{"off_to_def":{"head":{"vars":["def_tactic_label","def_tactic_rel_label","def_tech_parent_is_toplevel","def_tech_parent_label","def_tech_label","def_tech_id","def_artifact_rel_label","def_artifact_label","sc","off_artifact_label","off_artifact_rel_label","off_tech_label","framework_root_iri","off_tactic_rel_label","off_tactic_label","def_tactic","def_tactic_rel","def_tech","def_artifact_rel","def_artifact","off_artifact","off_artifact_rel","off_tech","off_tech_id","off_tactic_rel","off_tactic"]},"results":{"bindings":[{"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"File Eviction"},"def_tech_label":{"type":"literal","value":"Email Removal"},"def_tech_id":{"type":"literal","value":"D3-ER"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"Email"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmailRemoval"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_id":{"type":"literal","value":"T1114.001"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Evict"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Object Eviction"},"def_tech_label":{"type":"literal","value":"File Eviction"},"def_tech_id":{"type":"literal","value":"D3-FEV"},"def_artifact_rel_label":{"type":"literal","value":"deletes"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Evict"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileEviction"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#deletes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_id":{"type":"literal","value":"T1114.001"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Identifier Analysis"},"def_tech_label":{"type":"literal","value":"Homoglyph Detection"},"def_tech_id":{"type":"literal","value":"D3-HD"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Email"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HomoglyphDetection"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_id":{"type":"literal","value":"T1114.001"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Restore"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Restore Object"},"def_tech_label":{"type":"literal","value":"Restore File"},"def_tech_id":{"type":"literal","value":"D3-RF"},"def_artifact_rel_label":{"type":"literal","value":"restores"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restores"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_id":{"type":"literal","value":"T1114.001"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Message Analysis"},"def_tech_label":{"type":"literal","value":"Sender MTA Reputation Analysis"},"def_tech_id":{"type":"literal","value":"D3-SMRA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Email"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SenderMTAReputationAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_id":{"type":"literal","value":"T1114.001"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Message Analysis"},"def_tech_label":{"type":"literal","value":"Sender Reputation Analysis"},"def_tech_id":{"type":"literal","value":"D3-SRA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Email"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SenderReputationAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_id":{"type":"literal","value":"T1114.001"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Resource"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Resource"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_id":{"type":"literal","value":"T1114.001"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Restore"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Restore File"},"def_tech_label":{"type":"literal","value":"Restore Email"},"def_tech_id":{"type":"literal","value":"D3-RE"},"def_artifact_rel_label":{"type":"literal","value":"restores"},"def_artifact_label":{"type":"literal","value":"Email"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreEmail"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restores"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_id":{"type":"literal","value":"T1114.001"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Asset Inventory"},"def_tech_label":{"type":"literal","value":"Data Inventory"},"def_tech_id":{"type":"literal","value":"D3-DI"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Document File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DataInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_id":{"type":"literal","value":"T1114.001"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Defensive Technique"},"def_tech_label":{"type":"literal","value":"File Analysis"},"def_tech_id":{"type":"literal","value":"D3-FA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_id":{"type":"literal","value":"T1114.001"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Platform Monitoring"},"def_tech_label":{"type":"literal","value":"File Integrity Monitoring"},"def_tech_id":{"type":"literal","value":"D3-FIM"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileIntegrityMonitoring"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_id":{"type":"literal","value":"T1114.001"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"File Analysis"},"def_tech_label":{"type":"literal","value":"Dynamic Analysis"},"def_tech_id":{"type":"literal","value":"D3-DA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Document File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DynamicAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_id":{"type":"literal","value":"T1114.001"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"File Analysis"},"def_tech_label":{"type":"literal","value":"Emulated File Analysis"},"def_tech_id":{"type":"literal","value":"D3-EFA"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Document File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmulatedFileAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DocumentFile"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_id":{"type":"literal","value":"T1114.001"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_id":{"type":"literal","value":"T1114.001"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Defensive Technique"},"def_tech_label":{"type":"literal","value":"Content Filtering"},"def_tech_id":{"type":"literal","value":"D3-CF"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContentFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_id":{"type":"literal","value":"T1114.001"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Access Policy Administration"},"def_tech_label":{"type":"literal","value":"Local File Permissions"},"def_tech_id":{"type":"literal","value":"D3-LFP"},"def_artifact_rel_label":{"type":"literal","value":"restricts"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LocalFilePermissions"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restricts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_id":{"type":"literal","value":"T1114.001"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Network Resource Access Mediation"},"def_tech_label":{"type":"literal","value":"Remote File Access Mediation"},"def_tech_id":{"type":"literal","value":"D3-RFAM"},"def_artifact_rel_label":{"type":"literal","value":"isolates"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemoteFileAccessMediation"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#isolates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_id":{"type":"literal","value":"T1114.001"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Content Filtering"},"def_tech_label":{"type":"literal","value":"Content Quarantine"},"def_tech_id":{"type":"literal","value":"D3-CQ"},"def_artifact_rel_label":{"type":"literal","value":"quarantines"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContentQuarantine"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#quarantines"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_id":{"type":"literal","value":"T1114.001"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Content Filtering"},"def_tech_label":{"type":"literal","value":"Content Modification"},"def_tech_id":{"type":"literal","value":"D3-CM"},"def_artifact_rel_label":{"type":"literal","value":"modifies"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ContentModification"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_id":{"type":"literal","value":"T1114.001"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Deceive"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Decoy Object"},"def_tech_label":{"type":"literal","value":"Decoy File"},"def_tech_id":{"type":"literal","value":"D3-DF"},"def_artifact_rel_label":{"type":"literal","value":"spoofs"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Deceive"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DecoyFile"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#spoofs"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_id":{"type":"literal","value":"T1114.001"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Platform Hardening"},"def_tech_label":{"type":"literal","value":"File Encryption"},"def_tech_id":{"type":"literal","value":"D3-FE"},"def_artifact_rel_label":{"type":"literal","value":"encrypts"},"def_artifact_label":{"type":"literal","value":"File"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FileEncryption"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#encrypts"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#File"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_id":{"type":"literal","value":"T1114.001"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Isolate"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Inbound Traffic Filtering"},"def_tech_label":{"type":"literal","value":"Email Filtering"},"def_tech_id":{"type":"literal","value":"D3-EF"},"def_artifact_rel_label":{"type":"literal","value":"filters"},"def_artifact_label":{"type":"literal","value":"Email"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Email"},"off_artifact_rel_label":{"type":"literal","value":"reads"},"off_tech_label":{"type":"literal","value":"Local Email Collection"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Isolate"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EmailFiltering"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#filters"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Email"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#reads"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1114.001"},"off_tech_id":{"type":"literal","value":"T1114.001"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]}},"description":{"@context":{"rdfs":"http://www.w3.org/2000/01/rdf-schema#","owl":"http://www.w3.org/2002/07/owl#","d3f":"http://d3fend.mitre.org/ontologies/d3fend.owl#","skos":"http://www.w3.org/2004/02/skos/core#"},"@graph":[{"@id":"d3f:T1114.001","@type":["owl:NamedIndividual","owl:Class"],"d3f:attack-id":"T1114.001","d3f:definition":"Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files.","d3f:reads":{"@id":"d3f:Email"},"rdfs:label":"Local Email Collection","rdfs:subClassOf":{"@id":"d3f:T1114"}}]},"subtechniques":{"@context":{"rdfs":"http://www.w3.org/2000/01/rdf-schema#","owl":"http://www.w3.org/2002/07/owl#","d3f":"http://d3fend.mitre.org/ontologies/d3fend.owl#","skos":"http://www.w3.org/2004/02/skos/core#"},"@graph":[{"@id":"d3f:T1114","d3f:attack-id":["T1114"],"d3f:top-level":["true"],"rdfs:hasSubClass":[{"@id":"d3f:T1114.002"},{"@id":"d3f:T1114.003"},{"@id":"d3f:T1114.001"}],"rdfs:label":["Email Collection"]},{"@id":"d3f:T1114.001","d3f:attack-id":["T1114.001"],"rdfs:label":["Local Email Collection"],"rdfs:subClassOf":[{"@id":"d3f:T1114"}]},{"@id":"d3f:T1114.002","d3f:attack-id":["T1114.002"],"rdfs:label":["Remote Email Collection"],"rdfs:subClassOf":[{"@id":"d3f:T1114"}]},{"@id":"d3f:T1114.003","d3f:attack-id":["T1114.003"],"rdfs:label":["Email Forwarding Rule"],"rdfs:subClassOf":[{"@id":"d3f:T1114"}]}]},"framework":{"framework_key":"enterprise","framework_label":"Enterprise","framework_root":"d3f:ATTACKEnterpriseTechnique","label_key":"rdfs:label"}}