ATT&CK v12.1 ICS

2022-11-08 09:49:29 -05:00
parent 2b248218b6
commit 17c6c4110d
1009 changed files with 15964 additions and 15898 deletions
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--a391ade0-f389-47ab-a67a-3980cbe7a0a9",
+    "id": "bundle--3ed86b73-94ae-43ea-8502-71f21009e062",
    "spec_version": "2.0",
    "objects": [
        {
@@ -24,12 +24,11 @@
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "2.1.0",
            "x_mitre_data_sources": [
-                "Network Traffic: Network Traffic Flow",
-                "Network Traffic: Network Connection Creation",
                "Application Log: Application Log Content",
+                "Network Traffic: Network Traffic Flow",
+                "Operational Databases: Process/Event Alarm",
                "Process: Process Termination",
-                "Operational Databases: Process History/Live Data",
-                "Operational Databases: Process/Event Alarm"
+                "Operational Databases: Process History/Live Data"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--008b8f56-6107-48be-aa9f-746f927dbb61",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--cd148189-a10c-4856-ab75-2a4e4dcd6f24",
+    "id": "bundle--acdb8c43-cb0d-4b3b-bf93-4cc71ebcc19f",
    "spec_version": "2.0",
    "objects": [
        {
@@ -26,13 +26,13 @@
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "2.1.0",
            "x_mitre_data_sources": [
-                "Command: Command Execution",
-                "File: File Modification",
-                "Process: OS API Execution",
-                "Process: Process Creation",
                "Process: Process Termination",
+                "File: File Modification",
                "Service: Service Metadata",
-                "Windows Registry: Windows Registry Key Modification"
+                "Process: Process Creation",
+                "Windows Registry: Windows Registry Key Modification",
+                "Command: Command Execution",
+                "Process: OS API Execution"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--12f5fb34-04e2-4412-ae17-011744a3b94a",
+    "id": "bundle--0be25f1f-1c06-4bf5-b67d-28eaab873b54",
    "spec_version": "2.0",
    "objects": [
        {
@@ -27,10 +27,10 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
-                "Network Traffic: Network Traffic Content",
                "Application Log: Application Log Content",
-                "Operational Databases: Device Alarm",
-                "Asset: Device Configuration/Parameters"
+                "Network Traffic: Network Traffic Content",
+                "Asset: Asset Inventory",
+                "Operational Databases: Device Alarm"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--48656c2f-b08a-434f-be8a-ed9d96a2089f",
+    "id": "bundle--531427e6-2f50-4050-8ba4-3a1aa4466238",
    "spec_version": "2.0",
    "objects": [
        {
@@ -24,8 +24,9 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
-                "File: File Modification",
-                "Asset: Software/Firmware"
+                "Asset: Software",
+                "Operational Databases: Device Alarm",
+                "Application Log: Application Log Content"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--09a61657-46e1-439e-b3ed-3e4556a78243",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--6ffbecf6-8cef-4e0d-97cf-d93381c8b46e",
+    "id": "bundle--1b55e587-a223-4fad-b2db-8b63db804d8a",
    "spec_version": "2.0",
    "objects": [
        {
@@ -30,6 +30,9 @@
            "x_mitre_contributors": [
                "ICSCoE Japan"
            ],
+            "x_mitre_data_sources": [
+                "Network Traffic: Network Traffic Flow"
+            ],
            "type": "attack-pattern",
            "id": "attack-pattern--0fe075d5-beac-4d02-b93e-0f874997db72",
            "created": "2020-05-21T17:43:26.506Z",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--ce2804b6-d383-4897-89a0-af3346d738e6",
+    "id": "bundle--23689b6b-66e9-4aec-a391-3a787821a3a4",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--cd58f98d-014c-4025-8329-924bb6d3338a",
+    "id": "bundle--4d05480d-eeff-4f26-8826-6a8841396047",
    "spec_version": "2.0",
    "objects": [
        {
@@ -27,9 +27,9 @@
                "Joe Slowik - Dragos"
            ],
            "x_mitre_data_sources": [
-                "Network Traffic: Network Traffic Content",
                "Application Log: Application Log Content",
-                "Operational Databases: Device Alarm"
+                "Operational Databases: Device Alarm",
+                "Network Traffic: Network Traffic Content"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--19a71d1e-6334-4233-8260-b749cae37953",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--853f1130-0a7b-4dc1-9099-d5352bb3cc73",
+    "id": "bundle--c6066e64-b965-4ac5-aa75-963f21308464",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--2bad4db0-5e69-4071-b23e-0ac4942bdfe2",
+    "id": "bundle--456ff2b3-ac9a-4d5e-9a26-f4902a3c88cd",
    "spec_version": "2.0",
    "objects": [
        {
@@ -25,10 +25,10 @@
            ],
            "x_mitre_version": "1.0",
            "x_mitre_data_sources": [
-                "Application Log: Application Log Content",
-                "Network Traffic: Network Traffic Content",
                "Network Traffic: Network Traffic Flow",
-                "Operational Databases: Process History/Live Data"
+                "Operational Databases: Process History/Live Data",
+                "Application Log: Application Log Content",
+                "Network Traffic: Network Traffic Content"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--f404f518-de37-4d9b-927b-4c24b4f0f099",
+    "id": "bundle--ec11a42e-768c-4d23-8d60-84f012ddac0d",
    "spec_version": "2.0",
    "objects": [
        {
@@ -27,11 +27,10 @@
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
                "Network Traffic: Network Traffic Flow",
-                "Network Traffic: Network Connection Creation",
-                "Application Log: Application Log Content",
                "Process: Process Termination",
                "Operational Databases: Process History/Live Data",
-                "Operational Databases: Process/Event Alarm"
+                "Operational Databases: Process/Event Alarm",
+                "Application Log: Application Log Content"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--1c478716-71d9-46a4-9a53-fa5d576adb60",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--57afb223-6de8-4d36-89d4-615a2939536b",
+    "id": "bundle--746ada9a-0e22-4bad-8d43-de3825db23d5",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--6d226e1f-c004-4add-821a-79f67ce4c3ad",
+    "id": "bundle--72bd4f44-614b-4c4e-a2fc-25d2ceaddf2a",
    "spec_version": "2.0",
    "objects": [
        {
@@ -28,11 +28,9 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
-                "Command: Command Execution",
                "Process: Process Creation",
-                "Module: Module Load",
-                "Process: Process Creation",
-                "Script: Script Execution"
+                "Application Log: Application Log Content",
+                "Command: Command Execution"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--24a9253e-8948-4c98-b751-8e2aee53127c",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--e4214373-10eb-4fd8-800d-02b7597fe7ac",
+    "id": "bundle--2967b009-7e20-4151-a9b2-5b9f3c68664b",
    "spec_version": "2.0",
    "objects": [
        {
@@ -29,7 +29,8 @@
                "Jos Wetzels - Midnight Blue"
            ],
            "x_mitre_data_sources": [
-                "Network Traffic: Network Traffic Content"
+                "Network Traffic: Network Traffic Content",
+                "Application Log: Application Log Content"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--fa25bcea-2b3f-4630-b4b0-08377589d87d",
+    "id": "bundle--e2f5fb32-8bca-425b-8476-d45900862ad3",
    "spec_version": "2.0",
    "objects": [
        {
@@ -25,8 +25,9 @@
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
                "Network Traffic: Network Traffic Content",
+                "Operational Databases: Device Alarm",
                "Application Log: Application Log Content",
-                "Operational Databases: Device Alarm"
+                "Network Traffic: Network Traffic Flow"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--ea8467ed-3f9c-4878-a4ff-f7c01684a7ff",
+    "id": "bundle--2fb12c31-965c-402f-9f47-9720279e291e",
    "spec_version": "2.0",
    "objects": [
        {
@@ -25,12 +25,12 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
-                "Application Log: Application Log Content",
-                "Command: Command Execution",
-                "File: File Creation",
-                "Network Traffic: Network Connection Creation",
                "Network Traffic: Network Traffic Content",
-                "Process: Process Creation"
+                "Command: Command Execution",
+                "Application Log: Application Log Content",
+                "Network Traffic: Network Connection Creation",
+                "Process: Process Creation",
+                "File: File Access"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--2736b752-4ec5-4421-a230-8977dea7649c",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--af1a3d5c-5356-4acd-b85a-583ca580a0d1",
+    "id": "bundle--3c239467-196a-4ef0-a947-3a95a7525fdf",
    "spec_version": "2.0",
    "objects": [
        {
@@ -30,8 +30,8 @@
            ],
            "x_mitre_data_sources": [
                "Network Traffic: Network Traffic Flow",
-                "Application Log: Application Log Content",
-                "Logon Session: Logon Session Creation"
+                "Logon Session: Logon Session Creation",
+                "Application Log: Application Log Content"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--2877063e-1851-48d2-bcc6-bc1d2733157e",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--c3f8b07a-d036-4c60-ba71-64ffe7815488",
+    "id": "bundle--4a609c7b-4fe1-4d50-ad77-095baa5cf61e",
    "spec_version": "2.0",
    "objects": [
        {
@@ -64,8 +64,8 @@
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_data_sources": [
-                "Network Traffic: Network Traffic Content",
                "Application Log: Application Log Content",
+                "Network Traffic: Network Traffic Content",
                "Operational Databases: Device Alarm"
            ],
            "x_mitre_attack_spec_version": "2.1.0",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--0b8265be-4b69-4b6d-ae7e-1617c2024546",
+    "id": "bundle--a383665b-8194-4425-b20b-bd4f6e469862",
    "spec_version": "2.0",
    "objects": [
        {
@@ -30,10 +30,10 @@
                "Jos Wetzels - Midnight Blue"
            ],
            "x_mitre_data_sources": [
-                "Network Traffic: Network Traffic Content",
-                "Application Log: Application Log Content",
-                "Operational Databases: Process History/Live Data",
-                "Operational Databases: Process/Event Alarm"
+                "Network Traffic: Network Traffic Flow",
+                "Operational Databases: Process/Event Alarm",
+                "Operational Databases: Device Alarm",
+                "Operational Databases: Process History/Live Data"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--2900bbd8-308a-4274-b074-5b8bde8347bc",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--e1fc90b6-4d73-4caa-aa14-9e0fdeba105f",
+    "id": "bundle--34bdd318-01b6-42a2-812c-f9c8e2177a71",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--a63caa18-adc4-41db-abc3-a7d71e010010",
+    "id": "bundle--ee9f3424-1090-4630-a0c3-3a8ee5d9f713",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--371bae5b-4cd4-412a-99db-2d9d2e408c77",
+    "id": "bundle--8cf20116-611e-4615-b5a8-b11bd39df5e6",
    "spec_version": "2.0",
    "objects": [
        {
@@ -27,6 +27,7 @@
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "2.1.0",
            "x_mitre_data_sources": [
+                "Application Log: Application Log Content",
                "Network Traffic: Network Traffic Content"
            ],
            "type": "attack-pattern",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--2adc78ab-5a17-4c4c-9d53-b7035fa1b842",
+    "id": "bundle--23c910bd-6f64-4cf7-aec5-d264ea8f44f3",
    "spec_version": "2.0",
    "objects": [
        {
@@ -24,9 +24,10 @@
            ],
            "x_mitre_version": "1.0",
            "x_mitre_data_sources": [
-                "Command: Command Execution",
                "Module: Module Load",
+                "Command: Command Execution",
                "Process: Process Creation",
+                "Process: Process Metadata",
                "Script: Script Execution"
            ],
            "type": "attack-pattern",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--9dff49c6-4aba-479c-9a17-bb066a83efba",
+    "id": "bundle--6574cede-7730-4935-b098-6666c9adc575",
    "spec_version": "2.0",
    "objects": [
        {
@@ -26,7 +26,9 @@
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
                "Network Traffic: Network Traffic Content",
-                "Application Log: Application Log Content"
+                "Network Traffic: Network Traffic Flow",
+                "Process: Process Creation",
+                "File: File Access"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--ac9ef1eb-b0c6-4791-becb-3567cbebd9f8",
+    "id": "bundle--cf245805-6ea6-4a68-a0ec-52be808cc1ce",
    "spec_version": "2.0",
    "objects": [
        {
@@ -25,6 +25,7 @@
            "x_mitre_attack_spec_version": "2.1.0",
            "x_mitre_data_sources": [
                "Application Log: Application Log Content",
+                "Network Traffic: Network Traffic Flow",
                "Network Traffic: Network Traffic Content"
            ],
            "type": "attack-pattern",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--af3fbd86-afec-49f1-8c92-9d9a8f1b242d",
+    "id": "bundle--a0334140-df2a-4d8b-9fdb-ec8ea0bfd99c",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--3ebc5e49-451a-4a72-b127-0cd0c923b21e",
+    "id": "bundle--89fdb0ad-31c6-4b4b-8ff1-81c2e3f1d8b3",
    "spec_version": "2.0",
    "objects": [
        {
@@ -27,9 +27,14 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
-                "Application Log: Application Log Content",
                "Logon Session: Logon Session Creation",
-                "File: File Access"
+                "Process: OS API Execution",
+                "Command: Command Execution",
+                "Process: Process Creation",
+                "Script: Script Execution",
+                "File: File Access",
+                "Network Share: Network Share Access",
+                "Application Log: Application Log Content"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--3405891b-16aa-4bd7-bd7c-733501f9b20f",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--083a1f9a-e03b-42de-b2cb-895d06addff9",
+    "id": "bundle--2bc15d2d-612f-43a3-be64-4ed59ff006f2",
    "spec_version": "2.0",
    "objects": [
        {
@@ -23,6 +23,10 @@
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
+            "x_mitre_data_sources": [
+                "Application Log: Application Log Content",
+                "Network Traffic: Network Traffic Flow"
+            ],
            "type": "attack-pattern",
            "id": "attack-pattern--35392fb4-a31d-4c6a-b9f2-1c65b7f5e6b9",
            "created": "2021-10-14T15:25:32.143Z",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--f7644ffa-b3d6-48c9-847c-af3c870589ff",
+    "id": "bundle--7d56e61b-30ad-417f-8f92-8b4e762e357c",
    "spec_version": "2.0",
    "objects": [
        {
@@ -24,8 +24,7 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
-                "Operational Databases: Process History/Live Data",
-                "Operational Databases: Device Alarm"
+                "Asset: Software"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--36e9f5bc-ac13-4da4-a2f4-01f4877d9004",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--c0921601-a057-40fb-a03d-c1c43fbd10c7",
+    "id": "bundle--3a40c97f-9f28-4b6b-81cd-0fa520a8d873",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--68eb6c36-c78f-43a8-accc-7056a0d74551",
+    "id": "bundle--fe4bd8e6-a400-410b-8ead-01f2dc0b05d8",
    "spec_version": "2.0",
    "objects": [
        {
@@ -28,9 +28,7 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
-                "Drive: Drive Modification",
-                "Firmware: Firmware Modification",
-                "Module: Module Load"
+                "Firmware: Firmware Modification"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--962c044d-55cb-4640-a0d2-0b0030964840",
+    "id": "bundle--74396bc4-6677-4711-888f-ee4b7f7af192",
    "spec_version": "2.0",
    "objects": [
        {
@@ -25,10 +25,10 @@
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "2.1.0",
            "x_mitre_data_sources": [
-                "Command: Command Execution",
+                "Network Traffic: Network Traffic Content",
                "File: File Access",
                "Script: Script Execution",
-                "Network Traffic: Network Traffic Content"
+                "Command: Command Execution"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--3de230d4-3e42-4041-b089-17e1128feded",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--e1cbf4d9-d8ff-4b51-969f-1dda0f3b8850",
+    "id": "bundle--ce58af5a-ad5e-4888-85f7-34923f22a280",
    "spec_version": "2.0",
    "objects": [
        {
@@ -27,11 +27,10 @@
            "x_mitre_version": "1.0",
            "x_mitre_data_sources": [
                "Network Traffic: Network Traffic Flow",
-                "Network Traffic: Network Connection Creation",
-                "Application Log: Application Log Content",
                "Process: Process Termination",
-                "Operational Databases: Process History/Live Data",
-                "Operational Databases: Process/Event Alarm"
+                "Operational Databases: Process/Event Alarm",
+                "Application Log: Application Log Content",
+                "Operational Databases: Process History/Live Data"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--3f1f4ccb-9be2-4ff8-8f69-dd972221169b",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--7457d279-d706-4948-8fed-15da32735cb0",
+    "id": "bundle--d41a0ae9-6d4a-4717-939a-e246665f44ba",
    "spec_version": "2.0",
    "objects": [
        {
@@ -24,10 +24,11 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
-                "Network Traffic: Network Traffic Content",
                "Application Log: Application Log Content",
+                "Operational Databases: Process/Event Alarm",
                "Operational Databases: Process History/Live Data",
-                "Operational Databases: Process/Event Alarm"
+                "Network Traffic: Network Traffic Flow",
+                "Network Traffic: Network Traffic Content"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--40b300ba-f553-48bf-862e-9471b220d455",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--eefadae2-4999-45f2-9325-afe9402f5fc7",
+    "id": "bundle--2e8bbec7-3480-48f7-9b47-19d78f141dee",
    "spec_version": "2.0",
    "objects": [
        {
@@ -29,10 +29,10 @@
                "Matan Dobrushin - Otorio"
            ],
            "x_mitre_data_sources": [
-                "Command: Command Execution",
-                "File: File Deletion",
                "File: File Modification",
-                "Process: Process Creation"
+                "Process: Process Creation",
+                "Command: Command Execution",
+                "File: File Deletion"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--bf4a94b4-83e0-4672-8ae9-ec873b407f5e",
+    "id": "bundle--f83225b3-daae-4b36-bead-12c56f2d6fab",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--340bec81-f2e0-4af3-b513-55ec8974d4c5",
+    "id": "bundle--326dfa4c-45d4-4755-b2cc-55ed40077b3e",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--bcf99e9d-2823-40ea-9aaa-1049aae44b61",
+    "id": "bundle--13850b23-6db4-4d7c-9d5b-7d9cb3ccc764",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--51ae6f7f-2973-4971-97a4-63aff2dd8bd0",
+    "id": "bundle--37ef02a1-f0b5-4fd6-aece-71436dc780bb",
    "spec_version": "2.0",
    "objects": [
        {
@@ -24,16 +24,14 @@
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "2.1.0",
            "x_mitre_data_sources": [
-                "Command: Command Execution",
-                "File: File Deletion",
                "File: File Metadata",
-                "File: File Modification",
-                "Network Traffic: Network Traffic Content",
-                "Process: OS API Execution",
                "Process: Process Creation",
-                "User Account: User Account Authentication",
+                "File: File Modification",
+                "Windows Registry: Windows Registry Key Modification",
+                "File: File Deletion",
+                "Command: Command Execution",
                "Windows Registry: Windows Registry Key Deletion",
-                "Windows Registry: Windows Registry Key Modification"
+                "Process: OS API Execution"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--e5146ded-1600-460d-96ba-91a3c1e3dfce",
+    "id": "bundle--c09bcd05-46cc-49c2-8059-150f3484d238",
    "spec_version": "2.0",
    "objects": [
        {
@@ -24,7 +24,7 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
-                "Asset: Software/Firmware"
+                "Asset: Software"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--53a48c74-0025-45f4-b04a-baa853df8204",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--9da6f360-a2c9-4fff-be79-7032132c7a8a",
+    "id": "bundle--41b4d4c1-461a-487f-999e-06771fc44f44",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--8349da77-f01d-4457-9a4f-3141b91ee4dc",
+    "id": "bundle--c5ed1fdc-3f24-474d-802a-9a74ab9b6824",
    "spec_version": "2.0",
    "objects": [
        {
@@ -24,8 +24,7 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
-                "Module: Module Load",
-                "Network Traffic: Network Traffic Content"
+                "Process: OS API Execution"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--d1a06160-eda9-402d-85c6-87697ac347a0",
+    "id": "bundle--3b619269-7ec0-45ac-af21-acad8602311b",
    "spec_version": "2.0",
    "objects": [
        {
@@ -28,6 +28,9 @@
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
+            "x_mitre_data_sources": [
+                "File: File Metadata"
+            ],
            "type": "attack-pattern",
            "id": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3",
            "created": "2020-05-21T17:43:26.506Z",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--d6979f12-a6dd-4b85-8819-99fd0f3a8403",
+    "id": "bundle--82e86fa1-d136-4bc9-b885-fbfd4b870bdb",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--eb58e9f0-9520-4780-aaf5-1d9e048e18dc",
+    "id": "bundle--d6ef9807-7f7b-4ab2-b239-3e3610d915ff",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--b93db7a3-eb08-4a9d-9de1-40e889fca6fa",
+    "id": "bundle--c928190b-ca8a-4177-b34b-871f6b20ddba",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--95954aef-7ff7-404d-aa25-a4b1aa622f5d",
+    "id": "bundle--0f4ad224-fe7e-4ece-9f0d-7ac7b586634a",
    "spec_version": "2.0",
    "objects": [
        {
@@ -28,6 +28,8 @@
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
                "Application Log: Application Log Content",
+                "File: File Creation",
+                "Process: Process Creation",
                "Network Traffic: Network Traffic Content"
            ],
            "type": "attack-pattern",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--68464d6b-3f17-4888-b2fb-bea0ac94d425",
+    "id": "bundle--efaf75c4-45dd-4d58-af47-bd365a204f98",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--eab455d2-0137-474a-8b2c-fc1838127689",
+    "id": "bundle--900b5773-01ec-438f-95d8-56d9bb11b420",
    "spec_version": "2.0",
    "objects": [
        {
@@ -24,10 +24,10 @@
            ],
            "x_mitre_version": "1.0",
            "x_mitre_data_sources": [
-                "Application Log: Application Log Content",
+                "Network Traffic: Network Traffic Content",
                "File: File Creation",
                "Network Traffic: Network Connection Creation",
-                "Network Traffic: Network Traffic Content",
+                "Application Log: Application Log Content",
                "Process: Process Creation"
            ],
            "type": "attack-pattern",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--667109b2-47f9-49a9-a345-40e9aa8558a7",
+    "id": "bundle--b32487c4-4f52-48d4-a86e-f9fb3607d014",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--e6d80a68-6acc-40e5-978c-f938295dbb6f",
+    "id": "bundle--f3f6c012-f990-40d9-ab72-6409fa2ad699",
    "spec_version": "2.0",
    "objects": [
        {
@@ -28,8 +28,10 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
-                "Network Traffic: Network Traffic Content",
-                "Application Log: Application Log Content"
+                "Network Traffic: Network Traffic Flow",
+                "Operational Databases: Device Alarm",
+                "Windows Registry: Windows Registry Key Modification",
+                "Network Traffic: Network Traffic Content"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--8535b71e-3c12-4258-a4ab-40257a1becc4",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--286cb5a0-78b8-4f16-b442-6d97f834e2bb",
+    "id": "bundle--10493f9a-1a83-4de1-8dc6-c4616fde4f8e",
    "spec_version": "2.0",
    "objects": [
        {
@@ -30,8 +30,8 @@
            ],
            "x_mitre_version": "1.0",
            "x_mitre_data_sources": [
-                "Application Log: Application Log Content",
-                "Network Traffic: Network Traffic Content"
+                "Network Traffic: Network Traffic Content",
+                "Application Log: Application Log Content"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--a718a423-feaf-4750-8500-0de3cec25795",
+    "id": "bundle--a45d0c2b-a2d1-4d7d-b294-e26dd10d7d88",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--85c530a8-e2bc-47e7-9e5e-755b1dd45abf",
+    "id": "bundle--edd1ef11-c393-44cf-950e-fc4c0f410337",
    "spec_version": "2.0",
    "objects": [
        {
@@ -25,9 +25,9 @@
            ],
            "x_mitre_version": "1.0",
            "x_mitre_data_sources": [
+                "Network Traffic: Network Traffic Flow",
                "Application Log: Application Log Content",
-                "Logon Session: Logon Session Metadata",
-                "Network Traffic: Network Traffic Flow"
+                "Logon Session: Logon Session Metadata"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--bbface67-2c41-4219-837d-771ea756244b",
+    "id": "bundle--81bb4904-3d4e-4dcb-8f2c-30fd2e7b8213",
    "spec_version": "2.0",
    "objects": [
        {
@@ -25,9 +25,9 @@
            ],
            "x_mitre_version": "1.0",
            "x_mitre_data_sources": [
+                "Operational Databases: Process History/Live Data",
                "Network Traffic: Network Traffic Content",
-                "Application Log: Application Log Content",
-                "Operational Databases: Process History/Live Data"
+                "Application Log: Application Log Content"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--45fef304-e2a6-4dff-8ef0-37ade90722ef",
+    "id": "bundle--9d00af04-00ba-46f4-b164-86804cbda55b",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--f00dae9a-f8c0-428c-9eb8-e5ec0279ed66",
+    "id": "bundle--9bcf1a0d-86c0-4e69-ab3a-97f51494c303",
    "spec_version": "2.0",
    "objects": [
        {
@@ -29,11 +29,12 @@
                "Conrad Layne - GE Digital"
            ],
            "x_mitre_data_sources": [
-                "Network Traffic: Network Traffic Flow",
                "Network Traffic: Network Traffic Content",
-                "Process: OS API Execution",
+                "Service: Service Creation",
+                "Application Log: Application Log Content",
+                "Network Traffic: Network Traffic Flow",
                "Process: Process Creation",
-                "Command: Command Execution"
+                "Windows Registry: Windows Registry Key Modification"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--2aa3b2bd-a902-41a3-87d0-e81c87cab194",
+    "id": "bundle--d581ce81-d80a-4914-a657-42c3c7b9cb14",
    "spec_version": "2.0",
    "objects": [
        {
@@ -24,6 +24,9 @@
                "ics-attack"
            ],
            "x_mitre_version": "1.1",
+            "x_mitre_data_sources": [
+                "Application Log: Application Log Content"
+            ],
            "type": "attack-pattern",
            "id": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03",
            "created": "2020-05-21T17:43:26.506Z",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--96e5ec5a-081e-41bc-bb04-7ab8b94e3d19",
+    "id": "bundle--fa07a524-7178-499d-a1ea-36496b6fd302",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--38edd46d-6c54-489d-93ab-f7345ecc7467",
+    "id": "bundle--ebc15e0a-97e7-44b6-b74e-ca3ef2243064",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--b092d8c7-69f2-4a38-803b-10ab20d37d8a",
+    "id": "bundle--bfb6a629-769d-4e02-9b5d-c933daaa6834",
    "spec_version": "2.0",
    "objects": [
        {
@@ -28,8 +28,8 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
-                "File: File Modification",
-                "Module: Module Load"
+                "Process: OS API Execution",
+                "Process: Process Metadata"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--5ef8ec71-ba15-4b8c-8ffc-9d9c255270eb",
+    "id": "bundle--1e5b80da-8008-4919-b88e-d2aa0fc35a46",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--7336ace5-736b-4ced-974f-44c6d644d46a",
+    "id": "bundle--1d66bf54-3cbe-4568-a723-cc946650e565",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--0fb3ea22-23fa-4653-97fc-94735c6da5b2",
+    "id": "bundle--749a2de2-f5cd-41d9-a410-cfc2c1d5f8da",
    "spec_version": "2.0",
    "objects": [
        {
@@ -24,9 +24,10 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
-                "Network Traffic: Network Traffic Flow",
-                "Network Traffic: Network Traffic Content",
-                "Process: Process Creation"
+                "Module: Module Load",
+                "Process: Process Creation",
+                "Command: Command Execution",
+                "Logon Session: Logon Session Creation"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--b0628bfc-5376-4a38-9182-f324501cb4cf",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--234581c3-b16c-4507-a624-84409e11d0ce",
+    "id": "bundle--ad120e54-6065-4341-aada-90edf7c1b08b",
    "spec_version": "2.0",
    "objects": [
        {
@@ -26,10 +26,11 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
-                "Network Traffic: Network Traffic Content",
-                "Network Traffic: Network Traffic Flow",
                "Application Log: Application Log Content",
-                "Operational Databases: Process/Event Alarm"
+                "Asset: Asset Inventory",
+                "Operational Databases: Device Alarm",
+                "Network Traffic: Network Traffic Content",
+                "Network Traffic: Network Traffic Flow"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--403f52c6-8ef9-43b2-bc22-2df86c87db78",
+    "id": "bundle--09b1e2b3-2f99-4328-8034-ef80bffef4d3",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--532407ac-bbdf-44f1-9441-c07a9e73369e",
+    "id": "bundle--24c345d6-23b1-41c0-ac4b-40530f3783e8",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--bad1fddc-d9c4-4b06-87cb-b0b0486d82ad",
+    "id": "bundle--aa3328d8-fcf9-457d-88e7-48b8683a23c7",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--50e761bf-b5f3-4fbb-8895-b22d26ba7913",
+    "id": "bundle--6bc12a34-f3e2-42e5-8abf-917810b2a4b5",
    "spec_version": "2.0",
    "objects": [
        {
@@ -30,9 +30,10 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
-                "Firmware: Firmware Modification",
                "Network Traffic: Network Traffic Content",
-                "Network Traffic: Network Traffic Flow"
+                "Firmware: Firmware Modification",
+                "Application Log: Application Log Content",
+                "Operational Databases: Device Alarm"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--b9160e77-ea9e-4ba9-b1c8-53a3c466b13d",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--c92d7fa1-62eb-42db-90db-c42781b46587",
+    "id": "bundle--d4bceb18-b528-4e01-bf37-50b333d51989",
    "spec_version": "2.0",
    "objects": [
        {
@@ -25,13 +25,14 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
+                "Scheduled Job: Scheduled Job Creation",
                "Command: Command Execution",
-                "File: File Metadata",
-                "File: File Modification",
-                "Scheduled Job: Scheduled Job Metadata",
-                "Scheduled Job: Scheduled Job Modification",
+                "Service: Service Modification",
                "Service: Service Creation",
-                "Service: Service Metadata"
+                "File: File Modification",
+                "Process: Process Metadata",
+                "File: File Metadata",
+                "Scheduled Job: Scheduled Job Modification"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--a4636064-d321-45a1-b0a3-851778ca1450",
+    "id": "bundle--fee2da0d-9705-4996-a1a9-dcd9360874e2",
    "spec_version": "2.0",
    "objects": [
        {
@@ -25,9 +25,10 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
-                "Network Traffic: Network Traffic Content",
                "Application Log: Application Log Content",
-                "Operational Databases: Device Alarm"
+                "Operational Databases: Device Alarm",
+                "Network Traffic: Network Traffic Content",
+                "Asset: Asset Inventory"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--c17911ce-f52a-4981-bf52-f30c9f306ce6",
+    "id": "bundle--d9c4b2aa-9fe4-4be4-899f-39c8c2a4160d",
    "spec_version": "2.0",
    "objects": [
        {
@@ -26,10 +26,10 @@
            ],
            "x_mitre_version": "1.0",
            "x_mitre_data_sources": [
-                "Drive: Drive Creation",
-                "File: File Access",
+                "Process: Process Creation",
                "File: File Creation",
-                "Process: Process Creation"
+                "Drive: Drive Creation",
+                "File: File Access"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--0ead4098-0d6f-4df2-8453-af7497b3d2d0",
+    "id": "bundle--38548879-9a1a-48e7-bdf5-7b783aab223c",
    "spec_version": "2.0",
    "objects": [
        {
@@ -23,8 +23,8 @@
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "2.1.0",
            "x_mitre_data_sources": [
-                "Command: Command Execution",
-                "Process: OS API Execution"
+                "Process: OS API Execution",
+                "Command: Command Execution"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--c5e3cdbc-0387-4be9-8f83-ff5c0865f377",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--a06999be-badb-4b72-9275-4990f9ea47ea",
+    "id": "bundle--a48e9a64-eeaa-4a21-b44a-3050ff1f77e2",
    "spec_version": "2.0",
    "objects": [
        {
@@ -36,8 +36,8 @@
                "Aagam Shah, @neutrinoguy, ABB"
            ],
            "x_mitre_data_sources": [
-                "Logon Session: Logon Session Creation",
-                "Network Traffic: Network Traffic Content"
+                "Network Traffic: Network Traffic Content",
+                "Logon Session: Logon Session Creation"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--c9a8d958-fcdb-40d2-af4c-461c8031651a",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--400f537a-938e-4de5-a89f-a32d14ac3967",
+    "id": "bundle--65a16a48-c54e-427f-998b-7b890d12cff2",
    "spec_version": "2.0",
    "objects": [
        {
@@ -34,8 +34,9 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
+                "User Account: User Account Authentication",
                "Logon Session: Logon Session Creation",
-                "User Account: User Account Authentication"
+                "Logon Session: Logon Session Metadata"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--2d34c4ef-4fb2-48a9-9530-86a77923d6b6",
+    "id": "bundle--e193609c-118b-410c-82cd-a034525412fe",
    "spec_version": "2.0",
    "objects": [
        {
@@ -25,7 +25,7 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
-                "Process: OS API Execution"
+                "Application Log: Application Log Content"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--14e4dbd3-fdd8-4320-b2aa-70ae87a04171",
+    "id": "bundle--9911dc77-f27e-42bd-b877-93090abd3489",
    "spec_version": "2.0",
    "objects": [
        {
@@ -28,10 +28,10 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
-                "Command: Command Execution",
+                "Network Traffic: Network Traffic Content",
                "File: File Access",
-                "Network Traffic: Network Connection Creation",
-                "Process: Process Creation"
+                "Process: Process Creation",
+                "Network Traffic: Network Traffic Flow"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--b4787dd3-0b43-41cf-a80f-bdaad58ed732",
+    "id": "bundle--8288966a-0465-45e3-bbd9-77916ec2b720",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--79398fc1-c7db-4147-b27d-e3384ba8e939",
+    "id": "bundle--f652a4e2-da7c-4920-9884-4c84baeaee2a",
    "spec_version": "2.0",
    "objects": [
        {
@@ -24,7 +24,6 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
-                "Network Traffic: Network Connection Creation",
                "Network Traffic: Network Traffic Content",
                "Network Traffic: Network Traffic Flow"
            ],
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--1ecb3609-206c-41ef-8a11-c66a3ceee1f7",
+    "id": "bundle--f1deb1cf-583d-496f-bdb0-20df396f198a",
    "spec_version": "2.0",
    "objects": [
        {
@@ -26,8 +26,8 @@
            "x_mitre_version": "1.0",
            "x_mitre_attack_spec_version": "2.1.0",
            "x_mitre_data_sources": [
-                "Network Traffic: Network Traffic Flow",
-                "Network Traffic: Network Traffic Content"
+                "Network Traffic: Network Traffic Content",
+                "Network Traffic: Network Traffic Flow"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--015ade2d-d619-40dc-93de-7e4dbc99cbfb",
+    "id": "bundle--d3323787-49d3-4f29-8981-25119b013721",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--808eee6f-f435-4ee6-a10a-b4664767b475",
+    "id": "bundle--ab88c9b1-aa19-4a0b-94bf-22fdfe2b62f5",
    "spec_version": "2.0",
    "objects": [
        {
@@ -33,13 +33,13 @@
                "Daisuke Suzuki"
            ],
            "x_mitre_data_sources": [
-                "Command: Command Execution",
-                "Logon Session: Logon Session Creation",
-                "Network Share: Network Share Access",
+                "Process: Process Creation",
                "Network Traffic: Network Connection Creation",
-                "Network Traffic: Network Traffic Flow",
-                "Network Traffic: Network Traffic Content",
-                "Process: Process Creation"
+                "Module: Module Load",
+                "Network Share: Network Share Access",
+                "Logon Session: Logon Session Creation",
+                "Command: Command Execution",
+                "Network Traffic: Network Traffic Flow"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--05ca603f-5a65-46bd-ac5c-e873b323c1f3",
+    "id": "bundle--5a628d49-5e21-488f-852f-b406da561017",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--c47c19a1-f3a5-4727-8714-055ea234c515",
+    "id": "bundle--5084dca6-83fd-4c99-9e93-4a445da302ec",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--1bebb247-dd9e-4ffe-be1d-f7258fa76658",
+    "id": "bundle--01dcd935-b9e0-45b9-8417-aa08bca0c1ee",
    "spec_version": "2.0",
    "objects": [
        {
@@ -28,9 +28,10 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
-                "Network Traffic: Network Traffic Content",
+                "Operational Databases: Process History/Live Data",
                "Application Log: Application Log Content",
-                "Operational Databases: Process History/Live Data"
+                "Network Traffic: Network Traffic Content",
+                "Asset: Asset Inventory"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--1c3cc061-1c4b-4bc1-ab0e-48eae7ec5ff8",
+    "id": "bundle--b7ed24bd-bada-4e36-ba1b-0ec34e74b422",
    "spec_version": "2.0",
    "objects": [
        {
@@ -31,7 +31,8 @@
                "Matan Dobrushin - Otorio"
            ],
            "x_mitre_data_sources": [
-                "Network Traffic: Network Traffic Flow"
+                "Network Traffic: Network Traffic Flow",
+                "Network Traffic: Network Traffic Content"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--a15712f7-7db5-4591-aa7f-1df02abbef5f",
+    "id": "bundle--03e5cf64-2e24-4c5c-a63e-73e8e40385a9",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--aff8ac47-f8e8-4bf5-a0d5-04da869c1d96",
+    "id": "bundle--964ab34b-e86c-438b-a9b2-ece4154462e5",
    "spec_version": "2.0",
    "objects": [
        {
@@ -24,9 +24,10 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
-                "Command: Command Execution",
                "Process: OS API Execution",
-                "Process: Process Creation"
+                "Script: Script Execution",
+                "Process: Process Creation",
+                "Command: Command Execution"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--0700b68c-b52e-4156-802a-aed5768dc8d8",
+    "id": "bundle--0a8bb063-e338-435a-8bee-b4059b77f3bc",
    "spec_version": "2.0",
    "objects": [
        {
@@ -26,11 +26,12 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
+                "Network Traffic: Network Traffic Content",
+                "Network Share: Network Share Access",
+                "Network Traffic: Network Traffic Flow",
                "Command: Command Execution",
                "File: File Creation",
                "File: File Metadata",
-                "Network Traffic: Network Traffic Content",
-                "Network Traffic: Network Traffic Flow",
                "Process: Process Creation"
            ],
            "type": "attack-pattern",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--dc3bc7fd-9b11-44b9-8ff8-abf417c06912",
+    "id": "bundle--ff990c5e-5dfc-471a-a6d4-5b820c69775f",
    "spec_version": "2.0",
    "objects": [
        {
@@ -29,9 +29,10 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
-                "Firmware: Firmware Modification",
                "Network Traffic: Network Traffic Content",
-                "Network Traffic: Network Traffic Flow"
+                "Application Log: Application Log Content",
+                "Operational Databases: Device Alarm",
+                "Firmware: Firmware Modification"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--efbf7888-f61b-4572-9c80-7e2965c60707",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--7f36ab61-12d4-4f9e-937e-63e20d1974c9",
+    "id": "bundle--c51ed92c-4adb-4ac3-b81a-d403afefc53c",
    "spec_version": "2.0",
    "objects": [
        {
@@ -29,8 +29,8 @@
            ],
            "x_mitre_version": "1.0",
            "x_mitre_data_sources": [
-                "Network Traffic: Network Traffic Flow",
                "Network Traffic: Network Traffic Content",
+                "Network Traffic: Network Traffic Flow",
                "Logon Session: Logon Session Metadata"
            ],
            "type": "attack-pattern",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--755f5126-f92c-4bc1-8250-3baabf200341",
+    "id": "bundle--2d30b715-460d-4653-8607-dacd689b3a41",
    "spec_version": "2.0",
    "objects": [
        {
@@ -24,8 +24,10 @@
            ],
            "x_mitre_version": "1.1",
            "x_mitre_data_sources": [
-                "File: File Modification",
-                "Asset: Software/Firmware"
+                "Application Log: Application Log Content",
+                "Network Traffic: Network Traffic Content",
+                "Asset: Software",
+                "Operational Databases: Device Alarm"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--fc5fda7e-6b2c-4457-b036-759896a2efa2",
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--db8d476d-2543-4509-8b32-a9aa13a59c67",
+    "id": "bundle--51e42b1d-9516-4b2f-a2d7-a88a63721658",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--3ccbc7dc-cb15-40a5-b8bd-7f1d3347d559",
+    "id": "bundle--6fac6ad5-4d6b-445f-b2ad-449a7e33d7a0",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--1c6c0337-c4b5-4b6d-8253-9cbdaf176e97",
+    "id": "bundle--6892a7cd-a79b-46ef-a5c9-245ea89e5584",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--f565872b-11f2-4816-8ea8-56c522621642",
+    "id": "bundle--5586eccf-3eeb-4224-acc6-7371e6ff02bc",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--fbde3f3f-153a-4016-8bc7-85d28df98760",
+    "id": "bundle--30539a3a-3561-43c5-a470-a82c648c39e6",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--d6c3a930-5092-46da-ad56-9a901b790f49",
+    "id": "bundle--fab02b81-5057-44ba-ab18-6c121d53b5fe",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--a0f0ee6b-2668-4058-b256-13a54963dd77",
+    "id": "bundle--a489c174-c85c-470b-be84-2ace36ceaec7",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--d8e5877a-1d42-4856-baba-4524966e0da3",
+    "id": "bundle--5b351fd4-8615-4d0a-ad2f-43aea06e6a52",
    "spec_version": "2.0",
    "objects": [
        {
@@ -1,6 +1,6 @@
 {
    "type": "bundle",
-    "id": "bundle--b12cd0e9-5d3b-475c-9fec-1b2f11300163",
+    "id": "bundle--d2e1334a-bb31-4e22-8de0-53229f9e73e1",
    "spec_version": "2.0",
    "objects": [
        {
--- a/Show More
+++ b/Show More