Inconsistent External References for MITRE ATT&CK ICS Techniques (12 affected entries)

未关闭
  • 哪里不对？
#63 0 条评论 0 个 reaction 已指派 1 人 在 GitHub 查看

@seansica 已经在做这个了。

开始于 2025年12月8日。

评估

这个 Issue 还没有评估数据。

描述

Description

While reviewing the generated STIX data for MITRE ATT&CK ICS techniques, I noticed that most attack patterns correctly use the expected external reference format with source_name: "mitre-ics-attack".

However, 12 entries deviate from this convention and instead contain an external reference with:

{
  "external_references": [
    {
      "source_name": "mitre-attack",
      "url": "https://attack.mitre.org/techniques/T0816",
      "external_id": "T0816"
    }
  ]
}

This is inconsistent with the rest of the dataset and breaks consumers that rely on a stable source_name for MITRE ICS ATT&CK techniques.

Expected Behavior

All ICS techniques should reference MITRE ATT&CK ICS using:

{
  "source_name": "mitre-ics-attack"
}
12 Affected Techniques
STIX ID Name
attack-pattern--23270e54-1d68-4c3b-b763-b25607bcef80 Role Identification
attack-pattern--50d3222f-7550-4a3c-94e1-78cb6c81d064 Data Historian Compromise
attack-pattern--539d0484-fe95-485a-b654-86991c0d0d00 Network Service Scanning
attack-pattern--5f3da2f3-91c8-4d8b-a02f-bf43a11def55 Serial Connection Enumeration
attack-pattern--7374ab87-0782-41f8-b415-678c0950bb2a Location Identification
attack-pattern--94f042ae-3033-4a8d-9ec3-26396533a541 Detect Program State
attack-pattern--a8cfd474-9358-464f-a169-9c6f099a8e8a Change Program State
attack-pattern--abb0a255-eb9c-48d0-8f5c-874bb84c0e45 Control Device Identification
attack-pattern--ae62fe1a-ea1a-479b-8dc0-65d250bd8bc7 Program Organization Units
attack-pattern--d614a9cf-18eb-4800-81e4-ab8ddf0baa73 Engineering Workstation Compromise
attack-pattern--e0d74479-86d2-465d-bf36-903ebecef43e Modify Control Logic
attack-pattern--e2994b6a-122b-4043-b654-7411c5198ec0 I/O Module Discovery
Proposed Fix

Standardize the external reference by rewriting the affected objects to use:

{
  "source_name": "mitre-ics-attack"
}

If needed, merge or reconcile any mismatching MITRE ATT&CK references before normalization.

Impact

Systems or pipelines expecting consistent MITRE ICS reference identifiers may misinterpret or skip these techniques due to the unexpected source_name value.

主要语言
Python
星标
708
派生
149
30 天内没有已合并 PR

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

mitre-attack/attack-stix-data 的其他 Issue

查看 mitre-attack/attack-stix-data 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。