Mobile-Attack techniques missing tactic reference (kill_chain_phases/name) about cti HOT 3 CLOSED

Hi @dRy3vd - thanks for posting this issue!

I think what you're noticing is that techniques that were revoked in the Oct. 2018 update (Malicious SMS Message is an example) don't have all of the attributes that they did previously. Revoked techniques are techniques that were replaced by other techniques.

This motivated me to add a new section to the USAGE documentation here to explain how to find what technique replaced a given technique. You can also see what technique replaced this technique by going to the website and seeing where it redirects to - for example for this technique you'd go to https://attack.mitre.org/techniques/MOB-T1057 and see that it redirects to https://attack.mitre.org/techniques/T1477.

Please let me know if you have any further questions or concerns. Thanks!

from cti.

Thank you--that definitely helps! Will the techniques with the attribute x_mitre_deprecated be updated at some point to use the revoked attribute or are these attributes intended to be used for different scenarios?

from cti.

Hey @dRy3vd - sorry I missed this response! Currently we use x_mitre_deprecated for techniques/software/groups/etc. that no longer fit into the ATT&CK knowledge base but have not been replaced by another technique/software/group/etc.

At this point the intention is to keep x_mitre_deprecated objects separate from the revoked objects, so a technique that is deprecated may never be revoked and vice versa. However, if that changes due to the evolution of the ATT&CK knowledge base, we will make sure to document that properly.

Thanks again for your question and thoughts!

from cti.