DISARMFoundation / DISARM-STIX2

A STIX2 generator for the DISARM Framework
8 stars 4 forks source link

mitre-attack references hardcoded in STIX generation logic #5

Open himynamesdave opened 10 months ago

himynamesdave commented 10 months ago

It appears a lot of the code for object has been copied from ATT&CK repo (which is fine). However, it seems some hardcoded values have been incorrectly copied across, in kill_chain_phases and external_references, e.g.

           "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-attack",
                    "phase_name": "drive-online-harms"
                }
            ],
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0048.004.md",
                    "external_id": "T0048.004"
                }
            ],

Suggestion to replace hardcoded mitre-attack with DISARM

himynamesdave commented 10 months ago

Can confirm, does not affect ATT&CK Navigator support

https://raw.githubusercontent.com/signalscorps/DISARM-STIX2/main/output/DISARM.json

image