Duplicate SRO in ics-attack.json

[stmtstk]

Hi All,

I found there are two objects which have the same object ID and modified timestamp in ics-attack.json.

https://github.com/mitre/cti/blob/master/ics-attack/ics-attack.json

The first one is

    {
      "type": "relationship",
      "id": "relationship--8a06c15b-b7e5-4374-9265-8d9020e126cd",
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "created": "2021-10-14T16:46:06.044Z",
      "modified": "2022-04-21T22:02:04.210599Z",
      "relationship_type": "uses",
      "description": "[Stuxnet](https://attack.mitre.org/software/S0010) sends two network bursts (done through the DP_SEND primitive). The data in the frames are instructions for the frequency converter drives. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
      "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
      "target_ref": "attack-pattern--40b300ba-f553-48bf-862e-9471b220d455",
      "external_references": [
        {
          "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
          "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved. 2017/09/22 ",
          "url": "https://www.wired.com/images_blogs/threatlevel/2011/02/Symantec-Stuxnet-Update-Feb-2011.pdf"
        }
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ]
    },

The second one is ...

    {
      "type": "relationship",
      "id": "relationship--8a06c15b-b7e5-4374-9265-8d9020e126cd",
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "created": "2021-10-14T16:46:06.044Z",
      "modified": "2022-04-21T22:02:04.211599Z",
      "relationship_type": "uses",
      "description": "[Stuxnet](https://attack.mitre.org/software/S0010) infects DLL's associated with the WinCC Simatic manager which are responsible for opening project files. If a user opens an uninfected project file using a compromised manager, the file will be infected with Stuxnet code. If an infected project is opened with the Simatic manager, the modified data file will trigger a search for the \\xyz.dll\\ file. If the \\xyz.dll\\ file is not found in any of the specified locations, the malicious DLL will be loaded and executed by the manager. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)",
      "source_ref": "malware--088f1d6e-0783-47c6-9923-9c79b2af43d4",
      "target_ref": "attack-pattern--2736b752-4ec5-4421-a230-8977dea7649c",
      "external_references": [
        {
          "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
          "description": "Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved. 2017/09/22 ",
          "url": "https://www.wired.com/images_blogs/threatlevel/2011/02/Symantec-Stuxnet-Update-Feb-2011.pdf"
        }
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ]
    },

The difference is target_ref.

According to the link below,

https://github.com/mitre/cti/blob/master/ics-attack/relationship/relationship--8a06c15b-b7e5-4374-9265-8d9020e126cd.json

The second one seems to be correct.

The same ID and same modified timestamp should not be used.

I would like to strongly recommend a duplicate check.

[stmtstk]

Sorry. I noticed that these two objects have a different modified timestamp. I will close the issue.

[stmtstk]

I have another example in ics-attack.json.

The first one is ...

    {
      "type": "relationship",
      "id": "relationship--1f8abf6f-0dd0-4449-b555-733fe7296177",
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "created": "2018-04-18T17:59:24.739Z",
      "modified": "2022-04-21T22:02:04.224603Z",
      "relationship_type": "uses",
      "description": "[Triton](https://attack.mitre.org/software/S0013) leveraged the TriStation protocol to download programs onto Triconex Safety Instrumented System. (Citation: Jos Wetzels January 2018)",
      "source_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
      "target_ref": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068",
      "external_references": [
        {
          "source_name": "Jos Wetzels January 2018",
          "description": "Jos Wetzels 2018, January 16 Analyzing the TRITON industrial malware Retrieved. 2019/10/22 ",
          "url": "https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware"
        }
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ]
    },

The second one is..

    {
      "type": "relationship",
      "id": "relationship--1f8abf6f-0dd0-4449-b555-733fe7296177",
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "created": "2018-04-18T17:59:24.739Z",
      "modified": "2022-04-21T22:02:04.224603Z",
      "relationship_type": "uses",
      "description": "[Triton](https://attack.mitre.org/software/S0013) calls the SafeAppendProgramMod to transfer its payloads to the Tricon. Part of this call includes preforming a program upload. (Citation: MDudek-ICS)",
      "source_ref": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
      "target_ref": "attack-pattern--3067b85e-271e-4bc5-81ad-ab1a81d411e3",
      "external_references": [
        {
          "source_name": "MDudek-ICS",
          "description": "MDudek-ICS   TRISIS-TRITON-HATMAN Retrieved. 2019/11/03 ",
          "url": "https://github.com/MDudek-ICS/TRISIS-TRITON-HATMAN/tree/master/decompiled_code/library"
        }
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ]
    },

The two objects have the same ID (relationship--1f8abf6f-0dd0-4449-b555-733fe7296177) and the same modified timestamp (2022-04-21T22:02:04.224603Z). The two objects have the different target property.

According the URL below, the second one seems to be correct. https://github.com/mitre/cti/blob/master/ics-attack/relationship/relationship--1f8abf6f-0dd0-4449-b555-733fe7296177.json

[jondricek]

Thanks for reporting this to us! There were a number of inconsistencies in the ICS ATT&CK bundle in the v11 release. We just released v11.1 yesterday and these duplicate Relationships have been addressed in that release. Let us know if you find anything else. Thanks!