Inaccurate threat actor mapping

rabobank-cdc / DeTTECT

Detect Tactics, Techniques & Combat Threats

GNU General Public License v3.0

2.05k stars 333 forks source link

Inaccurate threat actor mapping #56

Closed moullos closed 2 years ago

moullos commented 2 years ago

Hi and thank you for the amazing project.

I am trying to generate a threat actor mapping for APT29 using the command python .\dettect.py g -g 'APT29'. While it completes successfully, it seems that the results are incomplete. For example, subtechnique T1546.003 shouldbe included in the resulting navigator layer but it is not.

As github prevents me from uploading the actual json file, I have attaching a screenshot of the navigator:

For any more information required please let me know.

rubinatorz commented 2 years ago

hi @moullos

Please check your stix2 python library version. I guess it's 3.x. The 3.x version gives some strange results, so you need the stix2==2.1.0 version to work with DeTT&CT (as listed in the requirements.txt file).

Regards, Ruben

rubinatorz commented 2 years ago

@moullos You'll probably also need to remove the cache directory after downgrading to stix2==2.1.0, otherwise DeTT&CT will use cached STIX information.