{"off_to_def":{"head":{"vars":["def_tactic_label","def_tactic_rel_label","def_tech_parent_is_toplevel","def_tech_parent_label","def_tech_label","def_tech_id","def_artifact_rel_label","def_artifact_label","sc","off_artifact_label","off_artifact_rel_label","off_tech_label","framework_root_iri","off_tactic_rel_label","off_tactic_label","def_tactic","def_tactic_rel","def_tech","def_artifact_rel","def_artifact","off_artifact","off_artifact_rel","off_tech","off_tech_id","off_tactic_rel","off_tactic"]},"results":{"bindings":[{"def_tactic_label":{"type":"literal","value":"Restore"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Restore Object"},"def_tech_label":{"type":"literal","value":"Restore Software"},"def_tech_id":{"type":"literal","value":"D3-RS"},"def_artifact_rel_label":{"type":"literal","value":"restores"},"def_artifact_label":{"type":"literal","value":"Software"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Stealth"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restores"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_id":{"type":"literal","value":"T1574.010"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Stealth"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_id":{"type":"literal","value":"T1574.010"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Asset Inventory"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_tech_id":{"type":"literal","value":"D3-SWI"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Stealth"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_id":{"type":"literal","value":"T1574.010"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"System File Analysis"},"def_tech_label":{"type":"literal","value":"Service Binary Verification"},"def_tech_id":{"type":"literal","value":"D3-SBV"},"def_artifact_rel_label":{"type":"literal","value":"verifies"},"def_artifact_label":{"type":"literal","value":"Service Application"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Stealth"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_id":{"type":"literal","value":"T1574.010"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Asset Inventory"},"def_tech_label":{"type":"literal","value":"Software Inventory"},"def_tech_id":{"type":"literal","value":"D3-SWI"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Software"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_id":{"type":"literal","value":"T1574.010"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"System File Analysis"},"def_tech_label":{"type":"literal","value":"Service Binary Verification"},"def_tech_id":{"type":"literal","value":"D3-SBV"},"def_artifact_rel_label":{"type":"literal","value":"verifies"},"def_artifact_label":{"type":"literal","value":"Service Application"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceBinaryVerification"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#verifies"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_id":{"type":"literal","value":"T1574.010"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Asset Inventory"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_tech_id":{"type":"literal","value":"D3-AVE"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_id":{"type":"literal","value":"T1574.010"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Platform Hardening"},"def_tech_label":{"type":"literal","value":"Software Update"},"def_tech_id":{"type":"literal","value":"D3-SU"},"def_artifact_rel_label":{"type":"literal","value":"updates"},"def_artifact_label":{"type":"literal","value":"Software"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Stealth"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#updates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_id":{"type":"literal","value":"T1574.010"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Harden"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Platform Hardening"},"def_tech_label":{"type":"literal","value":"Software Update"},"def_tech_id":{"type":"literal","value":"D3-SU"},"def_artifact_rel_label":{"type":"literal","value":"updates"},"def_artifact_label":{"type":"literal","value":"Software"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Harden"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SoftwareUpdate"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#updates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_id":{"type":"literal","value":"T1574.010"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Restore"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Restore Object"},"def_tech_label":{"type":"literal","value":"Restore Software"},"def_tech_id":{"type":"literal","value":"D3-RS"},"def_artifact_rel_label":{"type":"literal","value":"restores"},"def_artifact_label":{"type":"literal","value":"Software"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Restore"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RestoreSoftware"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#restores"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_id":{"type":"literal","value":"T1574.010"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_id":{"type":"literal","value":"T1574.010"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"def_tech_parent_label":{"type":"literal","value":"Asset Inventory"},"def_tech_label":{"type":"literal","value":"Asset Vulnerability Enumeration"},"def_tech_id":{"type":"literal","value":"D3-AVE"},"def_artifact_rel_label":{"type":"literal","value":"evaluates"},"def_artifact_label":{"type":"literal","value":"Software"},"sc":{"type":"literal","value":"-<-"},"off_artifact_label":{"type":"literal","value":"Service Application"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Services File Permissions Weakness"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Stealth"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AssetVulnerabilityEnumeration"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#evaluates"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ServiceApplication"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1574.010"},"off_tech_id":{"type":"literal","value":"T1574.010"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]}},"description":{"@context":{"rdfs":"http://www.w3.org/2000/01/rdf-schema#","owl":"http://www.w3.org/2002/07/owl#","d3f":"http://d3fend.mitre.org/ontologies/d3fend.owl#","skos":"http://www.w3.org/2004/02/skos/core#"},"@graph":[{"@id":"d3f:T1574.010","@type":["owl:NamedIndividual","owl:Class"],"d3f:attack-id":"T1574.010","d3f:definition":"Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.","d3f:modifies":{"@id":"d3f:ServiceApplication"},"rdfs:label":"Services File Permissions Weakness","rdfs:subClassOf":{"@id":"d3f:T1574"},"skos:altLabel":"Service Registry Permissions Weakness"}]},"subtechniques":{"@context":{"rdfs":"http://www.w3.org/2000/01/rdf-schema#","owl":"http://www.w3.org/2002/07/owl#","d3f":"http://d3fend.mitre.org/ontologies/d3fend.owl#","skos":"http://www.w3.org/2004/02/skos/core#"},"@graph":[{"@id":"d3f:T1574","d3f:attack-id":["T1574"],"d3f:top-level":["true"],"rdfs:hasSubClass":[{"@id":"d3f:T1574.014"},{"@id":"d3f:T1574.002"},{"@id":"d3f:T1574.004"},{"@id":"d3f:T1574.013"},{"@id":"d3f:T1574.012"},{"@id":"d3f:T1574.011"},{"@id":"d3f:T1574.009"},{"@id":"d3f:T1574.001"},{"@id":"d3f:T1574.007"},{"@id":"d3f:T1574.010"},{"@id":"d3f:T1574.006"},{"@id":"d3f:T1574.005"},{"@id":"d3f:T1574.008"}],"rdfs:label":["Hijack Execution Flow"]},{"@id":"d3f:T1574.001","d3f:attack-id":["T1574.001"],"rdfs:label":["DLL"],"rdfs:subClassOf":[{"@id":"d3f:T1574"}]},{"@id":"d3f:T1574.002","d3f:attack-id":["T1574.002"],"rdfs:label":["DLL Side-Loading"],"rdfs:subClassOf":[{"@id":"d3f:T1574"}]},{"@id":"d3f:T1574.004","d3f:attack-id":["T1574.004"],"rdfs:label":["Dylib Hijacking"],"rdfs:subClassOf":[{"@id":"d3f:T1574"}]},{"@id":"d3f:T1574.005","d3f:attack-id":["T1574.005"],"rdfs:label":["Executable Installer File Permissions Weakness"],"rdfs:subClassOf":[{"@id":"d3f:T1574"}]},{"@id":"d3f:T1574.006","d3f:attack-id":["T1574.006"],"rdfs:label":["Dynamic Linker Hijacking"],"rdfs:subClassOf":[{"@id":"d3f:T1574"}]},{"@id":"d3f:T1574.007","d3f:attack-id":["T1574.007"],"rdfs:label":["Path Interception by PATH Environment Variable"],"rdfs:subClassOf":[{"@id":"d3f:T1574"}]},{"@id":"d3f:T1574.008","d3f:attack-id":["T1574.008"],"rdfs:label":["Path Interception by Search Order Hijacking"],"rdfs:subClassOf":[{"@id":"d3f:T1574"}]},{"@id":"d3f:T1574.009","d3f:attack-id":["T1574.009"],"rdfs:label":["Path Interception by Unquoted Path"],"rdfs:subClassOf":[{"@id":"d3f:T1574"}]},{"@id":"d3f:T1574.010","d3f:attack-id":["T1574.010"],"rdfs:label":["Services File Permissions Weakness"],"rdfs:subClassOf":[{"@id":"d3f:T1574"}]},{"@id":"d3f:T1574.011","d3f:attack-id":["T1574.011"],"rdfs:label":["Services Registry Permissions Weakness"],"rdfs:subClassOf":[{"@id":"d3f:T1574"}]},{"@id":"d3f:T1574.012","d3f:attack-id":["T1574.012"],"rdfs:label":["COR_PROFILER"],"rdfs:subClassOf":[{"@id":"d3f:T1574"}]},{"@id":"d3f:T1574.013","d3f:attack-id":["T1574.013"],"rdfs:label":["KernelCallbackTable"],"rdfs:subClassOf":[{"@id":"d3f:T1574"}]},{"@id":"d3f:T1574.014","d3f:attack-id":["T1574.014"],"rdfs:label":["AppDomainManager"],"rdfs:subClassOf":[{"@id":"d3f:T1574"}]}]},"framework":{"framework_key":"enterprise","framework_label":"Enterprise","framework_root":"d3f:ATTACKEnterpriseTechnique","label_key":"rdfs:label"}}