{"off_tactics":{"@context":{"rdfs":"http://www.w3.org/2000/01/rdf-schema#","owl":"http://www.w3.org/2002/07/owl#","d3f":"http://d3fend.mitre.org/ontologies/d3fend.owl#","skos":"http://www.w3.org/2004/02/skos/core#"},"@graph":[{"@id":"d3f:AML.TA0000","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0000","d3f:definition":"The adversary is attempting to gain some level of access to an AI model.\n\nAI Model Access enables techniques that use various types of access to the AI model that can be used by the adversary to gain information, develop attacks, and as a means to input data to the model.\nThe level of access can range from the full knowledge of the internals of the model to access to the physical environment where data is collected for use in the AI model.\nThe adversary may use varying levels of model access during the course of their attack, from staging the attack to impacting the target system.\n\nAccess to an AI model may require access to the system housing the model, the model may be publicly accessible via an API, or it may be accessed indirectly via interaction with a product or service that utilizes AI as part of its processes.","rdfs:label":"AI Model Access - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0000"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"AI Model Access"},{"@id":"d3f:AML.TA0001","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0001","d3f:definition":"The adversary is leveraging their knowledge of and access to the target system to tailor the attack.\n\nAI Attack Staging consists of techniques adversaries use to prepare their attack on the target AI model.\nTechniques can include training proxy models, poisoning the target model, and crafting adversarial data to feed the target model.\nSome of these techniques can be performed in an offline manner and are thus difficult to mitigate.\nThese techniques are often used to achieve the adversary's end goal.","rdfs:label":"AI Attack Staging - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0001"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"AI Attack Staging"},{"@id":"d3f:AML.TA0002","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0002","d3f:definition":"The adversary is trying to gather information about the AI system they can use to plan future operations.\n\nReconnaissance consists of techniques that involve adversaries actively or passively gathering information that can be used to support targeting.\nSuch information may include details of the victim organizations' AI capabilities and research efforts.\nThis information can be leveraged by the adversary to aid in other phases of the adversary lifecycle, such as using gathered information to obtain relevant AI artifacts, targeting AI capabilities used by the victim, tailoring attacks to the particular models used by the victim, or to drive and lead further Reconnaissance efforts.","rdfs:label":"Reconnaissance - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0002"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Reconnaissance"},{"@id":"d3f:AML.TA0003","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0003","d3f:definition":"The adversary is trying to establish resources they can use to support operations.\n\nResource Development consists of techniques that involve adversaries creating,\npurchasing, or compromising/stealing resources that can be used to support targeting.\nSuch resources include AI artifacts, infrastructure, accounts, or capabilities.\nThese resources can be leveraged by the adversary to aid in other phases of the adversary lifecycle, such as [AI Attack Staging](/tactics/AML.TA0001).","rdfs:label":"Resource Development - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0003"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Resource Development"},{"@id":"d3f:AML.TA0004","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0004","d3f:definition":"The adversary is trying to gain access to the AI system.\n\nThe target system could be a network, mobile device, or an edge device such as a sensor platform.\nThe AI capabilities used by the system could be local with onboard or cloud-enabled AI capabilities.\n\nInitial Access consists of techniques that use various entry vectors to gain their initial foothold within the system.","rdfs:label":"Initial Access - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0004"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Initial Access"},{"@id":"d3f:AML.TA0005","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0005","d3f:definition":"The adversary is trying to run malicious code embedded in AI artifacts or software.\n\nExecution consists of techniques that result in adversary-controlled code running on a local or remote system.\nTechniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data.\nFor example, an adversary might use a remote access tool to run a PowerShell script that does [Remote System Discovery](https://attack.mitre.org/techniques/T1018/).","rdfs:label":"Execution - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0005"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Execution"},{"@id":"d3f:AML.TA0006","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0006","d3f:definition":"The adversary is trying to maintain their foothold via AI artifacts or software.\n\nPersistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access.\nTechniques used for persistence often involve leaving behind modified ML artifacts such as poisoned training data or manipulated AI models.","rdfs:label":"Persistence - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0006"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Persistence"},{"@id":"d3f:AML.TA0007","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0007","d3f:definition":"The adversary is trying to avoid being detected by AI-enabled security software.\n\nDefense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise.\nTechniques used for defense evasion include evading AI-enabled security software such as malware detectors.","rdfs:label":"Defense Evasion - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0007"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Defense Evasion"},{"@id":"d3f:AML.TA0008","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0008","d3f:definition":"The adversary is trying to figure out your AI environment.\n\nDiscovery consists of techniques an adversary may use to gain knowledge about the system and internal network.\nThese techniques help adversaries observe the environment and orient themselves before deciding how to act.\nThey also allow adversaries to explore what they can control and what's around their entry point in order to discover how it could benefit their current objective.\nNative operating system tools are often used toward this post-compromise information-gathering objective.","rdfs:label":"Discovery - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0008"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Discovery"},{"@id":"d3f:AML.TA0009","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0009","d3f:definition":"The adversary is trying to gather AI artifacts and other related information relevant to their goal.\n\nCollection consists of techniques adversaries may use to gather information and the sources information is collected from that are relevant to following through on the adversary's objectives.\nFrequently, the next goal after collecting data is to steal (exfiltrate) the AI artifacts, or use the collected information to stage future operations.\nCommon target sources include software repositories, container registries, model repositories, and object stores.","rdfs:label":"Collection - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0009"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Collection"},{"@id":"d3f:AML.TA0010","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0010","d3f:definition":"The adversary is trying to steal AI artifacts or other information about the AI system.\n\nExfiltration consists of techniques that adversaries may use to steal data from your network.\nData may be stolen for its valuable intellectual property, or for use in staging future operations.\n\nTechniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission.","rdfs:label":"Exfiltration - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0010"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Exfiltration"},{"@id":"d3f:AML.TA0011","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0011","d3f:definition":"The adversary is trying to manipulate, interrupt, erode confidence in, or destroy your AI systems and data.\n\nImpact consists of techniques that adversaries use to disrupt availability or compromise integrity by manipulating business and operational processes.\nTechniques used for impact can include destroying or tampering with data.\nIn some cases, business processes can look fine, but may have been altered to benefit the adversaries' goals.\nThese techniques might be used by adversaries to follow through on their end goal or to provide cover for a confidentiality breach.","rdfs:label":"Impact - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0011"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Impact"},{"@id":"d3f:AML.TA0012","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0012","d3f:definition":"The adversary is trying to gain higher-level permissions.\n\nPrivilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include:\n- SYSTEM/root level\n- local administrator\n- user account with admin-like access\n- user accounts with access to specific system or perform specific function\n\nThese techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.","rdfs:label":"Privilege Escalation - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0012"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Privilege Escalation"},{"@id":"d3f:AML.TA0013","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0013","d3f:definition":"The adversary is trying to steal account names and passwords.\n\nCredential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.","rdfs:label":"Credential Access - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0013"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Credential Access"},{"@id":"d3f:AML.TA0014","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0014","d3f:definition":"The adversary is trying to communicate with compromised AI systems to control them.\n\nCommand and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim's network structure and defenses.","rdfs:label":"Command and Control - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0014"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Command and Control"},{"@id":"d3f:AML.TA0015","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:attack-id":"AML.TA0015","d3f:definition":"The adversary is trying to move through your AI environment.\n\nLateral Movement consists of techniques that adversaries may use to gain access to and control other systems or components in the environment. Adversaries may pivot towards AI Ops infrastructure such as model registries, experiment trackers, vector databases, notebooks, or training pipelines. As the adversary moves through the environment, they may discover means of accessing additional AI-related tools, services, or applications. AI agents may also be a valuable target as they commonly have more permissions than standard user accounts on the system.","rdfs:label":"Lateral Movement - ATLAS","rdfs:seeAlso":{"@id":"https://atlas.mitre.org/tactics/AML.TA0015"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATLASTactic"}],"skos:prefLabel":"Lateral Movement"},{"@id":"d3f:ST0001","@type":["owl:NamedIndividual","d3f:SPARTATactic","owl:Class"],"d3f:definition":"Threat actor is trying to gather information they can use to plan future operations.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"1"},"rdfs:label":"Reconnaissance - SPARTA","rdfs:seeAlso":{"@id":"https://sparta.aerospace.org/tactic/ST0001"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:SPARTATactic"}],"skos:prefLabel":"Reconnaissance"},{"@id":"d3f:ST0002","@type":["owl:NamedIndividual","d3f:SPARTATactic","owl:Class"],"d3f:definition":"Threat actor is trying to establish resources they can use to support operations.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"2"},"rdfs:label":"Resource Development - SPARTA","rdfs:seeAlso":{"@id":"https://sparta.aerospace.org/tactic/ST0002"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:SPARTATactic"}],"skos:prefLabel":"Resource Development"},{"@id":"d3f:ST0003","@type":["owl:NamedIndividual","d3f:SPARTATactic","owl:Class"],"d3f:definition":"Threat actor is trying to get point of presence/command execution on the spacecraft.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"3"},"rdfs:label":"Initial Access - SPARTA","rdfs:seeAlso":{"@id":"https://sparta.aerospace.org/tactic/ST0003"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:SPARTATactic"}],"skos:prefLabel":"Initial Access"},{"@id":"d3f:ST0004","@type":["owl:NamedIndividual","d3f:SPARTATactic","owl:Class"],"d3f:definition":"Threat actor is trying to execute malicious code on the spacecraft.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"4"},"rdfs:label":"Execution - SPARTA","rdfs:seeAlso":{"@id":"https://sparta.aerospace.org/tactic/ST0004"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:SPARTATactic"}],"skos:prefLabel":"Execution"},{"@id":"d3f:ST0005","@type":["owl:NamedIndividual","d3f:SPARTATactic","owl:Class"],"d3f:definition":"Threat actor is trying to maintain their foothold/access to command/execute code on the spacecraft.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"5"},"rdfs:label":"Persistence - SPARTA","rdfs:seeAlso":{"@id":"https://sparta.aerospace.org/tactic/ST0005"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:SPARTATactic"}],"skos:prefLabel":"Persistence"},{"@id":"d3f:ST0006","@type":["owl:NamedIndividual","d3f:SPARTATactic","owl:Class"],"d3f:definition":"Threat actor is trying to avoid being detected.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"6"},"rdfs:label":"Defense Evasion - SPARTA","rdfs:seeAlso":{"@id":"https://sparta.aerospace.org/tactic/ST0006"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:SPARTATactic"}],"skos:prefLabel":"Defense Evasion"},{"@id":"d3f:ST0007","@type":["owl:NamedIndividual","d3f:SPARTATactic","owl:Class"],"d3f:definition":"Threat actor is trying to move through across sub-systems of the spacecraft.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"7"},"rdfs:label":"Lateral Movement - SPARTA","rdfs:seeAlso":{"@id":"https://sparta.aerospace.org/tactic/ST0007"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:SPARTATactic"}],"skos:prefLabel":"Lateral Movement"},{"@id":"d3f:ST0008","@type":["owl:NamedIndividual","d3f:SPARTATactic","owl:Class"],"d3f:definition":"Threat actor is trying to steal information.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"8"},"rdfs:label":"Exfiltration - SPARTA","rdfs:seeAlso":{"@id":"https://sparta.aerospace.org/tactic/ST0008"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:SPARTATactic"}],"skos:prefLabel":"Exfiltration"},{"@id":"d3f:ST0009","@type":["owl:NamedIndividual","d3f:SPARTATactic","owl:Class"],"d3f:definition":"Threat actor is trying to manipulate, interrupt, or destroy the space system(s) and/or data.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"9"},"rdfs:label":"Impact - SPARTA","rdfs:seeAlso":{"@id":"https://sparta.aerospace.org/tactic/ST0009"},"rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:SPARTATactic"}],"skos:prefLabel":"Impact"},{"@id":"d3f:TA0001","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to get into your network.\n\nInitial Access consists of techniques that use various entry vectors to gain their initial foothold within a network. Techniques used to gain a foothold include targeted spearphishing and exploiting weaknesses on public-facing web servers. Footholds gained through initial access may allow for continued access, like valid accounts and use of external remote services, or may be limited-use due to changing passwords.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"1"},"rdfs:label":"Initial Access","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0002","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to run malicious code.\n\nExecution consists of techniques that result in adversary-controlled code running on a local or remote system. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data. For example, an adversary might use a remote access tool to run a PowerShell script that does Remote System Discovery.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"2"},"rdfs:label":"Execution","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0003","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to maintain their foothold.\n\nPersistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"3"},"rdfs:label":"Persistence","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0004","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to gain higher-level permissions.\n\nPrivilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include:\n\n* SYSTEM/root level\n* local administrator\n* user account with admin-like access\n* user accounts with access to specific system or perform specific function\n\nThese techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"4"},"rdfs:label":"Privilege Escalation","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0005","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to hide and conceal their actions, appearing as normal behavior.\n\nStealth consists of techniques that reduce the likelihood of detection by blending in with legitimate activity or minimizing observable signals. These techniques are characterized by concealment behaviors, such as avoiding, obfuscating, or mimicking normal operations, without modifying security controls or compromising collection and monitoring feeds. The goal is to remain indistinguishable from benign activity while leaving defensive systems intact.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"5"},"rdfs:label":"Stealth","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0006","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to steal account names and passwords.\n\nCredential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"7"},"rdfs:label":"Credential Access","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0007","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to figure out your environment.\n\nDiscovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what’s around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"8"},"rdfs:label":"Discovery","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0008","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to move through your environment.\n\nLateral Movement consists of techniques that adversaries use to enter and control remote systems on a network. Following through on their primary objective often requires exploring the network to find their target, then pivoting through multiple systems and accounts to gain access to it. Adversaries might install their own remote access tools to accomplish Lateral Movement or use legitimate credentials with native network and operating system tools, which may be stealthier.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"9"},"rdfs:label":"Lateral Movement","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0009","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to gather data of interest to their goal.\n\nCollection consists of techniques adversaries may use to gather information and the sources information is collected from that are relevant to following through on the adversary's objectives. Frequently, the next goal after collecting data is to either steal (exfiltrate) the data or to use the data to gain more information about the target environment. Common target sources include various drive types, browsers, audio, video, and email. Common collection methods include capturing screenshots and keyboard input.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"10"},"rdfs:label":"Collection","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0010","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to steal data.\n\nExfiltration consists of techniques that adversaries may use to steal data from your network. Once they’ve collected data, adversaries often package it to avoid detection while removing it. This can include compression and encryption. Techniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"12"},"rdfs:label":"Exfiltration","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0011","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to communicate with compromised systems to control them.\n\nCommand and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim’s network structure and defenses.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"11"},"rdfs:label":"Command and Control","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0027","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Initial Access - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}],"skos:prefLabel":"Initial Access"},{"@id":"d3f:TA0028","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Persistence - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}],"skos:prefLabel":"Persistence"},{"@id":"d3f:TA0029","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Privilege Escalation - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}],"skos:prefLabel":"Privilege Escalation"},{"@id":"d3f:TA0030","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Defense Evasion - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}],"skos:prefLabel":"Defense Evasion"},{"@id":"d3f:TA0031","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Credential Access - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}],"skos:prefLabel":"Credential Access"},{"@id":"d3f:TA0032","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Discovery - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}],"skos:prefLabel":"Discovery"},{"@id":"d3f:TA0033","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Lateral Movement - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}],"skos:prefLabel":"Lateral Movement"},{"@id":"d3f:TA0034","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Impact - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}],"skos:prefLabel":"Impact"},{"@id":"d3f:TA0035","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Collection - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}],"skos:prefLabel":"Collection"},{"@id":"d3f:TA0036","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Exfiltration - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}],"skos:prefLabel":"Exfiltration"},{"@id":"d3f:TA0037","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Command and Control - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}],"skos:prefLabel":"Command and Control"},{"@id":"d3f:TA0040","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to manipulate, interrupt, or destroy your systems and data.\n\nImpact consists of techniques that adversaries use to disrupt availability or compromise integrity by manipulating business and operational processes. Techniques used for impact can include destroying or tampering with data. In some cases, business processes can look fine, but may have been altered to benefit the adversaries’ goals. These techniques might be used by adversaries to follow through on their end goal or to provide cover for a confidentiality breach.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"13"},"rdfs:label":"Impact","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0041","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Execution - ATTACK Mobile","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKMobileTactic"}]},{"@id":"d3f:TA0042","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to establish resources they can use to support operations.\n\nResource Development consists of techniques that involve adversaries creating, purchasing, or compromising/stealing resources that can be used to support targeting. Such resources include infrastructure, accounts, or capabilities. These resources can be leveraged by the adversary to aid in other phases of the adversary lifecycle, such as using purchased domains to support Command and Control, email accounts for phishing as a part of Initial Access, or stealing code signing certificates to help with Defense Evasion.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"0"},"rdfs:label":"Resource Development","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0043","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to gather information they can use to plan future operations.\n\nReconnaissance consists of techniques that involve adversaries actively or passively gathering information that can be used to support targeting. Such information may include details of the victim organization, infrastructure, or staff/personnel. This information can be leveraged by the adversary to aid in other phases of the adversary lifecycle, such as using gathered information to plan and execute Initial Access, to scope and prioritize post-compromise objectives, or to drive and lead further Reconnaissance efforts.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"-1"},"rdfs:label":"Reconnaissance","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]},{"@id":"d3f:TA0100","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Collection - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Collection"},{"@id":"d3f:TA0101","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Command and Control - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Command and Control"},{"@id":"d3f:TA0102","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Discovery - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Discovery"},{"@id":"d3f:TA0103","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Evasion - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Evasion"},{"@id":"d3f:TA0104","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Execution - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Execution"},{"@id":"d3f:TA0105","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Impact - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Impact"},{"@id":"d3f:TA0106","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Impair Process Control - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Impair Process Control"},{"@id":"d3f:TA0107","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Inhibit Response Function - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Inhibit Response Function"},{"@id":"d3f:TA0108","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Initial Access - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Initial Access"},{"@id":"d3f:TA0109","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Lateral Movement - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Lateral Movement"},{"@id":"d3f:TA0110","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Persistence - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Persistence"},{"@id":"d3f:TA0111","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"rdfs:label":"Privilege Escalation - ATTACK ICS","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKICSTactic"}],"skos:prefLabel":"Privilege Escalation"},{"@id":"d3f:TA0112","@type":["d3f:OffensiveTactic","owl:NamedIndividual","owl:Class"],"d3f:definition":"The adversary is trying to break security mechanisms, pipelines, and tooling so defenders can’t see or trust what’s happening.\n\nDefense Impairment consists of techniques that degrade, disable, or undermine the effectiveness and trustworthiness of security controls and monitoring mechanisms. These techniques are characterized by direct interference with defensive systems. The goal is to reduce defenders’ ability to detect, interpret, or respond to adversary activity.","d3f:display-order":{"@type":"http://www.w3.org/2001/XMLSchema#integer","@value":"6"},"rdfs:label":"Defense Impairment","rdfs:subClassOf":[{"@id":"d3f:OffensiveTactic"},{"@id":"d3f:ATTACKEnterpriseTactic"}]}]},"def_to_off":{"head":{"vars":["query_def_tech_label","top_def_tech_label","def_tactic_label","def_tactic_rel_label","def_tech_label","def_artifact_rel_label","def_artifact_label","off_artifact_label","off_artifact_rel_label","off_tech_label","off_tech_id","framework_root_iri","off_tech_parent_label","off_tech_parent_is_toplevel","off_tactic_rel_label","off_tactic_label","def_tactic","def_tactic_rel","def_tech","def_artifact_rel","def_artifact","off_artifact","off_artifact_rel","off_tech","off_tech_parent","off_tactic_rel","off_tactic"]},"results":{"bindings":[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_id":{"type":"literal","value":"T1546.008"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"SSH"},"off_tech_id":{"type":"literal","value":"T1021.004"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Remote Services"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Additional Cloud Credentials"},"off_tech_id":{"type":"literal","value":"T1098.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Additional Cloud Credentials"},"off_tech_id":{"type":"literal","value":"T1098.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Credential Stuffing"},"off_tech_id":{"type":"literal","value":"T1110.004"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Rogue Domain Controller"},"off_tech_id":{"type":"literal","value":"T1207"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Defense Impairment Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Impairment"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseImpairmentTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0112"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Password Spraying"},"off_tech_id":{"type":"literal","value":"T1110.003"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Other Network Medium"},"off_tech_id":{"type":"literal","value":"T1011"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Drive-by Compromise"},"off_tech_id":{"type":"literal","value":"T1189"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Domain Fronting"},"off_tech_id":{"type":"literal","value":"T1090.004"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Proxy"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration to Cloud Storage"},"off_tech_id":{"type":"literal","value":"T1567.002"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Web Service"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Exfiltration to Code Repository"},"off_tech_id":{"type":"literal","value":"T1567.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Web Service"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"TFTP Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"TFTP Boot"},"off_tech_id":{"type":"literal","value":"T1542.005"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"TFTP Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"TFTP Boot"},"off_tech_id":{"type":"literal","value":"T1542.005"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Stealth"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Internal Proxy"},"off_tech_id":{"type":"literal","value":"T1090.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Proxy"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exploitation of Remote Services"},"off_tech_id":{"type":"literal","value":"T1210"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote Services"},"off_tech_id":{"type":"literal","value":"T0886"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0886"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSLateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0109"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote Services"},"off_tech_id":{"type":"literal","value":"T0886"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0886"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0108"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote Services"},"off_tech_id":{"type":"literal","value":"T1021"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Trusted Relationship"},"off_tech_id":{"type":"literal","value":"T1199"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exploitation of Remote Services"},"off_tech_id":{"type":"literal","value":"T0866"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0866"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSLateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0109"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exploitation of Remote Services"},"off_tech_id":{"type":"literal","value":"T0866"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0866"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0108"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Connection Proxy"},"off_tech_id":{"type":"literal","value":"T0884"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0884"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSCommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0101"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Multicast Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Name Resolution Poisoning and SMB Relay"},"off_tech_id":{"type":"literal","value":"T1557.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Adversary-in-the-Middle"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Multicast Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Name Resolution Poisoning and SMB Relay"},"off_tech_id":{"type":"literal","value":"T1557.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Adversary-in-the-Middle"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Symmetric Cryptography"},"off_tech_id":{"type":"literal","value":"T1573.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Encrypted Channel"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Asymmetric Cryptography"},"off_tech_id":{"type":"literal","value":"T1573.002"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Encrypted Channel"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Symmetric Encrypted Non-C2 Protocol"},"off_tech_id":{"type":"literal","value":"T1048.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Alternative Protocol"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Encrypted Channel"},"off_tech_id":{"type":"literal","value":"T1573"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"},"off_tech_id":{"type":"literal","value":"T1048.002"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Alternative Protocol"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Standard Application Layer Protocol"},"off_tech_id":{"type":"literal","value":"T0869"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0869"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSCommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0101"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_id":{"type":"literal","value":"T1550.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Adversary-in-the-Middle"},"off_tech_id":{"type":"literal","value":"T1557"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Adversary-in-the-Middle"},"off_tech_id":{"type":"literal","value":"T1557"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Rogue Master"},"off_tech_id":{"type":"literal","value":"T0848"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0848"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0108"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"monitors"},"off_tech_label":{"type":"literal","value":"Rogue Master"},"off_tech_id":{"type":"literal","value":"T0848"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0848"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0108"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Port Knocking"},"off_tech_id":{"type":"literal","value":"T1205.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Port Knocking"},"off_tech_id":{"type":"literal","value":"T1205.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Port Knocking"},"off_tech_id":{"type":"literal","value":"T1205.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Stealth"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"monitors"},"off_tech_label":{"type":"literal","value":"Network Connection Enumeration"},"off_tech_id":{"type":"literal","value":"T0840"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0840"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSDiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0102"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Adversary-in-the-Middle"},"off_tech_id":{"type":"literal","value":"T0830"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0830"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSCollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0100"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Commonly Used Port"},"off_tech_id":{"type":"literal","value":"T0885"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0885"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSCommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0101"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote System Discovery"},"off_tech_id":{"type":"literal","value":"T1018"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Autorun Image"},"off_tech_id":{"type":"literal","value":"T0895"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0895"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0104"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote System Information Discovery"},"off_tech_id":{"type":"literal","value":"T0888"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0888"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSDiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0102"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"monitors"},"off_tech_label":{"type":"literal","value":"Remote System Discovery"},"off_tech_id":{"type":"literal","value":"T0846"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0846"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSDiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0102"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"CMSTP"},"off_tech_id":{"type":"literal","value":"T1218.003"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"System Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Stealth"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"monitors"},"off_tech_label":{"type":"literal","value":"Network Sniffing"},"off_tech_id":{"type":"literal","value":"T0842"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0842"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSDiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0102"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_id":{"type":"literal","value":"T1205"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_id":{"type":"literal","value":"T1205"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_id":{"type":"literal","value":"T1205"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Stealth Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Stealth"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StealthTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"System Binary Proxy Execution"},"off_tech_id":{"type":"literal","value":"T0894"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Evasion Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0894"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0103"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Transmitted Data Manipulation"},"off_tech_id":{"type":"literal","value":"T1565.002"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Data Manipulation"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Windows Management Instrumentation"},"off_tech_id":{"type":"literal","value":"T1047"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote Desktop Protocol"},"off_tech_id":{"type":"literal","value":"T1021.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Remote Services"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote Service Session Hijacking"},"off_tech_id":{"type":"literal","value":"T1563"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"DCSync"},"off_tech_id":{"type":"literal","value":"T1003.006"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Malicious Link"},"off_tech_id":{"type":"literal","value":"T1204.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"User Execution"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Windows Management Instrumentation Event Subscription"},"off_tech_id":{"type":"literal","value":"T1546.003"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Windows Management Instrumentation Event Subscription"},"off_tech_id":{"type":"literal","value":"T1546.003"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Remote Terminal Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Exfiltration to Code Repository"},"off_tech_id":{"type":"literal","value":"T1567.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Web Service"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Mail Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Attachment"},"off_tech_id":{"type":"literal","value":"T1566.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Mail Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Link"},"off_tech_id":{"type":"literal","value":"T1566.002"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Mail Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Attachment"},"off_tech_id":{"type":"literal","value":"T0865"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0865"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0108"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"DHCP Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"DHCP Spoofing"},"off_tech_id":{"type":"literal","value":"T1557.003"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Adversary-in-the-Middle"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"DHCP Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"DHCP Spoofing"},"off_tech_id":{"type":"literal","value":"T1557.003"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Adversary-in-the-Middle"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Web Service"},"off_tech_id":{"type":"literal","value":"T1567"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_id":{"type":"literal","value":"T1197"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Automated Exfiltration"},"off_tech_id":{"type":"literal","value":"T1020"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1020"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Alternative Protocol"},"off_tech_id":{"type":"literal","value":"T1048"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Drive-by Compromise"},"off_tech_id":{"type":"literal","value":"T0817"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0817"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0108"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Data Transfer Size Limits"},"off_tech_id":{"type":"literal","value":"T1030"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1030"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Scheduled Transfer"},"off_tech_id":{"type":"literal","value":"T1029"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1029"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over C2 Channel"},"off_tech_id":{"type":"literal","value":"T1041"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_id":{"type":"literal","value":"T1197"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_id":{"type":"literal","value":"T1197"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Stealth Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Stealth"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StealthTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Web Protocols"},"off_tech_id":{"type":"literal","value":"T1071.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Web Service"},"off_tech_id":{"type":"literal","value":"T1102"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"RPC Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Kerberoasting"},"off_tech_id":{"type":"literal","value":"T1558.003"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exploit Public-Facing Application"},"off_tech_id":{"type":"literal","value":"T1190"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Reflection Amplification"},"off_tech_id":{"type":"literal","value":"T1498.002"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Network Denial of Service"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Service Exhaustion Flood"},"off_tech_id":{"type":"literal","value":"T1499.002"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Endpoint Denial of Service"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1499"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Service Exhaustion Flood"},"off_tech_id":{"type":"literal","value":"T1499.002"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Network Denial of Service"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exploit Public-Facing Application"},"off_tech_id":{"type":"literal","value":"T0819"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0819"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0108"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"External Remote Services"},"off_tech_id":{"type":"literal","value":"T0822"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0822"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0108"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Direct Network Flood"},"off_tech_id":{"type":"literal","value":"T1498.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Network Denial of Service"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Web Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_id":{"type":"literal","value":"T1550.004"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Web Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Browser Session Hijacking"},"off_tech_id":{"type":"literal","value":"T1185"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1185"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"DNS"},"off_tech_id":{"type":"literal","value":"T1071.004"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Dynamic Resolution"},"off_tech_id":{"type":"literal","value":"T1568"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote Access Tools"},"off_tech_id":{"type":"literal","value":"T1219"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Data Obfuscation"},"off_tech_id":{"type":"literal","value":"T1001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Multi-Stage Channels"},"off_tech_id":{"type":"literal","value":"T1104"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Fallback Channels"},"off_tech_id":{"type":"literal","value":"T1008"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Data Encoding"},"off_tech_id":{"type":"literal","value":"T1132"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Non-Application Layer Protocol"},"off_tech_id":{"type":"literal","value":"T1095"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Multi-hop Proxy"},"off_tech_id":{"type":"literal","value":"T1090.003"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Proxy"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Unencrypted Non-C2 Protocol"},"off_tech_id":{"type":"literal","value":"T1048.003"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Alternative Protocol"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Ingress Tool Transfer"},"off_tech_id":{"type":"literal","value":"T1105"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_id":{"type":"literal","value":"T1071"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Protocol Tunneling"},"off_tech_id":{"type":"literal","value":"T1572"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Non-Standard Port"},"off_tech_id":{"type":"literal","value":"T1571"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"External Proxy"},"off_tech_id":{"type":"literal","value":"T1090.002"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Proxy"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Connection Proxy"},"off_tech_id":{"type":"literal","value":"T0884"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0884"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSCommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0101"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet IPC Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_id":{"type":"literal","value":"T1197"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet IPC Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_id":{"type":"literal","value":"T1197"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet IPC Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_id":{"type":"literal","value":"T1197"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Stealth Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Stealth"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StealthTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"OT Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Denial of Service"},"off_tech_id":{"type":"literal","value":"T0814"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Inhibit Response Function Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Inhibit Response Function"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OTNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0814"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInhibitResponseFunctionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0107"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet File Transfer Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Lateral Tool Transfer"},"off_tech_id":{"type":"literal","value":"T1570"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet File Transfer Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"File Transfer Protocols"},"off_tech_id":{"type":"literal","value":"T1071.002"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Web Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_id":{"type":"literal","value":"T1197"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Web Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_id":{"type":"literal","value":"T1197"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Web Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_id":{"type":"literal","value":"T1197"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Stealth Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Stealth"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StealthTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Mail Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Mail Protocols"},"off_tech_id":{"type":"literal","value":"T1071.003"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_id":{"type":"literal","value":"T1546.008"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]}},"description":{"@context":{"rdfs":"http://www.w3.org/2000/01/rdf-schema#","owl":"http://www.w3.org/2002/07/owl#","d3f":"http://d3fend.mitre.org/ontologies/d3fend.owl#","skos":"http://www.w3.org/2004/02/skos/core#"},"@graph":[{"@id":"d3f:UserGeolocationLogonPatternAnalysis","@type":["d3f:UserGeolocationLogonPatternAnalysis","owl:NamedIndividual","owl:Class"],"d3f:analyzes":{"@id":"d3f:NetworkTraffic"},"d3f:d3fend-id":"D3-UGLPA","d3f:definition":"Monitoring geolocation data of user logon attempts and comparing it to a baseline user behavior profile to identify anomalies in logon location.","d3f:kb-article":"## How it works\nGeolocation data for each user logon attempt is collected and used to create a baseline user behavior profile. Current geolocation logon data is then compared against the user behavior profile. Logon activity that deviates from normal patterns and can help in identifying situations that may be indicative of a remote attacker using stolen credentials. For example:\n\n* logons from locations that are different from where a user usually logs in\n* logons from a location in which an enterprise has no users located\n* logon that is not physically possible given the elapsed time since a logon from another location.\n\n## Considerations\n* Potential for false positives from logon anomalies that are not associated with malicious activity.\n* Attackers may not differentiate their logon behavior enough to trigger an alert.","d3f:kb-reference":[{"@id":"d3f:Reference-System,Method,AndComputerProgramProductForDetectingAndAssessingSecurityRisksInANetwork_ExabeamInc"},{"@id":"d3f:Reference-MethodAndApparatusForNetworkFraudDetectionAndRemediationThroughAnalytics_IdaptiveLLC"}],"rdfs:label":"User Geolocation Logon Pattern Analysis","rdfs:subClassOf":{"@id":"d3f:UserBehaviorAnalysis"}}]},"digital_artifacts":{"head":{"vars":["query_def_tech_label","top_def_tech_label","def_tech_label","def_artifact_rel_label","def_artifact_label","def_tactic","def_tactic_rel","def_tech","def_artifact_rel","def_artifact"]},"results":{"bindings":[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"}}]}},"subtechniques":{"@context":{"rdfs":"http://www.w3.org/2000/01/rdf-schema#","owl":"http://www.w3.org/2002/07/owl#","d3f":"http://d3fend.mitre.org/ontologies/d3fend.owl#","skos":"http://www.w3.org/2004/02/skos/core#"},"@graph":[]},"weaknesses":{"head":{"vars":["query_def_tech_label","top_def_tech_label","def_tactic_label","def_tactic_rel_label","def_tech_label","def_artifact_rel_label","def_artifact_label","weak_artifact_label","weak_artifact_rel_label","weak_label","def_tactic","def_tactic_rel","def_tech","def_artifact_rel","def_artifact","weak_artifact","weak_artifact_rel","weak","weak_id"]},"results":{"bindings":[]}},"related_offensive_matrix":{"Persistence":[["Event Triggered Execution",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_id":{"type":"literal","value":"T1546.008"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Windows Management Instrumentation Event Subscription"},"off_tech_id":{"type":"literal","value":"T1546.003"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Account Manipulation",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Additional Cloud Credentials"},"off_tech_id":{"type":"literal","value":"T1098.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Pre-OS Boot",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"TFTP Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"TFTP Boot"},"off_tech_id":{"type":"literal","value":"T1542.005"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Traffic Signaling",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Port Knocking"},"off_tech_id":{"type":"literal","value":"T1205.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_id":{"type":"literal","value":"T1205"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["BITS Jobs",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_id":{"type":"literal","value":"T1197"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet IPC Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_id":{"type":"literal","value":"T1197"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Web Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_id":{"type":"literal","value":"T1197"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Persistence Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Persistence"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#PersistenceTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0003"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]]],"Lateral Movement":[["Remote Services",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"SSH"},"off_tech_id":{"type":"literal","value":"T1021.004"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Remote Services"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote Services"},"off_tech_id":{"type":"literal","value":"T0886"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0886"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSLateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0109"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote Services"},"off_tech_id":{"type":"literal","value":"T1021"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote Desktop Protocol"},"off_tech_id":{"type":"literal","value":"T1021.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Remote Services"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1021.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1021"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Exploitation of Remote Services",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exploitation of Remote Services"},"off_tech_id":{"type":"literal","value":"T1210"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1210"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exploitation of Remote Services"},"off_tech_id":{"type":"literal","value":"T0866"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0866"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSLateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0109"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}}]],["Use Alternate Authentication Material",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Application Access Token"},"off_tech_id":{"type":"literal","value":"T1550.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Web Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Web Session Cookie"},"off_tech_id":{"type":"literal","value":"T1550.004"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Use Alternate Authentication Material"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1550"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Remote Service Session Hijacking",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote Service Session Hijacking"},"off_tech_id":{"type":"literal","value":"T1563"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#AdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1563"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Lateral Tool Transfer",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet File Transfer Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Lateral Tool Transfer"},"off_tech_id":{"type":"literal","value":"T1570"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Lateral Movement Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Lateral Movement"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetFileTransferTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1570"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#LateralMovementTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0008"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]]],"Privilege Escalation":[["Account Manipulation",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Additional Cloud Credentials"},"off_tech_id":{"type":"literal","value":"T1098.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Account Manipulation"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1098"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Event Triggered Execution",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Windows Management Instrumentation Event Subscription"},"off_tech_id":{"type":"literal","value":"T1546.003"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Accessibility Features"},"off_tech_id":{"type":"literal","value":"T1546.008"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Event Triggered Execution"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Privilege Escalation"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546.008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1546"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0004"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]]],"Credential Access":[["Brute Force",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Credential Stuffing"},"off_tech_id":{"type":"literal","value":"T1110.004"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Password Spraying"},"off_tech_id":{"type":"literal","value":"T1110.003"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Brute Force"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1110"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Adversary-in-the-Middle",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Multicast Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Name Resolution Poisoning and SMB Relay"},"off_tech_id":{"type":"literal","value":"T1557.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Adversary-in-the-Middle"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Adversary-in-the-Middle"},"off_tech_id":{"type":"literal","value":"T1557"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Credential Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CredentialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"DHCP Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"DHCP Spoofing"},"off_tech_id":{"type":"literal","value":"T1557.003"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Adversary-in-the-Middle"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["OS Credential Dumping",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"DCSync"},"off_tech_id":{"type":"literal","value":"T1003.006"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"OS Credential Dumping"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003.006"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1003"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Steal or Forge Kerberos Tickets",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"RPC Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Kerberoasting"},"off_tech_id":{"type":"literal","value":"T1558.003"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Steal or Forge Kerberos Tickets"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Credential Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#RPCNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1558"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0006"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]]],"Defense Impairment":[["Rogue Domain Controller",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Rogue Domain Controller"},"off_tech_id":{"type":"literal","value":"T1207"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Defense Impairment Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Defense Impairment"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1207"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DefenseImpairmentTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0112"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]]],"Exfiltration":[["Exfiltration Over Other Network Medium",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Other Network Medium"},"off_tech_id":{"type":"literal","value":"T1011"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1011"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Exfiltration Over Web Service",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration to Cloud Storage"},"off_tech_id":{"type":"literal","value":"T1567.002"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Web Service"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Exfiltration to Code Repository"},"off_tech_id":{"type":"literal","value":"T1567.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Web Service"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Remote Terminal Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Exfiltration to Code Repository"},"off_tech_id":{"type":"literal","value":"T1567.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Web Service"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedRemoteTerminalTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Web Service"},"off_tech_id":{"type":"literal","value":"T1567"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1567"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Exfiltration Over Alternative Protocol",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Symmetric Encrypted Non-C2 Protocol"},"off_tech_id":{"type":"literal","value":"T1048.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Alternative Protocol"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"},"off_tech_id":{"type":"literal","value":"T1048.002"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Alternative Protocol"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Alternative Protocol"},"off_tech_id":{"type":"literal","value":"T1048"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over Unencrypted Non-C2 Protocol"},"off_tech_id":{"type":"literal","value":"T1048.003"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Over Alternative Protocol"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1048"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Automated Exfiltration",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Automated Exfiltration"},"off_tech_id":{"type":"literal","value":"T1020"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1020"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Data Transfer Size Limits",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Data Transfer Size Limits"},"off_tech_id":{"type":"literal","value":"T1030"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1030"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Scheduled Transfer",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Scheduled Transfer"},"off_tech_id":{"type":"literal","value":"T1029"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1029"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Exfiltration Over C2 Channel",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exfiltration Over C2 Channel"},"off_tech_id":{"type":"literal","value":"T1041"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Exfiltration Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Exfiltration"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1041"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExfiltrationTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0010"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]]],"Initial Access":[["Drive-by Compromise",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Drive-by Compromise"},"off_tech_id":{"type":"literal","value":"T1189"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1189"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Drive-by Compromise"},"off_tech_id":{"type":"literal","value":"T0817"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0817"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0108"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}}]],["Remote Services",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote Services"},"off_tech_id":{"type":"literal","value":"T0886"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0886"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0108"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}}]],["Trusted Relationship",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Trusted Relationship"},"off_tech_id":{"type":"literal","value":"T1199"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1199"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Exploitation of Remote Services",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exploitation of Remote Services"},"off_tech_id":{"type":"literal","value":"T0866"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0866"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0108"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}}]],["Rogue Master",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Rogue Master"},"off_tech_id":{"type":"literal","value":"T0848"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0848"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0108"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"monitors"},"off_tech_label":{"type":"literal","value":"Rogue Master"},"off_tech_id":{"type":"literal","value":"T0848"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0848"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0108"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}}]],["Phishing",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Mail Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Attachment"},"off_tech_id":{"type":"literal","value":"T1566.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Mail Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Link"},"off_tech_id":{"type":"literal","value":"T1566.002"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Phishing"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1566"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Spearphishing Attachment",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Mail Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Spearphishing Attachment"},"off_tech_id":{"type":"literal","value":"T0865"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetMailTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0865"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0108"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}}]],["Exploit Public-Facing Application",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exploit Public-Facing Application"},"off_tech_id":{"type":"literal","value":"T1190"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1190"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0001"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Exploit Public-Facing Application"},"off_tech_id":{"type":"literal","value":"T0819"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0819"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0108"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}}]],["External Remote Services",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"External Remote Services"},"off_tech_id":{"type":"literal","value":"T0822"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Initial Access Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Initial Access"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0822"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInitialAccessTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0108"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}}]]],"Command and Control":[["Proxy",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Domain Fronting"},"off_tech_id":{"type":"literal","value":"T1090.004"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Proxy"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Internal Proxy"},"off_tech_id":{"type":"literal","value":"T1090.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Proxy"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Multi-hop Proxy"},"off_tech_id":{"type":"literal","value":"T1090.003"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Proxy"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"External Proxy"},"off_tech_id":{"type":"literal","value":"T1090.002"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Proxy"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1090"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Connection Proxy",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Connection Proxy"},"off_tech_id":{"type":"literal","value":"T0884"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0884"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSCommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0101"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Connection Proxy"},"off_tech_id":{"type":"literal","value":"T0884"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0884"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSCommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0101"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}}]],["Encrypted Channel",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Symmetric Cryptography"},"off_tech_id":{"type":"literal","value":"T1573.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Encrypted Channel"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Asymmetric Cryptography"},"off_tech_id":{"type":"literal","value":"T1573.002"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Encrypted Channel"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Encrypted Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Encrypted Channel"},"off_tech_id":{"type":"literal","value":"T1573"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetEncryptedTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1573"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Standard Application Layer Protocol",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Standard Application Layer Protocol"},"off_tech_id":{"type":"literal","value":"T0869"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0869"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSCommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0101"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}}]],["Traffic Signaling",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Port Knocking"},"off_tech_id":{"type":"literal","value":"T1205.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_id":{"type":"literal","value":"T1205"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Commonly Used Port",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Commonly Used Port"},"off_tech_id":{"type":"literal","value":"T0885"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0885"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSCommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0101"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}}]],["Application Layer Protocol",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Web Protocols"},"off_tech_id":{"type":"literal","value":"T1071.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"DNS"},"off_tech_id":{"type":"literal","value":"T1071.004"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.004"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_id":{"type":"literal","value":"T1071"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet File Transfer Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"File Transfer Protocols"},"off_tech_id":{"type":"literal","value":"T1071.002"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetFileTransferTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Mail Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Mail Protocols"},"off_tech_id":{"type":"literal","value":"T1071.003"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Application Layer Protocol"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetMailTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1071"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Web Service",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Web Service"},"off_tech_id":{"type":"literal","value":"T1102"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1102"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Dynamic Resolution",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet DNS Lookup Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Dynamic Resolution"},"off_tech_id":{"type":"literal","value":"T1568"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetDNSLookupTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1568"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Remote Access Tools",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote Access Tools"},"off_tech_id":{"type":"literal","value":"T1219"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1219"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Data Obfuscation",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Data Obfuscation"},"off_tech_id":{"type":"literal","value":"T1001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Multi-Stage Channels",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Multi-Stage Channels"},"off_tech_id":{"type":"literal","value":"T1104"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1104"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Fallback Channels",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Fallback Channels"},"off_tech_id":{"type":"literal","value":"T1008"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1008"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Data Encoding",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Data Encoding"},"off_tech_id":{"type":"literal","value":"T1132"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1132"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Non-Application Layer Protocol",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Non-Application Layer Protocol"},"off_tech_id":{"type":"literal","value":"T1095"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1095"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Ingress Tool Transfer",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Ingress Tool Transfer"},"off_tech_id":{"type":"literal","value":"T1105"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1105"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Protocol Tunneling",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Protocol Tunneling"},"off_tech_id":{"type":"literal","value":"T1572"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1572"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Non-Standard Port",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Non-Standard Port"},"off_tech_id":{"type":"literal","value":"T1571"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Command and Control Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Command and Control"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1571"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CommandAndControlTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0011"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]]],"Stealth":[["Pre-OS Boot",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"TFTP Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"TFTP Boot"},"off_tech_id":{"type":"literal","value":"T1542.005"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Pre-OS Boot"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Stealth"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TFTPNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542.005"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1542"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Traffic Signaling",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Port Knocking"},"off_tech_id":{"type":"literal","value":"T1205.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Stealth"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Traffic Signaling"},"off_tech_id":{"type":"literal","value":"T1205"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Stealth Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Stealth"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1205"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StealthTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["System Binary Proxy Execution",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"CMSTP"},"off_tech_id":{"type":"literal","value":"T1218.003"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"System Binary Proxy Execution"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Stealth"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1218"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["BITS Jobs",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_id":{"type":"literal","value":"T1197"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Stealth Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Stealth"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StealthTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet IPC Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_id":{"type":"literal","value":"T1197"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Stealth Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Stealth"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StealthTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Web Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_id":{"type":"literal","value":"T1197"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Stealth Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Stealth"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#StealthTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0005"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]]],"Collection":[["Adversary-in-the-Middle",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Multicast Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Name Resolution Poisoning and SMB Relay"},"off_tech_id":{"type":"literal","value":"T1557.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Adversary-in-the-Middle"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetMulticastNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Adversary-in-the-Middle"},"off_tech_id":{"type":"literal","value":"T1557"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Adversary-in-the-Middle"},"off_tech_id":{"type":"literal","value":"T0830"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0830"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSCollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0100"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"DHCP Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"DHCP Spoofing"},"off_tech_id":{"type":"literal","value":"T1557.003"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Adversary-in-the-Middle"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DHCPNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557.003"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1557"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Browser Session Hijacking",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Web Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Browser Session Hijacking"},"off_tech_id":{"type":"literal","value":"T1185"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Collection Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Collection"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#WebNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1185"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#CollectionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0009"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]]],"Discovery":[["Network Connection Enumeration",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"monitors"},"off_tech_label":{"type":"literal","value":"Network Connection Enumeration"},"off_tech_id":{"type":"literal","value":"T0840"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0840"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSDiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0102"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}}]],["Remote System Discovery",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote System Discovery"},"off_tech_id":{"type":"literal","value":"T1018"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1018"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#DiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0007"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"monitors"},"off_tech_label":{"type":"literal","value":"Remote System Discovery"},"off_tech_id":{"type":"literal","value":"T0846"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0846"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSDiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0102"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}}]],["Remote System Information Discovery",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Remote System Information Discovery"},"off_tech_id":{"type":"literal","value":"T0888"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0888"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSDiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0102"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}}]],["Network Sniffing",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"monitors"},"off_tech_label":{"type":"literal","value":"Network Sniffing"},"off_tech_id":{"type":"literal","value":"T0842"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Discovery Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Discovery"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#monitors"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0842"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSDiscoveryTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0102"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}}]]],"Execution":[["Autorun Image",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"Autorun Image"},"off_tech_id":{"type":"literal","value":"T0895"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0895"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0104"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}}]],["Windows Management Instrumentation",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Administrative Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-create"},"off_tech_label":{"type":"literal","value":"Windows Management Instrumentation"},"off_tech_id":{"type":"literal","value":"T1047"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetAdministrativeNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-create"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1047"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["User Execution",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Malicious Link"},"off_tech_id":{"type":"literal","value":"T1204.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"User Execution"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1204"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["BITS Jobs",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Outbound Internet Web Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_id":{"type":"literal","value":"T1197"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OutboundInternetWebTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet IPC Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_id":{"type":"literal","value":"T1197"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetIPCNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Intranet Web Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"BITS Jobs"},"off_tech_id":{"type":"literal","value":"T1197"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Execution Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Execution"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#IntranetWebNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1197"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ExecutionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0002"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]]],"Evasion":[["System Binary Proxy Execution",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-produce"},"off_tech_label":{"type":"literal","value":"System Binary Proxy Execution"},"off_tech_id":{"type":"literal","value":"T0894"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Evasion Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Evasion"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-produce"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0894"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSEvasionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0103"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}}]]],"Impact":[["Data Manipulation",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"may-modify"},"off_tech_label":{"type":"literal","value":"Transmitted Data Manipulation"},"off_tech_id":{"type":"literal","value":"T1565.002"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Data Manipulation"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#may-modify"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1565"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Network Denial of Service",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Reflection Amplification"},"off_tech_id":{"type":"literal","value":"T1498.002"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Network Denial of Service"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Service Exhaustion Flood"},"off_tech_id":{"type":"literal","value":"T1499.002"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Network Denial of Service"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}},{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"creates"},"off_tech_label":{"type":"literal","value":"Direct Network Flood"},"off_tech_id":{"type":"literal","value":"T1498.001"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Network Denial of Service"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#creates"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498.001"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1498"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]],["Endpoint Denial of Service",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"Inbound Internet Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Service Exhaustion Flood"},"off_tech_id":{"type":"literal","value":"T1499.002"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKEnterpriseTechnique"},"off_tech_parent_label":{"type":"literal","value":"Endpoint Denial of Service"},"off_tech_parent_is_toplevel":{"type":"literal","value":"false","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Impact"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#InboundInternetNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1499.002"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T1499"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0040"},"framework_key":{"type":"literal","value":"enterprise"},"framework_label":{"type":"literal","value":"Enterprise"},"framework_root":{"type":"literal","value":"d3f:ATTACKEnterpriseTechnique"}}]]],"Inhibit Response Function":[["Denial of Service",[{"query_def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"top_def_tech_label":{"type":"literal","value":"User Behavior Analysis"},"def_tactic_label":{"type":"literal","value":"Detect"},"def_tactic_rel_label":{"type":"literal","value":"enables"},"def_tech_label":{"type":"literal","value":"User Geolocation Logon Pattern Analysis"},"def_artifact_rel_label":{"type":"literal","value":"analyzes"},"def_artifact_label":{"type":"literal","value":"Network Traffic"},"off_artifact_label":{"type":"literal","value":"OT Network Traffic"},"off_artifact_rel_label":{"type":"literal","value":"produces"},"off_tech_label":{"type":"literal","value":"Denial of Service"},"off_tech_id":{"type":"literal","value":"T0814"},"framework_root_iri":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSTechnique"},"off_tech_parent_label":{"type":"literal","value":"Inhibit Response Function Technique"},"off_tech_parent_is_toplevel":{"type":"literal","value":"true","datatype":"http://www.w3.org/2001/XMLSchema#boolean"},"off_tactic_rel_label":{"type":"literal","value":"enables"},"off_tactic_label":{"type":"literal","value":"Inhibit Response Function"},"def_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#Detect"},"def_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"def_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#UserGeolocationLogonPatternAnalysis"},"def_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#analyzes"},"def_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#NetworkTraffic"},"off_artifact":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#OTNetworkTraffic"},"off_artifact_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#produces"},"off_tech":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#T0814"},"off_tech_parent":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#ATTACKICSInhibitResponseFunctionTechnique"},"off_tactic_rel":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#enables"},"off_tactic":{"type":"uri","value":"http://d3fend.mitre.org/ontologies/d3fend.owl#TA0107"},"framework_key":{"type":"literal","value":"ics"},"framework_label":{"type":"literal","value":"ICS"},"framework_root":{"type":"literal","value":"d3f:ATTACKICSTechnique"}}]]]},"references":{"@context":{"rdfs":"http://www.w3.org/2000/01/rdf-schema#","d3f":"http://d3fend.mitre.org/ontologies/d3fend.owl#"},"@graph":[{"@id":"d3f:Reference-MethodAndApparatusForNetworkFraudDetectionAndRemediationThroughAnalytics_IdaptiveLLC","@type":["d3f:PatentReference","http://www.w3.org/2002/07/owl#NamedIndividual"],"d3f:has-link":{"@type":"http://www.w3.org/2001/XMLSchema#anyURI","@value":"https://patents.google.com/patent/US20190081968A1/en"},"d3f:kb-abstract":"A system and method for assessing the identity fraud risk of an entity's (a user's, computer process's, or device's) behavior within a computer network and then to take appropriate action. The system uses real-time machine learning for its assessment. It records the entity's log-in behavior (conditions at log-in) and behavior once logged in to create an entity profile that helps identify behavior patterns. The system compares new entity behavior with the entity profile to determine a risk score and a confidence level for the behavior. If the risk score and confidence level indicate a credible identity fraud risk at log-in, the system can require more factors of authentication before log-in succeeds. If the system detects risky behavior after log-in, it can take remedial action such as ending the entity's session, curtailing the entity's privileges, or notifying a human administrator.","d3f:kb-author":"Yanlin Wang; Weizhi Li","d3f:kb-mitre-analysis":"This patent describes determining a confidence score to detect anomalies in user activity based on comparing a user's behavior profile with current user activity events.  The following types of events are used to develop a user entity profile:\n\n* logon and logoff times and locations\n* starting or ending applications\n* reading or writing files\n* changing an entity 's authorization\n* monitoring network traffic\n\nUser events that deviate from the entity profile over a certain threshold trigger a remedial action.","d3f:kb-organization":"Idaptive LLC","d3f:kb-reference-of":[{"@id":"d3f:ResourceAccessPatternAnalysis"},{"@id":"d3f:UserGeolocationLogonPatternAnalysis"},{"@id":"d3f:AuthorizationEventThresholding"},{"@id":"d3f:AuthenticationEventThresholding"},{"@id":"d3f:SessionDurationAnalysis"}],"d3f:kb-reference-title":"Method and Apparatus for Network Fraud Detection and Remediation Through Analytics","d3f:reference-type-label":"Patent","rdfs:label":"Reference - Method and Apparatus for Network Fraud Detection and Remediation Through Analytics - Idaptive LLC"},{"@id":"d3f:Reference-System,Method,AndComputerProgramProductForDetectingAndAssessingSecurityRisksInANetwork_ExabeamInc","@type":["d3f:PatentReference","http://www.w3.org/2002/07/owl#NamedIndividual"],"d3f:has-link":{"@type":"http://www.w3.org/2001/XMLSchema#anyURI","@value":"https://patents.google.com/patent/US20190034641A1"},"d3f:kb-abstract":"The present disclosure is directed to a system, method, and computer program for detecting and assessing security risks in an enterprise's computer network. A behavior model is built for a user in the network based on the user's interactions with the network, wherein a behavior model for a user indicates client device(s), server(s), and resources used by the user. The user's behavior during a period of time is compared to the user's behavior model. A risk assessment is calculated for the period of time based at least in part on the comparison between the user's behavior and the user's behavior model, wherein any one of certain anomalies between the user's behavior and the user's behavior model increase the risk assessment.","d3f:kb-author":"Sylvain Gil; Domingo Mihovilovic; Nir Polak; Magnus Stensmo; Sing Yip","d3f:kb-mitre-analysis":"This patent describes calculating a risk score to detect anomalies in user activity based on comparing a user's current session with a user behavior model. The user behavior model is comprised of a number of histograms including:\n\n* client devices from which the user logs in\n* servers accessed\n* data accessed\n* applications accessed\n* session duration\n* logon time of day\n* logon day of week\n* geo - location of logon origination\n\nThe system has an initial training period with x number of days (e. g., 90 days) in which session data is recorded in behavior models before behavior analysis begins.The histograms are then used to determine anomalies between current session activity and a user's behavior model. Values for a histogram category are along one axis and the number of times the value is received for the category is along another axis. If a data point value associated with the current user session is over an anomaly threshold, an alert is generated.","d3f:kb-organization":"Exabeam Inc","d3f:kb-reference-of":[{"@id":"d3f:ResourceAccessPatternAnalysis"},{"@id":"d3f:UserGeolocationLogonPatternAnalysis"},{"@id":"d3f:AuthorizationEventThresholding"},{"@id":"d3f:AuthenticationEventThresholding"},{"@id":"d3f:SessionDurationAnalysis"}],"d3f:kb-reference-title":"System, method, and computer program product for detecting and assessing security risks in a network","d3f:reference-type-label":"Patent","rdfs:label":"Reference - System, method, and computer program product for detecting and assessing security risks in a network - Exabeam Inc"}]},"references_meta":{"Patent":2}}