Is 'Has technique object' property for 'Software' available in ATT&CK STIX Content? about cti HOT 3 CLOSED

So far, I can only use the Software original descriptions and use relationships defined to map:
Group -> tactics -> techniques -> software (When Available)

Group Winnit:

I am replicating the same functionality as the PowerShell script I shared earlier and provide a similar output:

https://github.com/Cyb3rWard0g/ThreatHunter-Playbook/blob/master/adversary_attribution/Winnti%20Group.md

Thank you!

from cti.

Hey @Cyb3rWard0g ! This is a great question. The 'Has Technique Object?' property is available in the STIX content as a description on a relationship object. For your case, you'd be looking for relationships that have the source_ref that is the ID of the software (tool or malware) object and the target_ref of an attack-pattern. Here's an example of how to do that for the Winnti software:

from stix2 import TAXIICollectionSource, Filter
from stix2.utils import get_type_from_id
from taxii2client import Collection

# Establish TAXII2 Collection instance for Enterprise ATT&CK collection
collection = Collection("https://cti-taxii.mitre.org/stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/")

# Supply the collection to TAXIICollection
tc_source = TAXIICollectionSource(collection)

def get_technique_software_descriptions(src, sw_stix_id):
    rels = [
        r for r in src.relationships(sw_stix_id, 'uses')
        if get_type_from_id(r.target_ref) in ['attack-pattern']
    ]

    return rels

def get_software_by_name(src, name):
    software = src.query([
        Filter("type", "=", "tool"),
        Filter("name", "=", name)
    ])
    if len(software) == 0:
        software = src.query([
            Filter("type", "=", "malware"),
            Filter("name", "=", name)
        ])
    return software

def get_technique_by_id(src, id):
    technique = src.query([
        Filter("id", "=", id)
    ])
    return technique

software = get_software_by_name(tc_source, "Winnti")[0]
rels = get_technique_software_descriptions(tc_source, software)
for rel in rels:
    print(rel["description"])
    print(rel["target_ref"])
    print(get_technique_by_id(tc_source, rel["target_ref"])[0]["name"])

You could replace the get_software_by_name with a get_software_by_id similar to get_technique_by_id here if you wanted to just loop through all of the software (tools/malware) to get the techniques used by each one and corresponding descriptions.

Regarding relationship objects, attack-patterns will always be found as a target_ref and intrusion-sets will always be found as a source_ref. Therefore, tools/malware can be found as either. That has helped me in remembering how to set up my code to grab the correct content.

I hope this is helpful, and thanks again!

from cti.

Hey @jburns12 !! omg lol how did I miss the relationship description property??. It was 3am already so it must have been the time hahaha. Thank you so much for all the information!! I appreciate the details and the example 👍 💯

from cti.