_label":{"type":"literal","value":"System Call Analysis"},"def_tech_id":{"type":"literal","value":"D3-SCA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"System Call"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Analysis"},"def_tech_label":{"type":"literal","value":"System Call Analysis"},"def_tech_id":{"type":"literal","value":"D3-SCA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"System Call"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Analysis"},"def_tech_label":{"type":"literal","value":"System Call Analysis"},"def_tech_id":{"type":"literal","value":"D3-SCA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"System Call"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Analysis"},"def_tech_label":{"type":"literal","value":"Process Spawn Analysis"},"def_tech_id":{"type":"literal","value":"D3-PSA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Create Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Spawn Analysis"},"def_tech_label":{"type":"literal","value":"Process Lineage Analysis"},"def_tech_id":{"type":"literal","value":"D3-PLA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Spawn Analysis"},"def_tech_label":{"type":"literal","value":"Process Lineage Analysis"},"def_tech_id":{"type":"literal","value":"D3-PLA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Spawn Analysis"},"def_tech_label":{"type":"literal","value":"Process Lineage Analysis"},"def_tech_id":{"type":"literal","value":"D3-PLA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessLineageAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Analysis"},"def_tech_label":{"type":"literal","value":"Process Self-Modification Detection"},"def_tech_id":{"type":"literal","value":"D3-PSMD"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Analysis"},"def_tech_label":{"type":"literal","value":"Process Self-Modification Detection"},"def_tech_id":{"type":"literal","value":"D3-PSMD"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Analysis"},"def_tech_label":{"type":"literal","value":"Process Self-Modification Detection"},"def_tech_id":{"type":"literal","value":"D3-PSMD"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSelf-ModificationDetection"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Analysis"},"def_tech_label":{"type":"literal","value":"Process Spawn Analysis"},"def_tech_id":{"type":"literal","value":"D3-PSA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Analysis"},"def_tech_label":{"type":"literal","value":"Process Spawn Analysis"},"def_tech_id":{"type":"literal","value":"D3-PSA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Analysis"},"def_tech_label":{"type":"literal","value":"Process Spawn Analysis"},"def_tech_id":{"type":"literal","value":"D3-PSA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Defensive Technique"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_tech_id":{"type":"literal","value":"D3-FA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Defensive Technique"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_tech_id":{"type":"literal","value":"D3-FA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Operating System Monitoring"},"def_tech_label":{"type":"literal","value":"System Daemon Monitoring"},"def_tech_id":{"type":"literal","value":"D3-SDM"},"def_artifact_rel_label":{"type":"literal","value":"monitors"},"def_artifact_label":{"type":"literal","value":"Operating System Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Operating System Monitoring"},"def_tech_label":{"type":"literal","value":"System Daemon Monitoring"},"def_tech_id":{"type":"literal","value":"D3-SDM"},"def_artifact_rel_label":{"type":"literal","value":"monitors"},"def_artifact_label":{"type":"literal","value":"Operating System Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Defensive Technique"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_tech_id":{"type":"literal","value":"D3-FA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Operating System Monitoring"},"def_tech_label":{"type":"literal","value":"System Daemon Monitoring"},"def_tech_id":{"type":"literal","value":"D3-SDM"},"def_artifact_rel_label":{"type":"literal","value":"monitors"},"def_artifact_label":{"type":"literal","value":"Operating System Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemDaemonMonitoring"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OperatingSystemProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Eviction"},"def_tech_label":{"type":"literal","value":"Host Shutdown"},"def_tech_id":{"type":"literal","value":"D3-HS"},"def_artifact_rel_label":{"type":"literal","value":"terminates"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Execution Isolation"},"def_tech_label":{"type":"literal","value":"Kernel-based Process Isolation"},"def_tech_id":{"type":"literal","value":"D3-KBPI"},"def_artifact_rel_label":{"type":"literal","value":"isolates"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Execution Isolation"},"def_tech_label":{"type":"literal","value":"Kernel-based Process Isolation"},"def_tech_id":{"type":"literal","value":"D3-KBPI"},"def_artifact_rel_label":{"type":"literal","value":"isolates"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Execution Isolation"},"def_tech_label":{"type":"literal","value":"Kernel-based Process Isolation"},"def_tech_id":{"type":"literal","value":"D3-KBPI"},"def_artifact_rel_label":{"type":"literal","value":"isolates"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Kernel-basedProcessIsolation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Access Mediation"},"def_tech_label":{"type":"literal","value":"System Call Filtering"},"def_tech_id":{"type":"literal","value":"D3-SCF"},"def_artifact_rel_label":{"type":"literal","value":"isolates"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Access Mediation"},"def_tech_label":{"type":"literal","value":"System Call Filtering"},"def_tech_id":{"type":"literal","value":"D3-SCF"},"def_artifact_rel_label":{"type":"literal","value":"isolates"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Access Mediation"},"def_tech_label":{"type":"literal","value":"System Call Filtering"},"def_tech_id":{"type":"literal","value":"D3-SCF"},"def_artifact_rel_label":{"type":"literal","value":"isolates"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Execution Isolation"},"def_tech_label":{"type":"literal","value":"Hardware-based Process Isolation"},"def_tech_id":{"type":"literal","value":"D3-HBPI"},"def_artifact_rel_label":{"type":"literal","value":"isolates"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Execution Isolation"},"def_tech_label":{"type":"literal","value":"Hardware-based Process Isolation"},"def_tech_id":{"type":"literal","value":"D3-HBPI"},"def_artifact_rel_label":{"type":"literal","value":"isolates"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Execution Isolation"},"def_tech_label":{"type":"literal","value":"Hardware-based Process Isolation"},"def_tech_id":{"type":"literal","value":"D3-HBPI"},"def_artifact_rel_label":{"type":"literal","value":"isolates"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Eviction"},"def_tech_label":{"type":"literal","value":"Host Shutdown"},"def_tech_id":{"type":"literal","value":"D3-HS"},"def_artifact_rel_label":{"type":"literal","value":"terminates"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Execution Isolation"},"def_tech_label":{"type":"literal","value":"Application-based Process Isolation"},"def_tech_id":{"type":"literal","value":"D3-ABPI"},"def_artifact_rel_label":{"type":"literal","value":"isolates"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Execution Isolation"},"def_tech_label":{"type":"literal","value":"Application-based Process Isolation"},"def_tech_id":{"type":"literal","value":"D3-ABPI"},"def_artifact_rel_label":{"type":"literal","value":"isolates"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Execution Isolation"},"def_tech_label":{"type":"literal","value":"Application-based Process Isolation"},"def_tech_id":{"type":"literal","value":"D3-ABPI"},"def_artifact_rel_label":{"type":"literal","value":"isolates"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Application-basedProcessIsolation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Content Filtering"},"def_tech_label":{"type":"literal","value":"Content Modification"},"def_tech_id":{"type":"literal","value":"D3-CM"},"def_artifact_rel_label":{"type":"literal","value":"modifies"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Operating System Monitoring"},"def_tech_label":{"type":"literal","value":"Scheduled Job Analysis"},"def_tech_id":{"type":"literal","value":"D3-SJA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Job Schedule"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Job Schedule"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJobAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Platform Monitoring"},"def_tech_label":{"type":"literal","value":"File Integrity Monitoring"},"def_tech_id":{"type":"literal","value":"D3-FIM"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Platform Monitoring"},"def_tech_label":{"type":"literal","value":"File Integrity Monitoring"},"def_tech_id":{"type":"literal","value":"D3-FIM"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Platform Monitoring"},"def_tech_label":{"type":"literal","value":"File Integrity Monitoring"},"def_tech_id":{"type":"literal","value":"D3-FIM"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Analysis"},"def_tech_label":{"type":"literal","value":"Process Spawn Analysis"},"def_tech_id":{"type":"literal","value":"D3-PSA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Create Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Analysis"},"def_tech_label":{"type":"literal","value":"Process Spawn Analysis"},"def_tech_id":{"type":"literal","value":"D3-PSA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Create Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSpawnAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Defensive Technique"},"def_tech_label":{"type":"literal","value":"Content Filtering"},"def_tech_id":{"type":"literal","value":"D3-CF"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Defensive Technique"},"def_tech_label":{"type":"literal","value":"Content Filtering"},"def_tech_id":{"type":"literal","value":"D3-CF"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Restore"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Restore Object"},"def_tech_label":{"type":"literal","value":"Restore File"},"def_tech_id":{"type":"literal","value":"D3-RF"},"def_artifact_rel_label":{"type":"literal","value":"restores"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restores"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Restore"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Restore Object"},"def_tech_label":{"type":"literal","value":"Restore File"},"def_tech_id":{"type":"literal","value":"D3-RF"},"def_artifact_rel_label":{"type":"literal","value":"restores"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restores"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Decoy Object"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_tech_id":{"type":"literal","value":"D3-DF"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Decoy Object"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_tech_id":{"type":"literal","value":"D3-DF"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Object Eviction"},"def_tech_label":{"type":"literal","value":"File Eviction"},"def_tech_id":{"type":"literal","value":"D3-FEV"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Access Policy Administration"},"def_tech_label":{"type":"literal","value":"Local File Permissions"},"def_tech_id":{"type":"literal","value":"D3-LFP"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Access Policy Administration"},"def_tech_label":{"type":"literal","value":"Local File Permissions"},"def_tech_id":{"type":"literal","value":"D3-LFP"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Access Policy Administration"},"def_tech_label":{"type":"literal","value":"Local File Permissions"},"def_tech_id":{"type":"literal","value":"D3-LFP"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Object Eviction"},"def_tech_label":{"type":"literal","value":"File Eviction"},"def_tech_id":{"type":"literal","value":"D3-FEV"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Restore"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Restore Object"},"def_tech_label":{"type":"literal","value":"Restore File"},"def_tech_id":{"type":"literal","value":"D3-RF"},"def_artifact_rel_label":{"type":"literal","value":"restores"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restores"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Operating System Monitoring"},"def_tech_label":{"type":"literal","value":"Scheduled Job Analysis"},"def_tech_id":{"type":"literal","value":"D3-SJA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Job Schedule"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Job Schedule"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJobAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#JobSchedule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Eviction"},"def_tech_label":{"type":"literal","value":"Process Termination"},"def_tech_id":{"type":"literal","value":"D3-PT"},"def_artifact_rel_label":{"type":"literal","value":"terminates"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Eviction"},"def_tech_label":{"type":"literal","value":"Process Termination"},"def_tech_id":{"type":"literal","value":"D3-PT"},"def_artifact_rel_label":{"type":"literal","value":"terminates"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Eviction"},"def_tech_label":{"type":"literal","value":"Process Termination"},"def_tech_id":{"type":"literal","value":"D3-PT"},"def_artifact_rel_label":{"type":"literal","value":"terminates"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessTermination"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Object Eviction"},"def_tech_label":{"type":"literal","value":"File Eviction"},"def_tech_id":{"type":"literal","value":"D3-FEV"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Decoy Object"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_tech_id":{"type":"literal","value":"D3-DF"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Network Resource Access Mediation"},"def_tech_label":{"type":"literal","value":"Remote File Access Mediation"},"def_tech_id":{"type":"literal","value":"D3-RFAM"},"def_artifact_rel_label":{"type":"literal","value":"isolates"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Network Resource Access Mediation"},"def_tech_label":{"type":"literal","value":"Remote File Access Mediation"},"def_tech_id":{"type":"literal","value":"D3-RFAM"},"def_artifact_rel_label":{"type":"literal","value":"isolates"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Network Resource Access Mediation"},"def_tech_label":{"type":"literal","value":"Remote File Access Mediation"},"def_tech_id":{"type":"literal","value":"D3-RFAM"},"def_artifact_rel_label":{"type":"literal","value":"isolates"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Access Mediation"},"def_tech_label":{"type":"literal","value":"System Call Filtering"},"def_tech_id":{"type":"literal","value":"D3-SCF"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"System Call"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Eviction"},"def_tech_label":{"type":"literal","value":"Process Suspension"},"def_tech_id":{"type":"literal","value":"D3-PS"},"def_artifact_rel_label":{"type":"literal","value":"suspends"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Eviction"},"def_tech_label":{"type":"literal","value":"Process Suspension"},"def_tech_id":{"type":"literal","value":"D3-PS"},"def_artifact_rel_label":{"type":"literal","value":"suspends"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Eviction"},"def_tech_label":{"type":"literal","value":"Process Suspension"},"def_tech_id":{"type":"literal","value":"D3-PS"},"def_artifact_rel_label":{"type":"literal","value":"suspends"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessSuspension"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#suspends"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Access Mediation"},"def_tech_label":{"type":"literal","value":"System Call Filtering"},"def_tech_id":{"type":"literal","value":"D3-SCF"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"System Call"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Access Mediation"},"def_tech_label":{"type":"literal","value":"System Call Filtering"},"def_tech_id":{"type":"literal","value":"D3-SCF"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"System Call"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCallFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SystemCall"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Content Filtering"},"def_tech_label":{"type":"literal","value":"Content Quarantine"},"def_tech_id":{"type":"literal","value":"D3-CQ"},"def_artifact_rel_label":{"type":"literal","value":"quarantines"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Content Filtering"},"def_tech_label":{"type":"literal","value":"Content Quarantine"},"def_tech_id":{"type":"literal","value":"D3-CQ"},"def_artifact_rel_label":{"type":"literal","value":"quarantines"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Content Filtering"},"def_tech_label":{"type":"literal","value":"Content Quarantine"},"def_tech_id":{"type":"literal","value":"D3-CQ"},"def_artifact_rel_label":{"type":"literal","value":"quarantines"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Content Filtering"},"def_tech_label":{"type":"literal","value":"Content Modification"},"def_tech_id":{"type":"literal","value":"D3-CM"},"def_artifact_rel_label":{"type":"literal","value":"modifies"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Execution Isolation"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_tech_id":{"type":"literal","value":"D3-EAL"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Create Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Execution Isolation"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_tech_id":{"type":"literal","value":"D3-EAL"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Create Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Execution Isolation"},"def_tech_label":{"type":"literal","value":"Executable Allowlisting"},"def_tech_id":{"type":"literal","value":"D3-EAL"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Create Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableAllowlisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Host Shutdown"},"def_tech_label":{"type":"literal","value":"Host Reboot"},"def_tech_id":{"type":"literal","value":"D3-HR"},"def_artifact_rel_label":{"type":"literal","value":"terminates"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Platform Hardening"},"def_tech_label":{"type":"literal","value":"File Encryption"},"def_tech_id":{"type":"literal","value":"D3-FE"},"def_artifact_rel_label":{"type":"literal","value":"encrypts"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Execution Isolation"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_tech_id":{"type":"literal","value":"D3-EDL"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Create Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Execution Isolation"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_tech_id":{"type":"literal","value":"D3-EDL"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Create Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Execution Isolation"},"def_tech_label":{"type":"literal","value":"Executable Denylisting"},"def_tech_id":{"type":"literal","value":"D3-EDL"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Create Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutableDenylisting"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Host Shutdown"},"def_tech_label":{"type":"literal","value":"Host Reboot"},"def_tech_id":{"type":"literal","value":"D3-HR"},"def_artifact_rel_label":{"type":"literal","value":"terminates"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Host Shutdown"},"def_tech_label":{"type":"literal","value":"Host Reboot"},"def_tech_id":{"type":"literal","value":"D3-HR"},"def_artifact_rel_label":{"type":"literal","value":"terminates"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HostReboot"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Platform Hardening"},"def_tech_label":{"type":"literal","value":"File Encryption"},"def_tech_id":{"type":"literal","value":"D3-FE"},"def_artifact_rel_label":{"type":"literal","value":"encrypts"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Execution Isolation"},"def_tech_label":{"type":"literal","value":"Hardware-based Process Isolation"},"def_tech_id":{"type":"literal","value":"D3-HBPI"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Execution Isolation"},"def_tech_label":{"type":"literal","value":"Hardware-based Process Isolation"},"def_tech_id":{"type":"literal","value":"D3-HBPI"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Execution Isolation"},"def_tech_label":{"type":"literal","value":"Hardware-based Process Isolation"},"def_tech_id":{"type":"literal","value":"D3-HBPI"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"Create Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Hardware-basedProcessIsolation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Platform Hardening"},"def_tech_label":{"type":"literal","value":"File Encryption"},"def_tech_id":{"type":"literal","value":"D3-FE"},"def_artifact_rel_label":{"type":"literal","value":"encrypts"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Process Eviction"},"def_tech_label":{"type":"literal","value":"Host Shutdown"},"def_tech_id":{"type":"literal","value":"D3-HS"},"def_artifact_rel_label":{"type":"literal","value":"terminates"},"def_artifact_label":{"type":"literal","value":"Process"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Scheduled Job"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HostShutdown"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#terminates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Process"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ScheduledJob"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Create Process"},"off_artifact_rel_label":{"type":"literal","value":"invokes"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CreateProcess"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#invokes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Content Filtering"},"def_tech_label":{"type":"literal","value":"Content Modification"},"def_tech_id":{"type":"literal","value":"D3-CM"},"def_artifact_rel_label":{"type":"literal","value":"modifies"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Defensive Technique"},"def_tech_label":{"type":"literal","value":"Content Filtering"},"def_tech_id":{"type":"literal","value":"D3-CF"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Property List File"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Launchd"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PropertyListFile"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1053.004"},"off_tech_id":{"type":"literal","value":"T1053.004"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]}},"description":{"@context":{"rdfs":"http://www.w3.org/2000/01/rdf-schema#","owl":"http://www.w3.org/2002/07/owl#","d3f":"http://d3fend.mitre.org/ontologies/d3fend.owl#","skos":"http://www.w3.org/2004/02/skos/core#"},"@graph":[{"@id":"d3f:T1053.004","@type":["owl:NamedIndividual","owl:Class"],"d3f:attack-id":"T1053.004","d3f:creates":{"@id":"d3f:PropertyListFile"},"d3f:definition":"This technique is deprecated due to the inaccurate usage. The report cited did not provide technical detail as to how the malware interacted directly with launchd rather than going through known services. Other system services are used to interact with launchd rather than launchd being used by itself.","rdfs:comment":"This technique is deprecated due to the inaccurate usage. The report cited did not provide technical detail as to how the malware interacted directly with launchd rather than going through known services. Other system services are used to interact with launchd rather than launchd being used by itself.","rdfs:label":"Launchd","rdfs:subClassOf":{"@id":"d3f:T1053"},"owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}}]},"subtechniques":{"@context":{"rdfs":"http://www.w3.org/2000/01/rdf-schema#","owl":"http://www.w3.org/2002/07/owl#","d3f":"http://d3fend.mitre.org/ontologies/d3fend.owl#","skos":"http://www.w3.org/2004/02/skos/core#"},"@graph":[{"@id":"d3f:T1053","d3f:attack-id":["T1053"],"d3f:top-level":["true"],"rdfs:hasSubClass":[{"@id":"d3f:T1053.004"},{"@id":"d3f:T1053.005"},{"@id":"d3f:T1053.001"},{"@id":"d3f:T1053.007"},{"@id":"d3f:T1053.003"},{"@id":"d3f:T1053.006"},{"@id":"d3f:T1053.002"}],"rdfs:label":["Scheduled Task/Job"]},{"@id":"d3f:T1053.001","d3f:attack-id":["T1053.001"],"rdfs:label":["At (Linux) Execution"],"rdfs:subClassOf":[{"@id":"d3f:T1053"}]},{"@id":"d3f:T1053.002","d3f:attack-id":["T1053.002"],"rdfs:label":["At"],"rdfs:subClassOf":[{"@id":"d3f:T1053"}]},{"@id":"d3f:T1053.003","d3f:attack-id":["T1053.003"],"rdfs:label":["Cron"],"rdfs:subClassOf":[{"@id":"d3f:T1053"}]},{"@id":"d3f:T1053.004","d3f:attack-id":["T1053.004"],"rdfs:label":["Launchd"],"rdfs:subClassOf":[{"@id":"d3f:T1053"}]},{"@id":"d3f:T1053.005","d3f:attack-id":["T1053.005"],"rdfs:label":["Scheduled Task"],"rdfs:subClassOf":[{"@id":"d3f:T1053"}]},{"@id":"d3f:T1053.006","d3f:attack-id":["T1053.006"],"rdfs:label":["Systemd Timers"],"rdfs:subClassOf":[{"@id":"d3f:T1053"}]},{"@id":"d3f:T1053.007","d3f:attack-id":["T1053.007"],"rdfs:label":["Container Orchestration Job"],"rdfs:subClassOf":[{"@id":"d3f:T1053"}]}]},"framework":{"framework_key":"enterprise","framework_label":"Enterprise","framework_root":"d3f:ATTACKEnterpriseTechnique","label_key":"rdfs:label"}}