Jennifer Burns
42 lines
2.4 KiB
JSON
42 lines
2.4 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--8d21acee-ae7d-4c12-8ea4-6d23c3d4a2af",
|
|
"spec_version": "2.0",
|
|
"objects": [
|
|
{
|
|
"id": "attack-pattern--e5164428-03ca-4336-a9a7-4d9ea1417e59",
|
|
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
|
|
"name": "Acquire or compromise 3rd party signing certificates",
|
|
"description": "Code signing is the process of digitally signing executables or scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Users may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is. (Citation: Adobe Code Signing Cert)",
|
|
"external_references": [
|
|
{
|
|
"external_id": "T1310",
|
|
"url": "https://attack.mitre.org/techniques/T1310",
|
|
"source_name": "mitre-pre-attack"
|
|
},
|
|
{
|
|
"description": "Brad Arkin. (2012, September 27). Inappropriate Use of Adobe Code Signing Certificate. Retrieved March 28, 2017.",
|
|
"source_name": "Adobe Code Signing Cert"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
|
|
],
|
|
"x_mitre_detectable_by_common_defenses": "No",
|
|
"x_mitre_detectable_by_common_defenses_explanation": "Defender will not know what certificates an adversary acquires from a 3rd party. Defender will not know prior to public disclosure if a 3rd party has had their certificate compromised.",
|
|
"x_mitre_difficulty_for_adversary": "No",
|
|
"x_mitre_difficulty_for_adversary_explanation": "It is trivial to purchase code signing certificates within an organization; many exist and are available at reasonable cost. It is complex to factor or steal 3rd party code signing certificates for use in malicious mechanisms",
|
|
"x_mitre_version": "1.0",
|
|
"x_mitre_old_attack_id": "PRE-T1087",
|
|
"type": "attack-pattern",
|
|
"kill_chain_phases": [
|
|
{
|
|
"phase_name": "adversary-opsec",
|
|
"kill_chain_name": "mitre-pre-attack"
|
|
}
|
|
],
|
|
"modified": "2019-02-19T18:54:54.471Z",
|
|
"created": "2017-12-14T16:46:06.044Z"
|
|
}
|
|
]
|
|
} |