{"off_tactics":{"@context":{"rdfs":"http://www.w3.org/2000/01/rdf-schema#","owl":"http://www.w3.org/2002/07/owl#","d3f":"http://d3fend.mitre.org/ontologies/d3fend.owl#","skos":"http://www.w3.org/2004/02/skos/core#"},"@graph":[{"@id":"d3f:AML.TA0000","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0000","d3f:definition":"The adversary is attempting to gain some level of access to an AI model.\n\nAI Model Access enables techniques that use various types of access to the AI model that can be used by the adversary to gain information, develop attacks, and as a means to input data to the model.\nThe level of access can range from the full knowledge of the internals of the model to access to the physical environment where data is collected for use in the AI model.\nThe adversary may use varying levels of model access during the course of their attack, from staging the attack to impacting the target system.\n\nAccess to an AI model may require access to the system housing the model, the model may be publicly accessible via an API, or it may be accessed indirectly via interaction with a product or service that utilizes AI as part of its processes.","rdfs:label":"AI Model Access - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0000"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"AI Model Access"},{"@id":"d3f:AML.TA0001","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0001","d3f:definition":"The adversary is leveraging their knowledge of and access to the target system to tailor the attack.\n\nAI Attack Staging consists of techniques adversaries use to prepare their attack on the target AI model.\nTechniques can include training proxy models, poisoning the target model, and crafting adversarial data to feed the target model.\nSome of these techniques can be performed in an offline manner and are thus difficult to mitigate.\nThese techniques are often used to achieve the adversary's end goal.","rdfs:label":"AI Attack Staging - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0001"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"AI Attack Staging"},{"@id":"d3f:AML.TA0002","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0002","d3f:definition":"The adversary is trying to gather information about the AI system they can use to plan future operations.\n\nReconnaissance consists of techniques that involve adversaries actively or passively gathering information that can be used to support targeting.\nSuch information may include details of the victim organizations' AI capabilities and research efforts.\nThis information can be leveraged by the adversary to aid in other phases of the adversary lifecycle, such as using gathered information to obtain relevant AI artifacts, targeting AI capabilities used by the victim, tailoring attacks to the particular models used by the victim, or to drive and lead further Reconnaissance efforts.","rdfs:label":"Reconnaissance - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0002"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Reconnaissance"},{"@id":"d3f:AML.TA0003","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0003","d3f:definition":"The adversary is trying to establish resources they can use to support operations.\n\nResource Development consists of techniques that involve adversaries creating,\npurchasing, or compromising/stealing resources that can be used to support targeting.\nSuch resources include AI artifacts, infrastructure, accounts, or capabilities.\nThese resources can be leveraged by the adversary to aid in other phases of the adversary lifecycle, such as [AI Attack Staging](/tactics/AML.TA0001).","rdfs:label":"Resource Development - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0003"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Resource Development"},{"@id":"d3f:AML.TA0004","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0004","d3f:definition":"The adversary is trying to gain access to the AI system.\n\nThe target system could be a network, mobile device, or an edge device such as a sensor platform.\nThe AI capabilities used by the system could be local with onboard or cloud-enabled AI capabilities.\n\nInitial Access consists of techniques that use various entry vectors to gain their initial foothold within the system.","rdfs:label":"Initial Access - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0004"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Initial Access"},{"@id":"d3f:AML.TA0005","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0005","d3f:definition":"The adversary is trying to run malicious code embedded in AI artifacts or software.\n\nExecution consists of techniques that result in adversary-controlled code running on a local or remote system.\nTechniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data.\nFor example, an adversary might use a remote access tool to run a PowerShell script that does [Remote System Discovery](https://attack.mitre.org/techniques/T1018/).","rdfs:label":"Execution - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0005"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Execution"},{"@id":"d3f:AML.TA0006","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0006","d3f:definition":"The adversary is trying to maintain their foothold via AI artifacts or software.\n\nPersistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access.\nTechniques used for persistence often involve leaving behind modified ML artifacts such as poisoned training data or manipulated AI models.","rdfs:label":"Persistence - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0006"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Persistence"},{"@id":"d3f:AML.TA0007","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0007","d3f:definition":"The adversary is trying to avoid being detected by AI-enabled security software.\n\nDefense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise.\nTechniques used for defense evasion include evading AI-enabled security software such as malware detectors.","rdfs:label":"Defense Evasion - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0007"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Defense Evasion"},{"@id":"d3f:AML.TA0008","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0008","d3f:definition":"The adversary is trying to figure out your AI environment.\n\nDiscovery consists of techniques an adversary may use to gain knowledge about the system and internal network.\nThese techniques help adversaries observe the environment and orient themselves before deciding how to act.\nThey also allow adversaries to explore what they can control and what's around their entry point in order to discover how it could benefit their current objective.\nNative operating system tools are often used toward this post-compromise information-gathering objective.","rdfs:label":"Discovery - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0008"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Discovery"},{"@id":"d3f:AML.TA0009","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0009","d3f:definition":"The adversary is trying to gather AI artifacts and other related information relevant to their goal.\n\nCollection consists of techniques adversaries may use to gather information and the sources information is collected from that are relevant to following through on the adversary's objectives.\nFrequently, the next goal after collecting data is to steal (exfiltrate) the AI artifacts, or use the collected information to stage future operations.\nCommon target sources include software repositories, container registries, model repositories, and object stores.","rdfs:label":"Collection - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0009"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Collection"},{"@id":"d3f:AML.TA0010","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0010","d3f:definition":"The adversary is trying to steal AI artifacts or other information about the AI system.\n\nExfiltration consists of techniques that adversaries may use to steal data from your network.\nData may be stolen for its valuable intellectual property, or for use in staging future operations.\n\nTechniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission.","rdfs:label":"Exfiltration - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0010"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Exfiltration"},{"@id":"d3f:AML.TA0011","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0011","d3f:definition":"The adversary is trying to manipulate, interrupt, erode confidence in, or destroy your AI systems and data.\n\nImpact consists of techniques that adversaries use to disrupt availability or compromise integrity by manipulating business and operational processes.\nTechniques used for impact can include destroying or tampering with data.\nIn some cases, business processes can look fine, but may have been altered to benefit the adversaries' goals.\nThese techniques might be used by adversaries to follow through on their end goal or to provide cover for a confidentiality breach.","rdfs:label":"Impact - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0011"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Impact"},{"@id":"d3f:AML.TA0012","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0012","d3f:definition":"The adversary is trying to gain higher-level permissions.\n\nPrivilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include:\n- SYSTEM/root level\n- local administrator\n- user account with admin-like access\n- user accounts with access to specific system or perform specific function\n\nThese techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.","rdfs:label":"Privilege Escalation - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0012"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Privilege Escalation"},{"@id":"d3f:AML.TA0013","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0013","d3f:definition":"The adversary is trying to steal account names and passwords.\n\nCredential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.","rdfs:label":"Credential Access - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0013"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Credential Access"},{"@id":"d3f:AML.TA0014","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0014","d3f:definition":"The adversary is trying to communicate with compromised AI systems to control them.\n\nCommand and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim's network structure and defenses.","rdfs:label":"Command and Control - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0014"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Command and Control"},{"@id":"d3f:AML.TA0015","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0015","d3f:definition":"The adversary is trying to move through your AI environment.\n\nLateral Movement consists of techniques that adversaries may use to gain access to and control other systems or components in the environment. Adversaries may pivot towards AI Ops infrastructure such as model registries, experiment trackers, vector databases, notebooks, or training pipelines. As the adversary moves through the environment, they may discover means of accessing additional AI-related tools, services, or applications. AI agents may also be a valuable target as they commonly have more permissions than standard user accounts on the system.","rdfs:label":"Lateral Movement - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0015"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Lateral Movement"},{"@id":"d3f:ST0001","@type":["owl:NamedIndividual","d3f:SPARTATactic","owl:Class"],"d3f:definition":"Threat actor is trying to gather information they can use to plan future operations.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"1"},"rdfs:label":"Reconnaissance - SPARTA","rdfs:seeAlso":{"@id":"https://sparta.aerospace.org/tactic/ST0001"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:SPARTATactic"}],"skos:prefLabel":"Reconnaissance"},{"@id":"d3f:ST0002","@type":["owl:NamedIndividual","d3f:SPARTATactic","owl:Class"],"d3f:definition":"Threat actor is trying to establish resources they can use to support operations.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"2"},"rdfs:label":"Resource Development - SPARTA","rdfs:seeAlso":{"@id":"https://sparta.aerospace.org/tactic/ST0002"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:SPARTATactic"}],"skos:prefLabel":"Resource Development"},{"@id":"d3f:ST0003","@type":["owl:NamedIndividual","d3f:SPARTATactic","owl:Class"],"d3f:definition":"Threat actor is trying to get point of presence/command execution on the spacecraft.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"3"},"rdfs:label":"Initial Access - SPARTA","rdfs:seeAlso":{"@id":"https://sparta.aerospace.org/tactic/ST0003"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:SPARTATactic"}],"skos:prefLabel":"Initial Access"},{"@id":"d3f:ST0004","@type":["owl:NamedIndividual","d3f:SPARTATactic","owl:Class"],"d3f:definition":"Threat actor is trying to execute malicious code on the spacecraft.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"4"},"rdfs:label":"Execution - SPARTA","rdfs:seeAlso":{"@id":"https://sparta.aerospace.org/tactic/ST0004"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:SPARTATactic"}],"skos:prefLabel":"Execution"},{"@id":"d3f:ST0005","@type":["owl:NamedIndividual","d3f:SPARTATactic","owl:Class"],"d3f:definition":"Threat actor is trying to maintain their foothold/access to command/execute code on the spacecraft.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"5"},"rdfs:label":"Persistence - SPARTA","rdfs:seeAlso":{"@id":"https://sparta.aerospace.org/tactic/ST0005"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:SPARTATactic"}],"skos:prefLabel":"Persistence"},{"@id":"d3f:ST0006","@type":["owl:NamedIndividual","d3f:SPARTATactic","owl:Class"],"d3f:definition":"Threat actor is trying to avoid being detected.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"6"},"rdfs:label":"Defense Evasion - SPARTA","rdfs:seeAlso":{"@id":"https://sparta.aerospace.org/tactic/ST0006"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:SPARTATactic"}],"skos:prefLabel":"Defense Evasion"},{"@id":"d3f:ST0007","@type":["owl:NamedIndividual","d3f:SPARTATactic","owl:Class"],"d3f:definition":"Threat actor is trying to move through across sub-systems of the spacecraft.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"7"},"rdfs:label":"Lateral Movement - SPARTA","rdfs:seeAlso":{"@id":"https://sparta.aerospace.org/tactic/ST0007"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:SPARTATactic"}],"skos:prefLabel":"Lateral Movement"},{"@id":"d3f:ST0008","@type":["owl:NamedIndividual","d3f:SPARTATactic","owl:Class"],"d3f:definition":"Threat actor is trying to steal information.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"8"},"rdfs:label":"Exfiltration - SPARTA","rdfs:seeAlso":{"@id":"https://sparta.aerospace.org/tactic/ST0008"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:SPARTATactic"}],"skos:prefLabel":"Exfiltration"},{"@id":"d3f:ST0009","@type":["owl:NamedIndividual","d3f:SPARTATactic","owl:Class"],"d3f:definition":"Threat actor is trying to manipulate, interrupt, or destroy the space system(s) and/or data.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"9"},"rdfs:label":"Impact - SPARTA","rdfs:seeAlso":{"@id":"https://sparta.aerospace.org/tactic/ST0009"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:SPARTATactic"}],"skos:prefLabel":"Impact"},{"@id":"d3f:TA0001","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to get into your network.\n\nInitial Access consists of techniques that use various entry vectors to gain their initial foothold within a network. Techniques used to gain a foothold include targeted spearphishing and exploiting weaknesses on public-facing web servers. Footholds gained through initial access may allow for continued access, like valid accounts and use of external remote services, or may be limited-use due to changing passwords.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"1"},"rdfs:label":"Initial Access","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0002","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to run malicious code.\n\nExecution consists of techniques that result in adversary-controlled code running on a local or remote system. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data. For example, an adversary might use a remote access tool to run a PowerShell script that does Remote System Discovery.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"2"},"rdfs:label":"Execution","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0003","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to maintain their foothold.\n\nPersistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"3"},"rdfs:label":"Persistence","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0004","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to gain higher-level permissions.\n\nPrivilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include:\n\n* SYSTEM/root level\n* local administrator\n* user account with admin-like access\n* user accounts with access to specific system or perform specific function\n\nThese techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"4"},"rdfs:label":"Privilege Escalation","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0005","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to hide and conceal their actions, appearing as normal behavior.\n\nStealth consists of techniques that reduce the likelihood of detection by blending in with legitimate activity or minimizing observable signals. These techniques are characterized by concealment behaviors, such as avoiding, obfuscating, or mimicking normal operations, without modifying security controls or compromising collection and monitoring feeds. The goal is to remain indistinguishable from benign activity while leaving defensive systems intact.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"5"},"rdfs:label":"Stealth","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0006","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to steal account names and passwords.\n\nCredential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"7"},"rdfs:label":"Credential Access","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0007","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to figure out your environment.\n\nDiscovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what’s around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"8"},"rdfs:label":"Discovery","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0008","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to move through your environment.\n\nLateral Movement consists of techniques that adversaries use to enter and control remote systems on a network. Following through on their primary objective often requires exploring the network to find their target, then pivoting through multiple systems and accounts to gain access to it. Adversaries might install their own remote access tools to accomplish Lateral Movement or use legitimate credentials with native network and operating system tools, which may be stealthier.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"9"},"rdfs:label":"Lateral Movement","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0009","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to gather data of interest to their goal.\n\nCollection consists of techniques adversaries may use to gather information and the sources information is collected from that are relevant to following through on the adversary's objectives. Frequently, the next goal after collecting data is to either steal (exfiltrate) the data or to use the data to gain more information about the target environment. Common target sources include various drive types, browsers, audio, video, and email. Common collection methods include capturing screenshots and keyboard input.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"10"},"rdfs:label":"Collection","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0010","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to steal data.\n\nExfiltration consists of techniques that adversaries may use to steal data from your network. Once they’ve collected data, adversaries often package it to avoid detection while removing it. This can include compression and encryption. Techniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"12"},"rdfs:label":"Exfiltration","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0011","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to communicate with compromised systems to control them.\n\nCommand and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim’s network structure and defenses.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"11"},"rdfs:label":"Command and Control","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0027","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Initial Access - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}],"skos:prefLabel":"Initial Access"},{"@id":"d3f:TA0028","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Persistence - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}],"skos:prefLabel":"Persistence"},{"@id":"d3f:TA0029","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Privilege Escalation - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}],"skos:prefLabel":"Privilege Escalation"},{"@id":"d3f:TA0030","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Defense Evasion - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}],"skos:prefLabel":"Defense Evasion"},{"@id":"d3f:TA0031","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Credential Access - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}],"skos:prefLabel":"Credential Access"},{"@id":"d3f:TA0032","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Discovery - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}],"skos:prefLabel":"Discovery"},{"@id":"d3f:TA0033","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Lateral Movement - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}],"skos:prefLabel":"Lateral Movement"},{"@id":"d3f:TA0034","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Impact - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}],"skos:prefLabel":"Impact"},{"@id":"d3f:TA0035","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Collection - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}],"skos:prefLabel":"Collection"},{"@id":"d3f:TA0036","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Exfiltration - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}],"skos:prefLabel":"Exfiltration"},{"@id":"d3f:TA0037","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Command and Control - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}],"skos:prefLabel":"Command and Control"},{"@id":"d3f:TA0040","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to manipulate, interrupt, or destroy your systems and data.\n\nImpact consists of techniques that adversaries use to disrupt availability or compromise integrity by manipulating business and operational processes. Techniques used for impact can include destroying or tampering with data. In some cases, business processes can look fine, but may have been altered to benefit the adversaries’ goals. These techniques might be used by adversaries to follow through on their end goal or to provide cover for a confidentiality breach.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"13"},"rdfs:label":"Impact","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0041","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Execution - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}]},{"@id":"d3f:TA0042","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to establish resources they can use to support operations.\n\nResource Development consists of techniques that involve adversaries creating, purchasing, or compromising/stealing resources that can be used to support targeting. Such resources include infrastructure, accounts, or capabilities. These resources can be leveraged by the adversary to aid in other phases of the adversary lifecycle, such as using purchased domains to support Command and Control, email accounts for phishing as a part of Initial Access, or stealing code signing certificates to help with Defense Evasion.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"0"},"rdfs:label":"Resource Development","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0043","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to gather information they can use to plan future operations.\n\nReconnaissance consists of techniques that involve adversaries actively or passively gathering information that can be used to support targeting. Such information may include details of the victim organization, infrastructure, or staff/personnel. This information can be leveraged by the adversary to aid in other phases of the adversary lifecycle, such as using gathered information to plan and execute Initial Access, to scope and prioritize post-compromise objectives, or to drive and lead further Reconnaissance efforts.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"-1"},"rdfs:label":"Reconnaissance","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0100","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Collection - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Collection"},{"@id":"d3f:TA0101","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Command and Control - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Command and Control"},{"@id":"d3f:TA0102","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Discovery - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Discovery"},{"@id":"d3f:TA0103","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Evasion - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Evasion"},{"@id":"d3f:TA0104","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Execution - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Execution"},{"@id":"d3f:TA0105","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Impact - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Impact"},{"@id":"d3f:TA0106","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Impair Process Control - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Impair Process Control"},{"@id":"d3f:TA0107","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Inhibit Response Function - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Inhibit Response Function"},{"@id":"d3f:TA0108","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Initial Access - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Initial Access"},{"@id":"d3f:TA0109","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Lateral Movement - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Lateral Movement"},{"@id":"d3f:TA0110","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Persistence - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Persistence"},{"@id":"d3f:TA0111","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Privilege Escalation - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Privilege Escalation"},{"@id":"d3f:TA0112","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to break security mechanisms, pipelines, and tooling so defenders can’t see or trust what’s happening.\n\nDefense Impairment consists of techniques that degrade, disable, or undermine the effectiveness and trustworthiness of security controls and monitoring mechanisms. These techniques are characterized by direct interference with defensive systems. The goal is to reduce defenders’ ability to detect, interpret, or respond to adversary activity.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"6"},"rdfs:label":"Defense Impairment","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]}]},"def_to_off":{"head":{"vars":["query_def_tech_label","top_def_tech_label","def_tactic_label","def_tactic_rel_label","def_tech_label","def_artifact_rel_label","def_artifact_label","off_artifact_label","off_artifact_rel_label","off_tech_label","off_tech_id","framework_root_iri","off_tech_parent_label","off_tech_parent_is_toplevel","off_tactic_rel_label","off_tactic_label","def_tactic","def_tactic_rel","def_tech","def_artifact_rel","def_artifact","off_artifact","off_artifact_rel","off_tech","off_tech_parent","off_tactic_rel","off_tactic"]},"results":{"bindings":[{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Removable Media Device"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Replication Through Removable Media"},"off_tech_id":{"type":"literal","value":"T1091"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Flash Memory"},"off_artifact_rel_label":{"type":"literal","value":"may-corrupt"},"off_tech_label":{"type":"literal","value":"Trigger Single Event Upset"},"off_tech_id":{"type":"literal","value":"EX-0007"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTATechnique"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FlashMemory"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-corrupt"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EX-0007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTAExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ST0004"},"framework_key":{"type":"literal","value":"sparta"},"framework_label":{"type":"literal","value":"SPARTA"},"framework_root":{"type":"literal","value":"d3f:SPARTATechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Digital Camera"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Video Capture"},"off_tech_id":{"type":"literal","value":"T1125"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DigitalCamera"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Keyboard Input Device"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Keylogging"},"off_tech_id":{"type":"literal","value":"T1056.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Input Capture"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Keyboard Input Device"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Keylogging"},"off_tech_id":{"type":"literal","value":"T1056.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Input Capture"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Boot ROM"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Evasion via Bootkit"},"off_tech_id":{"type":"literal","value":"DE-0008"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTATechnique"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BootROM"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DE-0008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTADefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ST0006"},"framework_key":{"type":"literal","value":"sparta"},"framework_label":{"type":"literal","value":"SPARTA"},"framework_root":{"type":"literal","value":"d3f:SPARTATechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Boot ROM"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Compromise Boot Memory"},"off_tech_id":{"type":"literal","value":"EX-0004"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTATechnique"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BootROM"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EX-0004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTAExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ST0004"},"framework_key":{"type":"literal","value":"sparta"},"framework_label":{"type":"literal","value":"SPARTA"},"framework_root":{"type":"literal","value":"d3f:SPARTATechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"I/O Module"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Wireless Compromise"},"off_tech_id":{"type":"literal","value":"T0860"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IOModule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0860"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0108"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Video Input Device"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Video Capture"},"off_tech_id":{"type":"literal","value":"T1125"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#VideoInputDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Satellite Transponder"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Transponder"},"off_tech_id":{"type":"literal","value":"EXF-0006.02"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTATechnique"},"off_tech_parent_label":{"type":"literal","value":"Modify Communications Configuration"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SatelliteTransponder"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EXF-0006.02"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EXF-0006"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ST0008"},"framework_key":{"type":"literal","value":"sparta"},"framework_label":{"type":"literal","value":"SPARTA"},"framework_root":{"type":"literal","value":"d3f:SPARTATechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Software-defined Radio"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Software Defined Radio"},"off_tech_id":{"type":"literal","value":"EXF-0006.01"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTATechnique"},"off_tech_parent_label":{"type":"literal","value":"Modify Communications Configuration"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software-definedRadio"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EXF-0006.01"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EXF-0006"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ST0008"},"framework_key":{"type":"literal","value":"sparta"},"framework_label":{"type":"literal","value":"SPARTA"},"framework_root":{"type":"literal","value":"d3f:SPARTATechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Software-defined Radio"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Compromise Software Defined Radio"},"off_tech_id":{"type":"literal","value":"IA-0002"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTATechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software-definedRadio"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IA-0002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTAInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ST0003"},"framework_key":{"type":"literal","value":"sparta"},"framework_label":{"type":"literal","value":"SPARTA"},"framework_root":{"type":"literal","value":"d3f:SPARTATechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Receiver"},"off_artifact_rel_label":{"type":"literal","value":"impairs"},"off_tech_label":{"type":"literal","value":"Uplink Jamming"},"off_tech_id":{"type":"literal","value":"EX-0016.01"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTATechnique"},"off_tech_parent_label":{"type":"literal","value":"Jamming"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Receiver"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#impairs"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EX-0016.01"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EX-0016"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ST0004"},"framework_key":{"type":"literal","value":"sparta"},"framework_label":{"type":"literal","value":"SPARTA"},"framework_root":{"type":"literal","value":"d3f:SPARTATechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Receiver"},"off_artifact_rel_label":{"type":"literal","value":"impairs"},"off_tech_label":{"type":"literal","value":"Downlink Jamming"},"off_tech_id":{"type":"literal","value":"EX-0016.02"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTATechnique"},"off_tech_parent_label":{"type":"literal","value":"Jamming"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Receiver"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#impairs"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EX-0016.02"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EX-0016"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ST0004"},"framework_key":{"type":"literal","value":"sparta"},"framework_label":{"type":"literal","value":"SPARTA"},"framework_root":{"type":"literal","value":"d3f:SPARTATechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Processor Cache Memory"},"off_artifact_rel_label":{"type":"literal","value":"may-corrupt"},"off_tech_label":{"type":"literal","value":"Trigger Single Event Upset"},"off_tech_id":{"type":"literal","value":"EX-0007"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTATechnique"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CacheMemory"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-corrupt"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EX-0007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTAExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ST0004"},"framework_key":{"type":"literal","value":"sparta"},"framework_label":{"type":"literal","value":"SPARTA"},"framework_root":{"type":"literal","value":"d3f:SPARTATechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Cloud Storage"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Cloud Storage Object Discovery"},"off_tech_id":{"type":"literal","value":"T1619"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1619"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"OT Sensor"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Wireless Compromise"},"off_tech_id":{"type":"literal","value":"T0860"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OTSensor"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0860"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0108"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Removable Media Device"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Replication Through Removable Media"},"off_tech_id":{"type":"literal","value":"T0847"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0847"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0108"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Removable Media Device"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Data from Removable Media"},"off_tech_id":{"type":"literal","value":"T1025"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1025"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Removable Media Device"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Replication Through Removable Media"},"off_tech_id":{"type":"literal","value":"T1091"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_rel_label":{"type":"literal","value":"connects"},"off_tech_label":{"type":"literal","value":"Hardware Additions"},"off_tech_id":{"type":"literal","value":"T1200"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#connects"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1200"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Removable Media Device"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Communication Through Removable Media"},"off_tech_id":{"type":"literal","value":"T1092"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1092"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Removable Media Device"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Exfiltration over USB"},"off_tech_id":{"type":"literal","value":"T1052.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Physical Medium"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1052.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1052"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Primary Storage"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Memory Compromise"},"off_tech_id":{"type":"literal","value":"PER-0001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTATechnique"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrimaryStorage"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PER-0001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTAPersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ST0005"},"framework_key":{"type":"literal","value":"sparta"},"framework_label":{"type":"literal","value":"SPARTA"},"framework_root":{"type":"literal","value":"d3f:SPARTATechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Security Token"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Multi-Factor Authentication Interception"},"off_tech_id":{"type":"literal","value":"T1111"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SecurityToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1111"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Processor Register"},"off_artifact_rel_label":{"type":"literal","value":"may-corrupt"},"off_tech_label":{"type":"literal","value":"Trigger Single Event Upset"},"off_tech_id":{"type":"literal","value":"EX-0007"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTATechnique"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessorRegister"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-corrupt"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EX-0007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTAExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ST0004"},"framework_key":{"type":"literal","value":"sparta"},"framework_label":{"type":"literal","value":"SPARTA"},"framework_root":{"type":"literal","value":"d3f:SPARTATechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Audio Input Device"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Audio Capture"},"off_tech_id":{"type":"literal","value":"T1123"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AudioInputDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1123"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Compromise Hardware Supply Chain"},"off_tech_id":{"type":"literal","value":"T1195.003"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Supply Chain Compromise"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]}},"description":{"@context":{"rdfs":"http://www.w3.org/2000/01/rdf-schema#","owl":"http://www.w3.org/2002/07/owl#","d3f":"http://d3fend.mitre.org/ontologies/d3fend.owl#","skos":"http://www.w3.org/2004/02/skos/core#"},"@graph":[{"@id":"d3f:HardwareComponentInventory","@type":["d3f:HardwareComponentInventory","owl:NamedIndividual","owl:Class"],"d3f:d3fend-id":"D3-HCI","d3f:definition":"Hardware component inventorying identifies and records the hardware items in the organization's architecture.","d3f:inventories":{"@id":"d3f:HardwareDevice"},"d3f:kb-article":"## How it works\nAdministrators collect information on hardware devices such as peripherals, NICs, processors, and memory devices that are components of the computers in their architecture using a variety of administrative and management tools that query for this information.  In some cases, where such queries are not supported or provide specific information of interest, an administrator may also collect this information through remote administration tools and system commands, either manually or using scripts.\n\n## Considerations\n* Scanning and probing techniques using mapping tools can result in side effects to information technology (IT) and operational technology (OT) systems.\n* An adversary conducting network enumeration may engage in activities that parallel normal hardware inventorying activities, but would require escalating to admin privileges for most of the operations requiting administrative tools\n\n## Examples\n* Bus discovery\n   * Admin-scripted PCI Bus inventory using ssh and pciutils\n* Application-layer discovery\n   * Simple Network Management Protocol (SNMP) collects MIB information\n   * Web-based Enterprise Management (WBEM) collects CIM information\n      * Windows Management Instrumentation (WMI)\n      * Windows Management Infrastructure (MI)","d3f:kb-reference":{"@id":"d3f:Reference-AdvancedDeviceMatchingSystem"},"d3f:synonym":["Hardware Component Inventorying","Hardware Component Discovery"],"rdfs:label":"Hardware Component Inventory","rdfs:subClassOf":{"@id":"d3f:AssetInventory"}}]},"digital_artifacts":{"head":{"vars":["query_def_tech_label","top_def_tech_label","def_tech_label","def_artifact_rel_label","def_artifact_label","def_tactic","def_tactic_rel","def_tech","def_artifact_rel","def_artifact"]},"results":{"bindings":[{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"}}]}},"subtechniques":{"@context":{"rdfs":"http://www.w3.org/2000/01/rdf-schema#","owl":"http://www.w3.org/2002/07/owl#","d3f":"http://d3fend.mitre.org/ontologies/d3fend.owl#","skos":"http://www.w3.org/2004/02/skos/core#"},"@graph":[]},"weaknesses":{"head":{"vars":["query_def_tech_label","top_def_tech_label","def_tactic_label","def_tactic_rel_label","def_tech_label","def_artifact_rel_label","def_artifact_label","weak_artifact_label","weak_artifact_rel_label","weak_label","def_tactic","def_tactic_rel","def_tech","def_artifact_rel","def_artifact","weak_artifact","weak_artifact_rel","weak","weak_id"]},"results":{"bindings":[]}},"related_offensive_matrix":{"Lateral Movement":[["Replication Through Removable Media",[{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Removable Media Device"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Replication Through Removable Media"},"off_tech_id":{"type":"literal","value":"T1091"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]]],"Execution":[["Trigger Single Event Upset",[{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Flash Memory"},"off_artifact_rel_label":{"type":"literal","value":"may-corrupt"},"off_tech_label":{"type":"literal","value":"Trigger Single Event Upset"},"off_tech_id":{"type":"literal","value":"EX-0007"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTATechnique"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#FlashMemory"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-corrupt"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EX-0007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTAExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ST0004"},"framework_key":{"type":"literal","value":"sparta"},"framework_label":{"type":"literal","value":"SPARTA"},"framework_root":{"type":"literal","value":"d3f:SPARTATechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Processor Cache Memory"},"off_artifact_rel_label":{"type":"literal","value":"may-corrupt"},"off_tech_label":{"type":"literal","value":"Trigger Single Event Upset"},"off_tech_id":{"type":"literal","value":"EX-0007"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTATechnique"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CacheMemory"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-corrupt"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EX-0007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTAExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ST0004"},"framework_key":{"type":"literal","value":"sparta"},"framework_label":{"type":"literal","value":"SPARTA"},"framework_root":{"type":"literal","value":"d3f:SPARTATechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Processor Register"},"off_artifact_rel_label":{"type":"literal","value":"may-corrupt"},"off_tech_label":{"type":"literal","value":"Trigger Single Event Upset"},"off_tech_id":{"type":"literal","value":"EX-0007"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTATechnique"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ProcessorRegister"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-corrupt"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EX-0007"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTAExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ST0004"},"framework_key":{"type":"literal","value":"sparta"},"framework_label":{"type":"literal","value":"SPARTA"},"framework_root":{"type":"literal","value":"d3f:SPARTATechnique"}}]],["Compromise Boot Memory",[{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Boot ROM"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Compromise Boot Memory"},"off_tech_id":{"type":"literal","value":"EX-0004"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTATechnique"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BootROM"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EX-0004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTAExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ST0004"},"framework_key":{"type":"literal","value":"sparta"},"framework_label":{"type":"literal","value":"SPARTA"},"framework_root":{"type":"literal","value":"d3f:SPARTATechnique"}}]],["Jamming",[{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Receiver"},"off_artifact_rel_label":{"type":"literal","value":"impairs"},"off_tech_label":{"type":"literal","value":"Uplink Jamming"},"off_tech_id":{"type":"literal","value":"EX-0016.01"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTATechnique"},"off_tech_parent_label":{"type":"literal","value":"Jamming"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Receiver"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#impairs"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EX-0016.01"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EX-0016"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ST0004"},"framework_key":{"type":"literal","value":"sparta"},"framework_label":{"type":"literal","value":"SPARTA"},"framework_root":{"type":"literal","value":"d3f:SPARTATechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Receiver"},"off_artifact_rel_label":{"type":"literal","value":"impairs"},"off_tech_label":{"type":"literal","value":"Downlink Jamming"},"off_tech_id":{"type":"literal","value":"EX-0016.02"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTATechnique"},"off_tech_parent_label":{"type":"literal","value":"Jamming"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Receiver"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#impairs"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EX-0016.02"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EX-0016"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ST0004"},"framework_key":{"type":"literal","value":"sparta"},"framework_label":{"type":"literal","value":"SPARTA"},"framework_root":{"type":"literal","value":"d3f:SPARTATechnique"}}]]],"Collection":[["Video Capture",[{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Digital Camera"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Video Capture"},"off_tech_id":{"type":"literal","value":"T1125"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DigitalCamera"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Video Input Device"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Video Capture"},"off_tech_id":{"type":"literal","value":"T1125"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#VideoInputDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1125"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Input Capture",[{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Keyboard Input Device"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Keylogging"},"off_tech_id":{"type":"literal","value":"T1056.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Input Capture"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Data from Removable Media",[{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Removable Media Device"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Data from Removable Media"},"off_tech_id":{"type":"literal","value":"T1025"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1025"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Audio Capture",[{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Audio Input Device"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Audio Capture"},"off_tech_id":{"type":"literal","value":"T1123"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AudioInputDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1123"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]]],"Credential Access":[["Input Capture",[{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Keyboard Input Device"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Keylogging"},"off_tech_id":{"type":"literal","value":"T1056.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Input Capture"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#KeyboardInputDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1056"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Multi-Factor Authentication Interception",[{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Security Token"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Multi-Factor Authentication Interception"},"off_tech_id":{"type":"literal","value":"T1111"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SecurityToken"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1111"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]]],"Defense Evasion":[["Evasion via Bootkit",[{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Boot ROM"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Evasion via Bootkit"},"off_tech_id":{"type":"literal","value":"DE-0008"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTATechnique"},"off_tech_parent_label":{"type":"literal","value":"Defense Evasion Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#BootROM"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DE-0008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTADefenseEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ST0006"},"framework_key":{"type":"literal","value":"sparta"},"framework_label":{"type":"literal","value":"SPARTA"},"framework_root":{"type":"literal","value":"d3f:SPARTATechnique"}}]]],"Initial Access":[["Wireless Compromise",[{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"I/O Module"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Wireless Compromise"},"off_tech_id":{"type":"literal","value":"T0860"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IOModule"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0860"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0108"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"OT Sensor"},"off_artifact_rel_label":{"type":"literal","value":"may-access"},"off_tech_label":{"type":"literal","value":"Wireless Compromise"},"off_tech_id":{"type":"literal","value":"T0860"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OTSensor"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-access"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0860"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0108"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}}]],["Compromise Software Defined Radio",[{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Software-defined Radio"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Compromise Software Defined Radio"},"off_tech_id":{"type":"literal","value":"IA-0002"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTATechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software-definedRadio"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IA-0002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTAInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ST0003"},"framework_key":{"type":"literal","value":"sparta"},"framework_label":{"type":"literal","value":"SPARTA"},"framework_root":{"type":"literal","value":"d3f:SPARTATechnique"}}]],["Replication Through Removable Media",[{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Removable Media Device"},"off_artifact_rel_label":{"type":"literal","value":"uses"},"off_tech_label":{"type":"literal","value":"Replication Through Removable Media"},"off_tech_id":{"type":"literal","value":"T0847"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#uses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0847"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0108"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Removable Media Device"},"off_artifact_rel_label":{"type":"literal","value":"executes"},"off_tech_label":{"type":"literal","value":"Replication Through Removable Media"},"off_tech_id":{"type":"literal","value":"T1091"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#executes"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1091"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Hardware Additions",[{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_rel_label":{"type":"literal","value":"connects"},"off_tech_label":{"type":"literal","value":"Hardware Additions"},"off_tech_id":{"type":"literal","value":"T1200"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#connects"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1200"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Supply Chain Compromise",[{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Compromise Hardware Supply Chain"},"off_tech_id":{"type":"literal","value":"T1195.003"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Supply Chain Compromise"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1195.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1195"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]]],"Exfiltration":[["Modify Communications Configuration",[{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Satellite Transponder"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Transponder"},"off_tech_id":{"type":"literal","value":"EXF-0006.02"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTATechnique"},"off_tech_parent_label":{"type":"literal","value":"Modify Communications Configuration"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SatelliteTransponder"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EXF-0006.02"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EXF-0006"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ST0008"},"framework_key":{"type":"literal","value":"sparta"},"framework_label":{"type":"literal","value":"SPARTA"},"framework_root":{"type":"literal","value":"d3f:SPARTATechnique"}},{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Software-defined Radio"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Software Defined Radio"},"off_tech_id":{"type":"literal","value":"EXF-0006.01"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTATechnique"},"off_tech_parent_label":{"type":"literal","value":"Modify Communications Configuration"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Software-definedRadio"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EXF-0006.01"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#EXF-0006"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ST0008"},"framework_key":{"type":"literal","value":"sparta"},"framework_label":{"type":"literal","value":"SPARTA"},"framework_root":{"type":"literal","value":"d3f:SPARTATechnique"}}]],["Exfiltration Over Physical Medium",[{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Removable Media Device"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Exfiltration over USB"},"off_tech_id":{"type":"literal","value":"T1052.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Physical Medium"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1052.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1052"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]]],"Discovery":[["Cloud Storage Object Discovery",[{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Cloud Storage"},"off_artifact_rel_label":{"type":"literal","value":"accesses"},"off_tech_label":{"type":"literal","value":"Cloud Storage Object Discovery"},"off_tech_id":{"type":"literal","value":"T1619"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CloudStorage"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#accesses"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1619"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]]],"Command and Control":[["Communication Through Removable Media",[{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Removable Media Device"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Communication Through Removable Media"},"off_tech_id":{"type":"literal","value":"T1092"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RemovableMediaDevice"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1092"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]]],"Persistence":[["Memory Compromise",[{"query_def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"top_def_tech_label":{"type":"literal","value":"Asset Inventory"},"def_tactic_label":{"type":"literal","value":"Model"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"Hardware Component Inventory"},"def_artifact_rel_label":{"type":"literal","value":"inventories"},"def_artifact_label":{"type":"literal","value":"Hardware Device"},"off_artifact_label":{"type":"literal","value":"Primary Storage"},"off_artifact_rel_label":{"type":"literal","value":"modifies"},"off_tech_label":{"type":"literal","value":"Memory Compromise"},"off_tech_id":{"type":"literal","value":"PER-0001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTATechnique"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Model"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareComponentInventory"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#inventories"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#HardwareDevice"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PrimaryStorage"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#modifies"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PER-0001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#SPARTAPersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ST0005"},"framework_key":{"type":"literal","value":"sparta"},"framework_label":{"type":"literal","value":"SPARTA"},"framework_root":{"type":"literal","value":"d3f:SPARTATechnique"}}]]]},"references":{"@context":{"rdfs":"http://www.w3.org/2000/01/rdf-schema#","d3f":"http://d3fend.mitre.org/ontologies/d3fend.owl#"},"@graph":[{"@id":"d3f:Reference-AdvancedDeviceMatchingSystem","@type":["d3f:PatentReference","http://www.w3.org/2002/07/owl#NamedIndividual"],"d3f:has-link":{"@type":"http://www.w3.org/2001/XMLSchema#anyURI","@value":"https://patents.google.com/patent/US10892951B2/"},"d3f:kb-abstract":"Disclosed is a device management system for discovery and management of components added to computer systems and sub-systems. The device management system provides for recognizing a newly added component, and determining if the newly added component is already a part of the system inventory. The newly added component is matched with a component currently on the system, based on at least one matching attribute. A point total is calculated for each match level and a final match score is provided. The match score is compared with an aggressiveness level to determine if a match does indeed exist.","d3f:kb-author":"Rajneesh Jalan, Joseph M. Schmitt, and Marco Simoes","d3f:kb-organization":"Device42 Inc","d3f:kb-reference-of":{"@id":"d3f:HardwareComponentInventory"},"d3f:kb-reference-title":"Advanced device matching system","d3f:reference-type-label":"Patent","rdfs:label":"Reference - Advanced device matching system"}]},"references_meta":{"Patent":1}}