Kill Chain Phases

Details

ID	`indicator_killchainphases`
CLI Name	`killchainphases`
Type	multiSelect
From Version	5.5.0
Required	No
Read Only	No
Searchable	Yes
Case Insensitive	Yes
Expiration (hours)	72

Select Values

Reconnaissance Resource Development Weaponization Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Delivery Exploitation Installation Collection Command & Control Exfiltration Impact Actions on Objectives Build Capabilities Adversary Opsec

Associated Indicator Types

Source

indicatorfield-Kill_Chain_Phases.json

Download History Raw

{
    "id": "indicator_killchainphases",
    "version": -1,
    "modified": "2021-05-06T12:31:09.914765+03:00",
    "name": "Kill Chain Phases",
    "ownerOnly": false,
    "description": "The list of Kill Chain Phases for which this object is used.",
    "cliName": "killchainphases",
    "type": "multiSelect",
    "closeForm": false,
    "editForm": true,
    "required": false,
    "neverSetAsRequired": false,
    "isReadOnly": false,
    "selectValues": [
        "Reconnaissance",
        "Resource Development",
        "Weaponization",
        "Initial Access",
        "Execution",
        "Persistence",
        "Privilege Escalation",
        "Defense Evasion",
        "Credential Access",
        "Discovery",
        "Lateral Movement",
        "Delivery",
        "Exploitation",
        "Installation",
        "Collection",
        "Command \u0026 Control",
        "Exfiltration",
        "Impact",
        "Actions on Objectives",
        "Build Capabilities",
        "Adversary Opsec"
    ],
    "useAsKpi": false,
    "locked": false,
    "system": false,
    "content": true,
    "group": 2,
    "hidden": false,
    "associatedTypes": [
        "Infrastructure",
        "Attack Pattern",
        "Tool"
    ],
    "associatedToAll": false,
    "unmapped": false,
    "unsearchable": false,
    "caseInsensitive": true,
    "sla": 0,
    "threshold": 72,
    "fromVersion": "5.5.0",
    "supportedModules": [
        "agentix",
        "xsiam"
    ]
}