Rules (XIF)
[MODEL: dataset="extrahop_revealx_raw"]
alter
properties_version = properties -> version,
properties_file_paths = properties -> file_paths[],
properties_software = properties -> software,
properties_server_ipaddr = properties -> server_ipaddr[],
properties_file_extensions = properties -> exec_file_types[],
properties_hacking_tool_name = properties -> hacking_tool_name,
properties_jndi_strings = properties -> jndi_strings[],
properties_registered_domain_name = properties -> registered_domain_names[],
mitre_tactic = arraymap(mitre_tactics -> [], "@element" -> name),
mitre_technique = arraymap(mitre_techniques -> [], "@element" -> id)
| alter
properties_server_ipaddr_value_temp = json_extract(to_json_string(properties_server_ipaddr ),"$[0]"),
properties_file_paths = arraystring(properties_file_paths , " , "),
properties_file_extensions = arraystring(properties_file_extensions , " , "),
properties_jndi_strings = arraystring(properties_jndi_strings , " , "),
properties_registered_domain_name = arraystring(properties_registered_domain_name , " , ")
| alter
properties_server_ipaddr_value = arrayindex(regextract(properties_server_ipaddr_value_temp , "(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0)
| alter
xdm.alert.original_alert_id = to_string(id),
xdm.alert.name = title,
xdm.event.type = type,
xdm.alert.description = description,
xdm.alert.severity = to_string(risk_score),
xdm.alert.category = categories,
xdm.event.description = url,
xdm.network.tls.server_certificate.version = properties_version,
xdm.source.process.name = coalesce(properties_software ,properties_hacking_tool_name),
xdm.target.ipv4 = properties_server_ipaddr_value,
xdm.target.file.extension = properties_file_extensions,
xdm.source.process.command_line = properties_jndi_strings ,
xdm.target.file.path = properties_file_paths,
xdm.target.domain = properties_registered_domain_name,
xdm.alert.mitre_tactics = arraymap(mitre_tactic, if( "@element" ~= "Collection", XDM_CONST.MITRE_TACTIC_COLLECTION, "@element" ~= "Command and Control", XDM_CONST.MITRE_TACTIC_COMMAND_AND_CONTROL, "@element" ~= "Credential Access", XDM_CONST.MITRE_TACTIC_CREDENTIAL_ACCESS, "@element" ~= "Defense Evasion", XDM_CONST.MITRE_TACTIC_DEFENSE_EVASION, "@element" ~= "Discovery", XDM_CONST.MITRE_TACTIC_DISCOVERY, "@element" ~= "Execution", XDM_CONST.MITRE_TACTIC_EXECUTION, "@element" ~= "Exfiltration", XDM_CONST.MITRE_TACTIC_EXFILTRATION, "@element" ~= "Impact", XDM_CONST.MITRE_TACTIC_IMPACT, "@element" ~= "Initial Access", XDM_CONST.MITRE_TACTIC_INITIAL_ACCESS, "@element" ~= "Lateral Movement", XDM_CONST.MITRE_TACTIC_LATERAL_MOVEMENT, "@element" ~= "Persistence", XDM_CONST.MITRE_TACTIC_PERSISTENCE, "@element" ~= "Privilege Escalation", XDM_CONST.MITRE_TACTIC_PRIVILEGE_ESCALATION, "@element" ~= "Reconnaissance", XDM_CONST.MITRE_TACTIC_RECONNAISSANCE, "@element" ~= "Resource Development", XDM_CONST.MITRE_TACTIC_RESOURCE_DEVELOPMENT, "@element")),
xdm.alert.mitre_techniques = arraymap(mitre_technique, if("@element" ~="T1548", XDM_CONST.MITRE_TECHNIQUE_ABUSE_ELEVATION_CONTROL_MECHANISM,"@element" ~="T1548.002", XDM_CONST.MITRE_TECHNIQUE_ABUSE_ELEVATION_CONTROL_MECHANISM_BYPASS_USER_ACCOUNT_CONTROL,"@element" ~="T1548.004", XDM_CONST.MITRE_TECHNIQUE_ABUSE_ELEVATION_CONTROL_MECHANISM_ELEVATED_EXECUTION_WITH_PROMPT,"@element" ~="T1548.001", XDM_CONST.MITRE_TECHNIQUE_ABUSE_ELEVATION_CONTROL_MECHANISM_SETUID_AND_SETGID,"@element" ~="T1548.003", XDM_CONST.MITRE_TECHNIQUE_ABUSE_ELEVATION_CONTROL_MECHANISM_SUDO_AND_SUDO_CACHING,"@element" ~="T1134", XDM_CONST.MITRE_TECHNIQUE_ACCESS_TOKEN_MANIPULATION,"@element" ~="T1134.002", XDM_CONST.MITRE_TECHNIQUE_ACCESS_TOKEN_MANIPULATION_CREATE_PROCESS_WITH_TOKEN,"@element" ~="T1134.003", XDM_CONST.MITRE_TECHNIQUE_ACCESS_TOKEN_MANIPULATION_MAKE_AND_IMPERSONATE_TOKEN,"@element" ~="T1134.004", XDM_CONST.MITRE_TECHNIQUE_ACCESS_TOKEN_MANIPULATION_PARENT_PID_SPOOFING,"@element" ~="T1134.005", XDM_CONST.MITRE_TECHNIQUE_ACCESS_TOKEN_MANIPULATION_SID_HISTORY_INJECTION,"@element" ~="T1134.001", XDM_CONST.MITRE_TECHNIQUE_ACCESS_TOKEN_MANIPULATION_TOKEN_IMPERSONATION_OR_THEFT,"@element" ~="T1531", XDM_CONST.MITRE_TECHNIQUE_ACCOUNT_ACCESS_REMOVAL,"@element" ~="T1087", XDM_CONST.MITRE_TECHNIQUE_ACCOUNT_DISCOVERY,"@element" ~="T1087.004", XDM_CONST.MITRE_TECHNIQUE_ACCOUNT_DISCOVERY_CLOUD_ACCOUNT,"@element" ~="T1087.002", XDM_CONST.MITRE_TECHNIQUE_ACCOUNT_DISCOVERY_DOMAIN_ACCOUNT,"@element" ~="T1087.003", XDM_CONST.MITRE_TECHNIQUE_ACCOUNT_DISCOVERY_EMAIL_ACCOUNT,"@element" ~="T1087.001", XDM_CONST.MITRE_TECHNIQUE_ACCOUNT_DISCOVERY_LOCAL_ACCOUNT,"@element" ~="T1098", XDM_CONST.MITRE_TECHNIQUE_ACCOUNT_MANIPULATION,"@element" ~="T1098.003", XDM_CONST.MITRE_TECHNIQUE_ACCOUNT_MANIPULATION_ADD_OFFICE_365_GLOBAL_ADMINISTRATOR_ROLE,"@element" ~="T1098.001", XDM_CONST.MITRE_TECHNIQUE_ACCOUNT_MANIPULATION_ADDITIONAL_CLOUD_CREDENTIALS,"@element" ~="T1098.002", XDM_CONST.MITRE_TECHNIQUE_ACCOUNT_MANIPULATION_EXCHANGE_EMAIL_DELEGATE_PERMISSIONS,"@element" ~="T1098.004", XDM_CONST.MITRE_TECHNIQUE_ACCOUNT_MANIPULATION_SSH_AUTHORIZED_KEYS,"@element" ~="T1583", XDM_CONST.MITRE_TECHNIQUE_ACQUIRE_INFRASTRUCTURE,"@element" ~="T1583.005", XDM_CONST.MITRE_TECHNIQUE_ACQUIRE_INFRASTRUCTURE_BOTNET,"@element" ~="T1583.002", XDM_CONST.MITRE_TECHNIQUE_ACQUIRE_INFRASTRUCTURE_DNS_SERVER,"@element" ~="T1583.001", XDM_CONST.MITRE_TECHNIQUE_ACQUIRE_INFRASTRUCTURE_DOMAINS,"@element" ~="T1583.004", XDM_CONST.MITRE_TECHNIQUE_ACQUIRE_INFRASTRUCTURE_SERVER,"@element" ~="T1583.003", XDM_CONST.MITRE_TECHNIQUE_ACQUIRE_INFRASTRUCTURE_VIRTUAL_PRIVATE_SERVER,"@element" ~="T1583.006", XDM_CONST.MITRE_TECHNIQUE_ACQUIRE_INFRASTRUCTURE_WEB_SERVICES,"@element" ~="T1595", XDM_CONST.MITRE_TECHNIQUE_ACTIVE_SCANNING,"@element" ~="T1595.001", XDM_CONST.MITRE_TECHNIQUE_ACTIVE_SCANNING_SCANNING_IP_BLOCKS,"@element" ~="T1595.002", XDM_CONST.MITRE_TECHNIQUE_ACTIVE_SCANNING_VULNERABILITY_SCANNING,"@element" ~="T1557", XDM_CONST.MITRE_TECHNIQUE_ADVERSARY_IN_THE_MIDDLE,"@element" ~="T1557.002", XDM_CONST.MITRE_TECHNIQUE_ADVERSARY_IN_THE_MIDDLE_ARP_CACHE_POISONING,"@element" ~="T1557.001", XDM_CONST.MITRE_TECHNIQUE_ADVERSARY_IN_THE_MIDDLE_LLMNR_NBT_NS_POISONING_AND_SMB_RELAY,"@element" ~="T1071", XDM_CONST.MITRE_TECHNIQUE_APPLICATION_LAYER_PROTOCOL,"@element" ~="T1071.004", XDM_CONST.MITRE_TECHNIQUE_APPLICATION_LAYER_PROTOCOL_DNS,"@element" ~="T1071.002", XDM_CONST.MITRE_TECHNIQUE_APPLICATION_LAYER_PROTOCOL_FILE_TRANSFER_PROTOCOLS,"@element" ~="T1071.003", XDM_CONST.MITRE_TECHNIQUE_APPLICATION_LAYER_PROTOCOL_MAIL_PROTOCOLS,"@element" ~="T1071.001", XDM_CONST.MITRE_TECHNIQUE_APPLICATION_LAYER_PROTOCOL_WEB_PROTOCOLS,"@element" ~="T1010", XDM_CONST.MITRE_TECHNIQUE_APPLICATION_WINDOW_DISCOVERY,"@element" ~="T1560", XDM_CONST.MITRE_TECHNIQUE_ARCHIVE_COLLECTED_DATA,"@element" ~="T1560.003", XDM_CONST.MITRE_TECHNIQUE_ARCHIVE_COLLECTED_DATA_ARCHIVE_VIA_CUSTOM_METHOD,"@element" ~="T1560.002", XDM_CONST.MITRE_TECHNIQUE_ARCHIVE_COLLECTED_DATA_ARCHIVE_VIA_LIBRARY,"@element" ~="T1560.001", XDM_CONST.MITRE_TECHNIQUE_ARCHIVE_COLLECTED_DATA_ARCHIVE_VIA_UTILITY,"@element" ~="T1123", XDM_CONST.MITRE_TECHNIQUE_AUDIO_CAPTURE,"@element" ~="T1119", XDM_CONST.MITRE_TECHNIQUE_AUTOMATED_COLLECTION,"@element" ~="T1020", XDM_CONST.MITRE_TECHNIQUE_AUTOMATED_EXFILTRATION,"@element" ~="T1020.001", XDM_CONST.MITRE_TECHNIQUE_AUTOMATED_EXFILTRATION_TRAFFIC_DUPLICATION,"@element" ~="T1197", XDM_CONST.MITRE_TECHNIQUE_BITS_JOBS,"@element" ~="T1547", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_AUTOSTART_EXECUTION,"@element" ~="T1547.014", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_AUTOSTART_EXECUTION_ACTIVE_SETUP,"@element" ~="T1547.002", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_AUTOSTART_EXECUTION_AUTHENTICATION_PACKAGE,"@element" ~="T1547.006", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_AUTOSTART_EXECUTION_KERNEL_MODULES_AND_EXTENSIONS,"@element" ~="T1547.008", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_AUTOSTART_EXECUTION_LSASS_DRIVER,"@element" ~="T1547.015", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_AUTOSTART_EXECUTION_LOGIN_ITEMS,"@element" ~="T1547.011", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_AUTOSTART_EXECUTION_PLIST_MODIFICATION,"@element" ~="T1547.010", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_AUTOSTART_EXECUTION_PORT_MONITORS,"@element" ~="T1547.012", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_AUTOSTART_EXECUTION_PRINT_PROCESSORS,"@element" ~="T1547.007", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_AUTOSTART_EXECUTION_RE_OPENED_APPLICATIONS,"@element" ~="T1547.001", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_AUTOSTART_EXECUTION_REGISTRY_RUN_KEYS_OR_STARTUP_FOLDER,"@element" ~="T1547.005", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_AUTOSTART_EXECUTION_SECURITY_SUPPORT_PROVIDER,"@element" ~="T1547.009", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_AUTOSTART_EXECUTION_SHORTCUT_MODIFICATION,"@element" ~="T1547.003", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_AUTOSTART_EXECUTION_TIME_PROVIDERS,"@element" ~="T1547.004", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_AUTOSTART_EXECUTION_WINLOGON_HELPER_DLL,"@element" ~="T1547.013", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_AUTOSTART_EXECUTION_XDG_AUTOSTART_ENTRIES,"@element" ~="T1037", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_INITIALIZATION_SCRIPTS,"@element" ~="T1037.002", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_INITIALIZATION_SCRIPTS_LOGON_SCRIPT_MAC,"@element" ~="T1037.001", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_INITIALIZATION_SCRIPTS_LOGON_SCRIPT_WINDOWS,"@element" ~="T1037.003", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_INITIALIZATION_SCRIPTS_NETWORK_LOGON_SCRIPT,"@element" ~="T1037.004", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_INITIALIZATION_SCRIPTS_RC_SCRIPTS,"@element" ~="T1037.005", XDM_CONST.MITRE_TECHNIQUE_BOOT_OR_LOGON_INITIALIZATION_SCRIPTS_STARTUP_ITEMS,"@element" ~="T1217", XDM_CONST.MITRE_TECHNIQUE_BROWSER_BOOKMARK_DISCOVERY,"@element" ~="T1176", XDM_CONST.MITRE_TECHNIQUE_BROWSER_EXTENSIONS,"@element" ~="T1185", XDM_CONST.MITRE_TECHNIQUE_BROWSER_SESSION_HIJACKING,"@element" ~="T1110", XDM_CONST.MITRE_TECHNIQUE_BRUTE_FORCE,"@element" ~="T1110.004", XDM_CONST.MITRE_TECHNIQUE_BRUTE_FORCE_CREDENTIAL_STUFFING,"@element" ~="T1110.002", XDM_CONST.MITRE_TECHNIQUE_BRUTE_FORCE_PASSWORD_CRACKING,"@element" ~="T1110.001", XDM_CONST.MITRE_TECHNIQUE_BRUTE_FORCE_PASSWORD_GUESSING,"@element" ~="T1110.003", XDM_CONST.MITRE_TECHNIQUE_BRUTE_FORCE_PASSWORD_SPRAYING,"@element" ~="T1612", XDM_CONST.MITRE_TECHNIQUE_BUILD_IMAGE_ON_HOST,"@element" ~="T1115", XDM_CONST.MITRE_TECHNIQUE_CLIPBOARD_DATA,"@element" ~="T1580", XDM_CONST.MITRE_TECHNIQUE_CLOUD_INFRASTRUCTURE_DISCOVERY,"@element" ~="T1538", XDM_CONST.MITRE_TECHNIQUE_CLOUD_SERVICE_DASHBOARD,"@element" ~="T1526", XDM_CONST.MITRE_TECHNIQUE_CLOUD_SERVICE_DISCOVERY,"@element" ~="T1619", XDM_CONST.MITRE_TECHNIQUE_CLOUD_STORAGE_OBJECT_DISCOVERY,"@element" ~="T1059", XDM_CONST.MITRE_TECHNIQUE_COMMAND_AND_SCRIPTING_INTERPRETER,"@element" ~="T1059.002", XDM_CONST.MITRE_TECHNIQUE_COMMAND_AND_SCRIPTING_INTERPRETER_APPLESCRIPT,"@element" ~="T1059.007", XDM_CONST.MITRE_TECHNIQUE_COMMAND_AND_SCRIPTING_INTERPRETER_JAVASCRIPT,"@element" ~="T1059.008", XDM_CONST.MITRE_TECHNIQUE_COMMAND_AND_SCRIPTING_INTERPRETER_NETWORK_DEVICE_CLI,"@element" ~="T1059.001", XDM_CONST.MITRE_TECHNIQUE_COMMAND_AND_SCRIPTING_INTERPRETER_POWERSHELL,"@element" ~="T1059.006", XDM_CONST.MITRE_TECHNIQUE_COMMAND_AND_SCRIPTING_INTERPRETER_PYTHON,"@element" ~="T1059.004", XDM_CONST.MITRE_TECHNIQUE_COMMAND_AND_SCRIPTING_INTERPRETER_UNIX_SHELL,"@element" ~="T1059.005", XDM_CONST.MITRE_TECHNIQUE_COMMAND_AND_SCRIPTING_INTERPRETER_VISUAL_BASIC,"@element" ~="T1059.003", XDM_CONST.MITRE_TECHNIQUE_COMMAND_AND_SCRIPTING_INTERPRETER_WINDOWS_COMMAND_SHELL,"@element" ~="T1092", XDM_CONST.MITRE_TECHNIQUE_COMMUNICATION_THROUGH_REMOVABLE_MEDIA,"@element" ~="T1586", XDM_CONST.MITRE_TECHNIQUE_COMPROMISE_ACCOUNTS,"@element" ~="T1586.002", XDM_CONST.MITRE_TECHNIQUE_COMPROMISE_ACCOUNTS_EMAIL_ACCOUNTS,"@element" ~="T1586.001", XDM_CONST.MITRE_TECHNIQUE_COMPROMISE_ACCOUNTS_SOCIAL_MEDIA_ACCOUNTS,"@element" ~="T1554", XDM_CONST.MITRE_TECHNIQUE_COMPROMISE_CLIENT_SOFTWARE_BINARY,"@element" ~="T1584", XDM_CONST.MITRE_TECHNIQUE_COMPROMISE_INFRASTRUCTURE,"@element" ~="T1584.005", XDM_CONST.MITRE_TECHNIQUE_COMPROMISE_INFRASTRUCTURE_BOTNET,"@element" ~="T1584.002", XDM_CONST.MITRE_TECHNIQUE_COMPROMISE_INFRASTRUCTURE_DNS_SERVER,"@element" ~="T1584.001", XDM_CONST.MITRE_TECHNIQUE_COMPROMISE_INFRASTRUCTURE_DOMAINS,"@element" ~="T1584.004", XDM_CONST.MITRE_TECHNIQUE_COMPROMISE_INFRASTRUCTURE_SERVER,"@element" ~="T1584.003", XDM_CONST.MITRE_TECHNIQUE_COMPROMISE_INFRASTRUCTURE_VIRTUAL_PRIVATE_SERVER,"@element" ~="T1584.006", XDM_CONST.MITRE_TECHNIQUE_COMPROMISE_INFRASTRUCTURE_WEB_SERVICES,"@element" ~="T1609", XDM_CONST.MITRE_TECHNIQUE_CONTAINER_ADMINISTRATION_COMMAND,"@element" ~="T1613", XDM_CONST.MITRE_TECHNIQUE_CONTAINER_AND_RESOURCE_DISCOVERY,"@element" ~="T1136", XDM_CONST.MITRE_TECHNIQUE_CREATE_ACCOUNT,"@element" ~="T1136.003", XDM_CONST.MITRE_TECHNIQUE_CREATE_ACCOUNT_CLOUD_ACCOUNT,"@element" ~="T1136.002", XDM_CONST.MITRE_TECHNIQUE_CREATE_ACCOUNT_DOMAIN_ACCOUNT,"@element" ~="T1136.001", XDM_CONST.MITRE_TECHNIQUE_CREATE_ACCOUNT_LOCAL_ACCOUNT,"@element" ~="T1543", XDM_CONST.MITRE_TECHNIQUE_CREATE_OR_MODIFY_SYSTEM_PROCESS,"@element" ~="T1543.001", XDM_CONST.MITRE_TECHNIQUE_CREATE_OR_MODIFY_SYSTEM_PROCESS_LAUNCH_AGENT,"@element" ~="T1543.004", XDM_CONST.MITRE_TECHNIQUE_CREATE_OR_MODIFY_SYSTEM_PROCESS_LAUNCH_DAEMON,"@element" ~="T1543.002", XDM_CONST.MITRE_TECHNIQUE_CREATE_OR_MODIFY_SYSTEM_PROCESS_SYSTEMD_SERVICE,"@element" ~="T1543.003", XDM_CONST.MITRE_TECHNIQUE_CREATE_OR_MODIFY_SYSTEM_PROCESS_WINDOWS_SERVICE,"@element" ~="T1555", XDM_CONST.MITRE_TECHNIQUE_CREDENTIALS_FROM_PASSWORD_STORES,"@element" ~="T1555.003", XDM_CONST.MITRE_TECHNIQUE_CREDENTIALS_FROM_PASSWORD_STORES_CREDENTIALS_FROM_WEB_BROWSERS,"@element" ~="T1555.001", XDM_CONST.MITRE_TECHNIQUE_CREDENTIALS_FROM_PASSWORD_STORES_KEYCHAIN,"@element" ~="T1555.005", XDM_CONST.MITRE_TECHNIQUE_CREDENTIALS_FROM_PASSWORD_STORES_PASSWORD_MANAGERS,"@element" ~="T1555.002", XDM_CONST.MITRE_TECHNIQUE_CREDENTIALS_FROM_PASSWORD_STORES_SECURITYD_MEMORY,"@element" ~="T1555.004", XDM_CONST.MITRE_TECHNIQUE_CREDENTIALS_FROM_PASSWORD_STORES_WINDOWS_CREDENTIAL_MANAGER,"@element" ~="T1485", XDM_CONST.MITRE_TECHNIQUE_DATA_DESTRUCTION,"@element" ~="T1132", XDM_CONST.MITRE_TECHNIQUE_DATA_ENCODING,"@element" ~="T1132.002", XDM_CONST.MITRE_TECHNIQUE_DATA_ENCODING_NON_STANDARD_ENCODING,"@element" ~="T1132.001", XDM_CONST.MITRE_TECHNIQUE_DATA_ENCODING_STANDARD_ENCODING,"@element" ~="T1486", XDM_CONST.MITRE_TECHNIQUE_DATA_ENCRYPTED_FOR_IMPACT,"@element" ~="T1565", XDM_CONST.MITRE_TECHNIQUE_DATA_MANIPULATION,"@element" ~="T1565.003", XDM_CONST.MITRE_TECHNIQUE_DATA_MANIPULATION_RUNTIME_DATA_MANIPULATION,"@element" ~="T1565.001", XDM_CONST.MITRE_TECHNIQUE_DATA_MANIPULATION_STORED_DATA_MANIPULATION,"@element" ~="T1565.002", XDM_CONST.MITRE_TECHNIQUE_DATA_MANIPULATION_TRANSMITTED_DATA_MANIPULATION,"@element" ~="T1001", XDM_CONST.MITRE_TECHNIQUE_DATA_OBFUSCATION,"@element" ~="T1001.001", XDM_CONST.MITRE_TECHNIQUE_DATA_OBFUSCATION_JUNK_DATA,"@element" ~="T1001.003", XDM_CONST.MITRE_TECHNIQUE_DATA_OBFUSCATION_PROTOCOL_IMPERSONATION,"@element" ~="T1001.002", XDM_CONST.MITRE_TECHNIQUE_DATA_OBFUSCATION_STEGANOGRAPHY,"@element" ~="T1074", XDM_CONST.MITRE_TECHNIQUE_DATA_STAGED,"@element" ~="T1074.001", XDM_CONST.MITRE_TECHNIQUE_DATA_STAGED_LOCAL_DATA_STAGING,"@element" ~="T1074.002", XDM_CONST.MITRE_TECHNIQUE_DATA_STAGED_REMOTE_DATA_STAGING,"@element" ~="T1030", XDM_CONST.MITRE_TECHNIQUE_DATA_TRANSFER_SIZE_LIMITS,"@element" ~="T1530", XDM_CONST.MITRE_TECHNIQUE_DATA_FROM_CLOUD_STORAGE_OBJECT,"@element" ~="T1602", XDM_CONST.MITRE_TECHNIQUE_DATA_FROM_CONFIGURATION_REPOSITORY,"@element" ~="T1602.002", XDM_CONST.MITRE_TECHNIQUE_DATA_FROM_CONFIGURATION_REPOSITORY_NETWORK_DEVICE_CONFIGURATION_DUMP,"@element" ~="T1602.001", XDM_CONST.MITRE_TECHNIQUE_DATA_FROM_CONFIGURATION_REPOSITORY_SNMP,"@element" ~="T1213", XDM_CONST.MITRE_TECHNIQUE_DATA_FROM_INFORMATION_REPOSITORIES,"@element" ~="T1213.003", XDM_CONST.MITRE_TECHNIQUE_DATA_FROM_INFORMATION_REPOSITORIES_CODE_REPOSITORIES,"@element" ~="T1213.001", XDM_CONST.MITRE_TECHNIQUE_DATA_FROM_INFORMATION_REPOSITORIES_CONFLUENCE,"@element" ~="T1213.002", XDM_CONST.MITRE_TECHNIQUE_DATA_FROM_INFORMATION_REPOSITORIES_SHAREPOINT,"@element" ~="T1005", XDM_CONST.MITRE_TECHNIQUE_DATA_FROM_LOCAL_SYSTEM,"@element" ~="T1039", XDM_CONST.MITRE_TECHNIQUE_DATA_FROM_NETWORK_SHARED_DRIVE,"@element" ~="T1025", XDM_CONST.MITRE_TECHNIQUE_DATA_FROM_REMOVABLE_MEDIA,"@element" ~="T1491", XDM_CONST.MITRE_TECHNIQUE_DEFACEMENT,"@element" ~="T1491.002", XDM_CONST.MITRE_TECHNIQUE_DEFACEMENT_EXTERNAL_DEFACEMENT,"@element" ~="T1491.001", XDM_CONST.MITRE_TECHNIQUE_DEFACEMENT_INTERNAL_DEFACEMENT,"@element" ~="T1140", XDM_CONST.MITRE_TECHNIQUE_DEOBFUSCATE_DECODE_FILES_OR_INFORMATION,"@element" ~="T1610", XDM_CONST.MITRE_TECHNIQUE_DEPLOY_CONTAINER,"@element" ~="T1587", XDM_CONST.MITRE_TECHNIQUE_DEVELOP_CAPABILITIES,"@element" ~="T1587.002", XDM_CONST.MITRE_TECHNIQUE_DEVELOP_CAPABILITIES_CODE_SIGNING_CERTIFICATES,"@element" ~="T1587.003", XDM_CONST.MITRE_TECHNIQUE_DEVELOP_CAPABILITIES_DIGITAL_CERTIFICATES,"@element" ~="T1587.004", XDM_CONST.MITRE_TECHNIQUE_DEVELOP_CAPABILITIES_EXPLOITS,"@element" ~="T1587.001", XDM_CONST.MITRE_TECHNIQUE_DEVELOP_CAPABILITIES_MALWARE,"@element" ~="T1006", XDM_CONST.MITRE_TECHNIQUE_DIRECT_VOLUME_ACCESS,"@element" ~="T1561", XDM_CONST.MITRE_TECHNIQUE_DISK_WIPE,"@element" ~="T1561.001", XDM_CONST.MITRE_TECHNIQUE_DISK_WIPE_DISK_CONTENT_WIPE,"@element" ~="T1561.002", XDM_CONST.MITRE_TECHNIQUE_DISK_WIPE_DISK_STRUCTURE_WIPE,"@element" ~="T1484", XDM_CONST.MITRE_TECHNIQUE_DOMAIN_POLICY_MODIFICATION,"@element" ~="T1484.002", XDM_CONST.MITRE_TECHNIQUE_DOMAIN_POLICY_MODIFICATION_DOMAIN_TRUST_MODIFICATION,"@element" ~="T1484.001", XDM_CONST.MITRE_TECHNIQUE_DOMAIN_POLICY_MODIFICATION_GROUP_POLICY_MODIFICATION,"@element" ~="T1482", XDM_CONST.MITRE_TECHNIQUE_DOMAIN_TRUST_DISCOVERY,"@element" ~="T1189", XDM_CONST.MITRE_TECHNIQUE_DRIVE_BY_COMPROMISE,"@element" ~="T1568", XDM_CONST.MITRE_TECHNIQUE_DYNAMIC_RESOLUTION,"@element" ~="T1568.003", XDM_CONST.MITRE_TECHNIQUE_DYNAMIC_RESOLUTION_DNS_CALCULATION,"@element" ~="T1568.002", XDM_CONST.MITRE_TECHNIQUE_DYNAMIC_RESOLUTION_DOMAIN_GENERATION_ALGORITHMS,"@element" ~="T1568.001", XDM_CONST.MITRE_TECHNIQUE_DYNAMIC_RESOLUTION_FAST_FLUX_DNS,"@element" ~="T1114", XDM_CONST.MITRE_TECHNIQUE_EMAIL_COLLECTION,"@element" ~="T1114.003", XDM_CONST.MITRE_TECHNIQUE_EMAIL_COLLECTION_EMAIL_FORWARDING_RULE,"@element" ~="T1114.001", XDM_CONST.MITRE_TECHNIQUE_EMAIL_COLLECTION_LOCAL_EMAIL_COLLECTION,"@element" ~="T1114.002", XDM_CONST.MITRE_TECHNIQUE_EMAIL_COLLECTION_REMOTE_EMAIL_COLLECTION,"@element" ~="T1573", XDM_CONST.MITRE_TECHNIQUE_ENCRYPTED_CHANNEL,"@element" ~="T1573.002", XDM_CONST.MITRE_TECHNIQUE_ENCRYPTED_CHANNEL_ASYMMETRIC_CRYPTOGRAPHY,"@element" ~="T1573.001", XDM_CONST.MITRE_TECHNIQUE_ENCRYPTED_CHANNEL_SYMMETRIC_CRYPTOGRAPHY,"@element" ~="T1499", XDM_CONST.MITRE_TECHNIQUE_ENDPOINT_DENIAL_OF_SERVICE,"@element" ~="T1499.003", XDM_CONST.MITRE_TECHNIQUE_ENDPOINT_DENIAL_OF_SERVICE_APPLICATION_EXHAUSTION_FLOOD,"@element" ~="T1499.004", XDM_CONST.MITRE_TECHNIQUE_ENDPOINT_DENIAL_OF_SERVICE_APPLICATION_OR_SYSTEM_EXPLOITATION,"@element" ~="T1499.001", XDM_CONST.MITRE_TECHNIQUE_ENDPOINT_DENIAL_OF_SERVICE_OS_EXHAUSTION_FLOOD,"@element" ~="T1499.002", XDM_CONST.MITRE_TECHNIQUE_ENDPOINT_DENIAL_OF_SERVICE_SERVICE_EXHAUSTION_FLOOD,"@element" ~="T1611", XDM_CONST.MITRE_TECHNIQUE_ESCAPE_TO_HOST,"@element" ~="T1585", XDM_CONST.MITRE_TECHNIQUE_ESTABLISH_ACCOUNTS,"@element" ~="T1585.002", XDM_CONST.MITRE_TECHNIQUE_ESTABLISH_ACCOUNTS_EMAIL_ACCOUNTS,"@element" ~="T1585.001", XDM_CONST.MITRE_TECHNIQUE_ESTABLISH_ACCOUNTS_SOCIAL_MEDIA_ACCOUNTS,"@element" ~="T1546", XDM_CONST.MITRE_TECHNIQUE_EVENT_TRIGGERED_EXECUTION,"@element" ~="T1546.008", XDM_CONST.MITRE_TECHNIQUE_EVENT_TRIGGERED_EXECUTION_ACCESSIBILITY_FEATURES,"@element" ~="T1546.009", XDM_CONST.MITRE_TECHNIQUE_EVENT_TRIGGERED_EXECUTION_APPCERT_DLLS,"@element" ~="T1546.010", XDM_CONST.MITRE_TECHNIQUE_EVENT_TRIGGERED_EXECUTION_APPINIT_DLLS,"@element" ~="T1546.011", XDM_CONST.MITRE_TECHNIQUE_EVENT_TRIGGERED_EXECUTION_APPLICATION_SHIMMING,"@element" ~="T1546.001", XDM_CONST.MITRE_TECHNIQUE_EVENT_TRIGGERED_EXECUTION_CHANGE_DEFAULT_FILE_ASSOCIATION,"@element" ~="T1546.015", XDM_CONST.MITRE_TECHNIQUE_EVENT_TRIGGERED_EXECUTION_COMPONENT_OBJECT_MODEL_HIJACKING,"@element" ~="T1546.014", XDM_CONST.MITRE_TECHNIQUE_EVENT_TRIGGERED_EXECUTION_EMOND,"@element" ~="T1546.012", XDM_CONST.MITRE_TECHNIQUE_EVENT_TRIGGERED_EXECUTION_IMAGE_FILE_EXECUTION_OPTIONS_INJECTION,"@element" ~="T1546.006", XDM_CONST.MITRE_TECHNIQUE_EVENT_TRIGGERED_EXECUTION_LC_LOAD_DYLIB_ADDITION,"@element" ~="T1546.007", XDM_CONST.MITRE_TECHNIQUE_EVENT_TRIGGERED_EXECUTION_NETSH_HELPER_DLL,"@element" ~="T1546.013", XDM_CONST.MITRE_TECHNIQUE_EVENT_TRIGGERED_EXECUTION_POWERSHELL_PROFILE,"@element" ~="T1546.002", XDM_CONST.MITRE_TECHNIQUE_EVENT_TRIGGERED_EXECUTION_SCREENSAVER,"@element" ~="T1546.005", XDM_CONST.MITRE_TECHNIQUE_EVENT_TRIGGERED_EXECUTION_TRAP,"@element" ~="T1546.004", XDM_CONST.MITRE_TECHNIQUE_EVENT_TRIGGERED_EXECUTION_UNIX_SHELL_CONFIGURATION_MODIFICATION,
"@element" ~="T1546.003",XDM_CONST.MITRE_TECHNIQUE_MITRE_TECHNIQUE_EVENT_TRIGGERED_EXECUTION_WINDOWS_MANAGEMENT_INSTRUMENTATION_EVENT_SUBSCRIPTION,"@element" ~="T1480", XDM_CONST.MITRE_TECHNIQUE_EXECUTION_GUARDRAILS,"@element" ~="T1480.001", XDM_CONST.MITRE_TECHNIQUE_EXECUTION_GUARDRAILS_ENVIRONMENTAL_KEYING,"@element" ~="T1048", XDM_CONST.MITRE_TECHNIQUE_EXFILTRATION_OVER_ALTERNATIVE_PROTOCOL,
"@element" ~="T1048.002",XDM_CONST.MITRE_TECHNIQUE_MITRE_TECHNIQUE_EXFILTRATION_OVER_ALTERNATIVE_PROTOCOL_EXFILTRATION_OVER_ASYMMETRIC_ENCRYPTED_NON_C2_PROTOCOL,
"@element" ~="T1048.001",XDM_CONST.MITRE_TECHNIQUE_MITRE_TECHNIQUE_EXFILTRATION_OVER_ALTERNATIVE_PROTOCOL_EXFILTRATION_OVER_SYMMETRIC_ENCRYPTED_NON_C2_PROTOCOL,
"@element" ~="T1048.003",XDM_CONST.MITRE_TECHNIQUE_MITRE_TECHNIQUE_EXFILTRATION_OVER_ALTERNATIVE_PROTOCOL_EXFILTRATION_OVER_UNENCRYPTED_OBFUSCATED_NON_C2_PROTOCOL,"@element" ~="T1041", XDM_CONST.MITRE_TECHNIQUE_EXFILTRATION_OVER_C2_CHANNEL,"@element" ~="T1011", XDM_CONST.MITRE_TECHNIQUE_EXFILTRATION_OVER_OTHER_NETWORK_MEDIUM,"@element" ~="T1011.001", XDM_CONST.MITRE_TECHNIQUE_EXFILTRATION_OVER_OTHER_NETWORK_MEDIUM_EXFILTRATION_OVER_BLUETOOTH,"@element" ~="T1052", XDM_CONST.MITRE_TECHNIQUE_EXFILTRATION_OVER_PHYSICAL_MEDIUM,"@element" ~="T1052.001", XDM_CONST.MITRE_TECHNIQUE_EXFILTRATION_OVER_PHYSICAL_MEDIUM_EXFILTRATION_OVER_USB,"@element" ~="T1567", XDM_CONST.MITRE_TECHNIQUE_EXFILTRATION_OVER_WEB_SERVICE,"@element" ~="T1567.002", XDM_CONST.MITRE_TECHNIQUE_EXFILTRATION_OVER_WEB_SERVICE_EXFILTRATION_TO_CLOUD_STORAGE,"@element" ~="T1567.001", XDM_CONST.MITRE_TECHNIQUE_EXFILTRATION_OVER_WEB_SERVICE_EXFILTRATION_TO_CODE_REPOSITORY,"@element" ~="T1190", XDM_CONST.MITRE_TECHNIQUE_EXPLOIT_PUBLIC_FACING_APPLICATION,"@element" ~="T1203", XDM_CONST.MITRE_TECHNIQUE_EXPLOITATION_FOR_CLIENT_EXECUTION,"@element" ~="T1212", XDM_CONST.MITRE_TECHNIQUE_EXPLOITATION_FOR_CREDENTIAL_ACCESS,"@element" ~="T1211", XDM_CONST.MITRE_TECHNIQUE_EXPLOITATION_FOR_DEFENSE_EVASION,"@element" ~="T1068", XDM_CONST.MITRE_TECHNIQUE_EXPLOITATION_FOR_PRIVILEGE_ESCALATION,"@element" ~="T1210", XDM_CONST.MITRE_TECHNIQUE_EXPLOITATION_OF_REMOTE_SERVICES,"@element" ~="T1133", XDM_CONST.MITRE_TECHNIQUE_EXTERNAL_REMOTE_SERVICES,"@element" ~="T1008", XDM_CONST.MITRE_TECHNIQUE_FALLBACK_CHANNELS,"@element" ~="T1083", XDM_CONST.MITRE_TECHNIQUE_FILE_AND_DIRECTORY_DISCOVERY,"@element" ~="T1222", XDM_CONST.MITRE_TECHNIQUE_FILE_AND_DIRECTORY_PERMISSIONS_MODIFICATION,
"@element" ~="T1222.002",XDM_CONST.MITRE_TECHNIQUE_MITRE_TECHNIQUE_FILE_AND_DIRECTORY_PERMISSIONS_MODIFICATION_LINUX_AND_MAC_FILE_AND_DIRECTORY_PERMISSIONS_MODIFICATION,
"@element" ~="T1222.001",XDM_CONST.MITRE_TECHNIQUE_MITRE_TECHNIQUE_FILE_AND_DIRECTORY_PERMISSIONS_MODIFICATION_WINDOWS_FILE_AND_DIRECTORY_PERMISSIONS_MODIFICATION,"@element" ~="T1495", XDM_CONST.MITRE_TECHNIQUE_FIRMWARE_CORRUPTION,"@element" ~="T1187", XDM_CONST.MITRE_TECHNIQUE_FORCED_AUTHENTICATION,"@element" ~="T1606", XDM_CONST.MITRE_TECHNIQUE_FORGE_WEB_CREDENTIALS,"@element" ~="T1606.002", XDM_CONST.MITRE_TECHNIQUE_FORGE_WEB_CREDENTIALS_SAML_TOKENS,"@element" ~="T1606.001", XDM_CONST.MITRE_TECHNIQUE_FORGE_WEB_CREDENTIALS_WEB_COOKIES,"@element" ~="T1592", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_HOST_INFORMATION,"@element" ~="T1592.004", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_HOST_INFORMATION_CLIENT_CONFIGURATIONS,"@element" ~="T1592.003", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_HOST_INFORMATION_FIRMWARE,"@element" ~="T1592.001", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_HOST_INFORMATION_HARDWARE,"@element" ~="T1592.002", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_HOST_INFORMATION_SOFTWARE,"@element" ~="T1589", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_IDENTITY_INFORMATION,"@element" ~="T1589.001", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_IDENTITY_INFORMATION_CREDENTIALS,"@element" ~="T1589.002", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_IDENTITY_INFORMATION_EMAIL_ADDRESSES,"@element" ~="T1589.003", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_IDENTITY_INFORMATION_EMPLOYEE_NAMES,"@element" ~="T1590", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_NETWORK_INFORMATION,"@element" ~="T1590.002", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_NETWORK_INFORMATION_DNS,"@element" ~="T1590.001", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_NETWORK_INFORMATION_DOMAIN_PROPERTIES,"@element" ~="T1590.005", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_NETWORK_INFORMATION_IP_ADDRESSES,"@element" ~="T1590.006", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_NETWORK_INFORMATION_NETWORK_SECURITY_APPLIANCES,"@element" ~="T1590.004", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_NETWORK_INFORMATION_NETWORK_TOPOLOGY,"@element" ~="T1590.003", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_NETWORK_INFORMATION_NETWORK_TRUST_DEPENDENCIES,"@element" ~="T1591", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_ORG_INFORMATION,"@element" ~="T1591.002", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_ORG_INFORMATION_BUSINESS_RELATIONSHIPS,"@element" ~="T1591.001", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_ORG_INFORMATION_DETERMINE_PHYSICAL_LOCATIONS,"@element" ~="T1591.003", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_ORG_INFORMATION_IDENTIFY_BUSINESS_TEMPO,"@element" ~="T1591.004", XDM_CONST.MITRE_TECHNIQUE_GATHER_VICTIM_ORG_INFORMATION_IDENTIFY_ROLES,"@element" ~="T1615", XDM_CONST.MITRE_TECHNIQUE_GROUP_POLICY_DISCOVERY,"@element" ~="T1200", XDM_CONST.MITRE_TECHNIQUE_HARDWARE_ADDITIONS,"@element" ~="T1564", XDM_CONST.MITRE_TECHNIQUE_HIDE_ARTIFACTS,"@element" ~="T1564.008", XDM_CONST.MITRE_TECHNIQUE_HIDE_ARTIFACTS_EMAIL_HIDING_RULES,"@element" ~="T1564.005", XDM_CONST.MITRE_TECHNIQUE_HIDE_ARTIFACTS_HIDDEN_FILE_SYSTEM,"@element" ~="T1564.001", XDM_CONST.MITRE_TECHNIQUE_HIDE_ARTIFACTS_HIDDEN_FILES_AND_DIRECTORIES,"@element" ~="T1564.002", XDM_CONST.MITRE_TECHNIQUE_HIDE_ARTIFACTS_HIDDEN_USERS,"@element" ~="T1564.003", XDM_CONST.MITRE_TECHNIQUE_HIDE_ARTIFACTS_HIDDEN_WINDOW,"@element" ~="T1564.004", XDM_CONST.MITRE_TECHNIQUE_HIDE_ARTIFACTS_NTFS_FILE_ATTRIBUTES,"@element" ~="T1564.009", XDM_CONST.MITRE_TECHNIQUE_HIDE_ARTIFACTS_RESOURCE_FORKING,"@element" ~="T1564.006", XDM_CONST.MITRE_TECHNIQUE_HIDE_ARTIFACTS_RUN_VIRTUAL_INSTANCE,"@element" ~="T1564.007", XDM_CONST.MITRE_TECHNIQUE_HIDE_ARTIFACTS_VBA_STOMPING,"@element" ~="T1574", XDM_CONST.MITRE_TECHNIQUE_HIJACK_EXECUTION_FLOW,"@element" ~="T1574.012", XDM_CONST.MITRE_TECHNIQUE_HIJACK_EXECUTION_FLOW_COR_PROFILER,"@element" ~="T1574.001", XDM_CONST.MITRE_TECHNIQUE_HIJACK_EXECUTION_FLOW_DLL_SEARCH_ORDER_HIJACKING,"@element" ~="T1574.002", XDM_CONST.MITRE_TECHNIQUE_HIJACK_EXECUTION_FLOW_DLL_SIDE_LOADING,"@element" ~="T1574.004", XDM_CONST.MITRE_TECHNIQUE_HIJACK_EXECUTION_FLOW_DYLIB_HIJACKING,"@element" ~="T1574.006", XDM_CONST.MITRE_TECHNIQUE_HIJACK_EXECUTION_FLOW_DYNAMIC_LINKER_HIJACKING,"@element" ~="T1574.005", XDM_CONST.MITRE_TECHNIQUE_HIJACK_EXECUTION_FLOW_EXECUTABLE_INSTALLER_FILE_PERMISSIONS_WEAKNESS,"@element" ~="T1574.007", XDM_CONST.MITRE_TECHNIQUE_HIJACK_EXECUTION_FLOW_PATH_INTERCEPTION_BY_PATH_ENVIRONMENT_VARIABLE,"@element" ~="T1574.008", XDM_CONST.MITRE_TECHNIQUE_HIJACK_EXECUTION_FLOW_PATH_INTERCEPTION_BY_SEARCH_ORDER_HIJACKING,"@element" ~="T1574.009", XDM_CONST.MITRE_TECHNIQUE_HIJACK_EXECUTION_FLOW_PATH_INTERCEPTION_BY_UNQUOTED_PATH,"@element" ~="T1574.010", XDM_CONST.MITRE_TECHNIQUE_HIJACK_EXECUTION_FLOW_SERVICES_FILE_PERMISSIONS_WEAKNESS,"@element" ~="T1574.011", XDM_CONST.MITRE_TECHNIQUE_HIJACK_EXECUTION_FLOW_SERVICES_REGISTRY_PERMISSIONS_WEAKNESS,"@element" ~="T1562", XDM_CONST.MITRE_TECHNIQUE_IMPAIR_DEFENSES,"@element" ~="T1562.008", XDM_CONST.MITRE_TECHNIQUE_IMPAIR_DEFENSES_DISABLE_CLOUD_LOGS,"@element" ~="T1562.002", XDM_CONST.MITRE_TECHNIQUE_IMPAIR_DEFENSES_DISABLE_WINDOWS_EVENT_LOGGING,"@element" ~="T1562.007", XDM_CONST.MITRE_TECHNIQUE_IMPAIR_DEFENSES_DISABLE_OR_MODIFY_CLOUD_FIREWALL,"@element" ~="T1562.004", XDM_CONST.MITRE_TECHNIQUE_IMPAIR_DEFENSES_DISABLE_OR_MODIFY_SYSTEM_FIREWALL,"@element" ~="T1562.001", XDM_CONST.MITRE_TECHNIQUE_IMPAIR_DEFENSES_DISABLE_OR_MODIFY_TOOLS,"@element" ~="T1562.010", XDM_CONST.MITRE_TECHNIQUE_IMPAIR_DEFENSES_DOWNGRADE_ATTACK,"@element" ~="T1562.003", XDM_CONST.MITRE_TECHNIQUE_IMPAIR_DEFENSES_IMPAIR_COMMAND_HISTORY_LOGGING,"@element" ~="T1562.006", XDM_CONST.MITRE_TECHNIQUE_IMPAIR_DEFENSES_INDICATOR_BLOCKING,"@element" ~="T1562.009", XDM_CONST.MITRE_TECHNIQUE_IMPAIR_DEFENSES_SAFE_MODE_BOOT,"@element" ~="T1525", XDM_CONST.MITRE_TECHNIQUE_IMPLANT_INTERNAL_IMAGE,"@element" ~="T1070", XDM_CONST.MITRE_TECHNIQUE_INDICATOR_REMOVAL_ON_HOST,"@element" ~="T1070.003", XDM_CONST.MITRE_TECHNIQUE_INDICATOR_REMOVAL_ON_HOST_CLEAR_COMMAND_HISTORY,"@element" ~="T1070.002", XDM_CONST.MITRE_TECHNIQUE_INDICATOR_REMOVAL_ON_HOST_CLEAR_LINUX_OR_MAC_SYSTEM_LOGS,"@element" ~="T1070.001", XDM_CONST.MITRE_TECHNIQUE_INDICATOR_REMOVAL_ON_HOST_CLEAR_WINDOWS_EVENT_LOGS,"@element" ~="T1070.004", XDM_CONST.MITRE_TECHNIQUE_INDICATOR_REMOVAL_ON_HOST_FILE_DELETION,"@element" ~="T1070.005", XDM_CONST.MITRE_TECHNIQUE_INDICATOR_REMOVAL_ON_HOST_NETWORK_SHARE_CONNECTION_REMOVAL,"@element" ~="T1070.006", XDM_CONST.MITRE_TECHNIQUE_INDICATOR_REMOVAL_ON_HOST_TIMESTOMP,"@element" ~="T1202", XDM_CONST.MITRE_TECHNIQUE_INDIRECT_COMMAND_EXECUTION,"@element" ~="T1105", XDM_CONST.MITRE_TECHNIQUE_INGRESS_TOOL_TRANSFER,"@element" ~="T1490", XDM_CONST.MITRE_TECHNIQUE_INHIBIT_SYSTEM_RECOVERY,"@element" ~="T1056", XDM_CONST.MITRE_TECHNIQUE_INPUT_CAPTURE,"@element" ~="T1056.004", XDM_CONST.MITRE_TECHNIQUE_INPUT_CAPTURE_CREDENTIAL_API_HOOKING,"@element" ~="T1056.002", XDM_CONST.MITRE_TECHNIQUE_INPUT_CAPTURE_GUI_INPUT_CAPTURE,"@element" ~="T1056.001", XDM_CONST.MITRE_TECHNIQUE_INPUT_CAPTURE_KEYLOGGING,"@element" ~="T1056.003", XDM_CONST.MITRE_TECHNIQUE_INPUT_CAPTURE_WEB_PORTAL_CAPTURE,"@element" ~="T1559", XDM_CONST.MITRE_TECHNIQUE_INTER_PROCESS_COMMUNICATION,"@element" ~="T1559.001", XDM_CONST.MITRE_TECHNIQUE_INTER_PROCESS_COMMUNICATION_COMPONENT_OBJECT_MODEL,"@element" ~="T1559.002", XDM_CONST.MITRE_TECHNIQUE_INTER_PROCESS_COMMUNICATION_DYNAMIC_DATA_EXCHANGE,"@element" ~="T1534", XDM_CONST.MITRE_TECHNIQUE_INTERNAL_SPEARPHISHING,"@element" ~="T1570", XDM_CONST.MITRE_TECHNIQUE_LATERAL_TOOL_TRANSFER,"@element" ~="T1036", XDM_CONST.MITRE_TECHNIQUE_MASQUERADING,"@element" ~="T1036.007", XDM_CONST.MITRE_TECHNIQUE_MASQUERADING_DOUBLE_FILE_EXTENSION,"@element" ~="T1036.001", XDM_CONST.MITRE_TECHNIQUE_MASQUERADING_INVALID_CODE_SIGNATURE,"@element" ~="T1036.004", XDM_CONST.MITRE_TECHNIQUE_MASQUERADING_MASQUERADE_TASK_OR_SERVICE,"@element" ~="T1036.005", XDM_CONST.MITRE_TECHNIQUE_MASQUERADING_MATCH_LEGITIMATE_NAME_OR_LOCATION,"@element" ~="T1036.003", XDM_CONST.MITRE_TECHNIQUE_MASQUERADING_RENAME_SYSTEM_UTILITIES,"@element" ~="T1036.002", XDM_CONST.MITRE_TECHNIQUE_MASQUERADING_RIGHT_TO_LEFT_OVERRIDE,"@element" ~="T1036.006", XDM_CONST.MITRE_TECHNIQUE_MASQUERADING_SPACE_AFTER_FILENAME,"@element" ~="T1556", XDM_CONST.MITRE_TECHNIQUE_MODIFY_AUTHENTICATION_PROCESS,"@element" ~="T1556.001", XDM_CONST.MITRE_TECHNIQUE_MODIFY_AUTHENTICATION_PROCESS_DOMAIN_CONTROLLER_AUTHENTICATION,"@element" ~="T1556.004", XDM_CONST.MITRE_TECHNIQUE_MODIFY_AUTHENTICATION_PROCESS_NETWORK_DEVICE_AUTHENTICATION,"@element" ~="T1556.002", XDM_CONST.MITRE_TECHNIQUE_MODIFY_AUTHENTICATION_PROCESS_PASSWORD_FILTER_DLL,"@element" ~="T1556.003", XDM_CONST.MITRE_TECHNIQUE_MODIFY_AUTHENTICATION_PROCESS_PLUGGABLE_AUTHENTICATION_MODULES,"@element" ~="T1578", XDM_CONST.MITRE_TECHNIQUE_MODIFY_CLOUD_COMPUTE_INFRASTRUCTURE,"@element" ~="T1578.002", XDM_CONST.MITRE_TECHNIQUE_MODIFY_CLOUD_COMPUTE_INFRASTRUCTURE_CREATE_CLOUD_INSTANCE,"@element" ~="T1578.001", XDM_CONST.MITRE_TECHNIQUE_MODIFY_CLOUD_COMPUTE_INFRASTRUCTURE_CREATE_SNAPSHOT,"@element" ~="T1578.003", XDM_CONST.MITRE_TECHNIQUE_MODIFY_CLOUD_COMPUTE_INFRASTRUCTURE_DELETE_CLOUD_INSTANCE,"@element" ~="T1578.004", XDM_CONST.MITRE_TECHNIQUE_MODIFY_CLOUD_COMPUTE_INFRASTRUCTURE_REVERT_CLOUD_INSTANCE,"@element" ~="T1112", XDM_CONST.MITRE_TECHNIQUE_MODIFY_REGISTRY,"@element" ~="T1601", XDM_CONST.MITRE_TECHNIQUE_MODIFY_SYSTEM_IMAGE,"@element" ~="T1601.002", XDM_CONST.MITRE_TECHNIQUE_MODIFY_SYSTEM_IMAGE_DOWNGRADE_SYSTEM_IMAGE,"@element" ~="T1601.001", XDM_CONST.MITRE_TECHNIQUE_MODIFY_SYSTEM_IMAGE_PATCH_SYSTEM_IMAGE,"@element" ~="T1104", XDM_CONST.MITRE_TECHNIQUE_MULTI_STAGE_CHANNELS,"@element" ~="T1106", XDM_CONST.MITRE_TECHNIQUE_NATIVE_API,"@element" ~="T1599", XDM_CONST.MITRE_TECHNIQUE_NETWORK_BOUNDARY_BRIDGING,"@element" ~="T1599.001", XDM_CONST.MITRE_TECHNIQUE_NETWORK_BOUNDARY_BRIDGING_NETWORK_ADDRESS_TRANSLATION_TRAVERSAL,"@element" ~="T1498", XDM_CONST.MITRE_TECHNIQUE_NETWORK_DENIAL_OF_SERVICE,"@element" ~="T1498.001", XDM_CONST.MITRE_TECHNIQUE_NETWORK_DENIAL_OF_SERVICE_DIRECT_NETWORK_FLOOD,"@element" ~="T1498.002", XDM_CONST.MITRE_TECHNIQUE_NETWORK_DENIAL_OF_SERVICE_REFLECTION_AMPLIFICATION,"@element" ~="T1046", XDM_CONST.MITRE_TECHNIQUE_NETWORK_SERVICE_SCANNING,"@element" ~="T1135", XDM_CONST.MITRE_TECHNIQUE_NETWORK_SHARE_DISCOVERY,"@element" ~="T1040", XDM_CONST.MITRE_TECHNIQUE_NETWORK_SNIFFING,"@element" ~="T1095", XDM_CONST.MITRE_TECHNIQUE_NON_APPLICATION_LAYER_PROTOCOL,"@element" ~="T1571", XDM_CONST.MITRE_TECHNIQUE_NON_STANDARD_PORT,"@element" ~="T1003", XDM_CONST.MITRE_TECHNIQUE_OS_CREDENTIAL_DUMPING,"@element" ~="T1003.008", XDM_CONST.MITRE_TECHNIQUE_OS_CREDENTIAL_DUMPING_PASSWD_AND_SHADOW,"@element" ~="T1003.005", XDM_CONST.MITRE_TECHNIQUE_OS_CREDENTIAL_DUMPING_CACHED_DOMAIN_CREDENTIALS,"@element" ~="T1003.006", XDM_CONST.MITRE_TECHNIQUE_OS_CREDENTIAL_DUMPING_DCSYNC,"@element" ~="T1003.004", XDM_CONST.MITRE_TECHNIQUE_OS_CREDENTIAL_DUMPING_LSA_SECRETS,"@element" ~="T1003.001", XDM_CONST.MITRE_TECHNIQUE_OS_CREDENTIAL_DUMPING_LSASS_MEMORY,"@element" ~="T1003.003", XDM_CONST.MITRE_TECHNIQUE_OS_CREDENTIAL_DUMPING_NTDS,"@element" ~="T1003.007", XDM_CONST.MITRE_TECHNIQUE_OS_CREDENTIAL_DUMPING_PROC_FILESYSTEM,"@element" ~="T1003.002", XDM_CONST.MITRE_TECHNIQUE_OS_CREDENTIAL_DUMPING_SECURITY_ACCOUNT_MANAGER,"@element" ~="T1027", XDM_CONST.MITRE_TECHNIQUE_OBFUSCATED_FILES_OR_INFORMATION,"@element" ~="T1027.001", XDM_CONST.MITRE_TECHNIQUE_OBFUSCATED_FILES_OR_INFORMATION_BINARY_PADDING,"@element" ~="T1027.004", XDM_CONST.MITRE_TECHNIQUE_OBFUSCATED_FILES_OR_INFORMATION_COMPILE_AFTER_DELIVERY,"@element" ~="T1027.006", XDM_CONST.MITRE_TECHNIQUE_OBFUSCATED_FILES_OR_INFORMATION_HTML_SMUGGLING,"@element" ~="T1027.005", XDM_CONST.MITRE_TECHNIQUE_OBFUSCATED_FILES_OR_INFORMATION_INDICATOR_REMOVAL_FROM_TOOLS,"@element" ~="T1027.002", XDM_CONST.MITRE_TECHNIQUE_OBFUSCATED_FILES_OR_INFORMATION_SOFTWARE_PACKING,"@element" ~="T1027.003", XDM_CONST.MITRE_TECHNIQUE_OBFUSCATED_FILES_OR_INFORMATION_STEGANOGRAPHY,"@element" ~="T1588", XDM_CONST.MITRE_TECHNIQUE_OBTAIN_CAPABILITIES,"@element" ~="T1588.003", XDM_CONST.MITRE_TECHNIQUE_OBTAIN_CAPABILITIES_CODE_SIGNING_CERTIFICATES,"@element" ~="T1588.004", XDM_CONST.MITRE_TECHNIQUE_OBTAIN_CAPABILITIES_DIGITAL_CERTIFICATES,"@element" ~="T1588.005", XDM_CONST.MITRE_TECHNIQUE_OBTAIN_CAPABILITIES_EXPLOITS,"@element" ~="T1588.001", XDM_CONST.MITRE_TECHNIQUE_OBTAIN_CAPABILITIES_MALWARE,"@element" ~="T1588.002", XDM_CONST.MITRE_TECHNIQUE_OBTAIN_CAPABILITIES_TOOL,"@element" ~="T1588.006", XDM_CONST.MITRE_TECHNIQUE_OBTAIN_CAPABILITIES_VULNERABILITIES,"@element" ~="T1137", XDM_CONST.MITRE_TECHNIQUE_OFFICE_APPLICATION_STARTUP,"@element" ~="T1137.006", XDM_CONST.MITRE_TECHNIQUE_OFFICE_APPLICATION_STARTUP_ADD_INS,"@element" ~="T1137.001", XDM_CONST.MITRE_TECHNIQUE_OFFICE_APPLICATION_STARTUP_OFFICE_TEMPLATE_MACROS,"@element" ~="T1137.002", XDM_CONST.MITRE_TECHNIQUE_OFFICE_APPLICATION_STARTUP_OFFICE_TEST,"@element" ~="T1137.003", XDM_CONST.MITRE_TECHNIQUE_OFFICE_APPLICATION_STARTUP_OUTLOOK_FORMS,"@element" ~="T1137.004", XDM_CONST.MITRE_TECHNIQUE_OFFICE_APPLICATION_STARTUP_OUTLOOK_HOME_PAGE,"@element" ~="T1137.005", XDM_CONST.MITRE_TECHNIQUE_OFFICE_APPLICATION_STARTUP_OUTLOOK_RULES,"@element" ~="T1201", XDM_CONST.MITRE_TECHNIQUE_PASSWORD_POLICY_DISCOVERY,"@element" ~="T1120", XDM_CONST.MITRE_TECHNIQUE_PERIPHERAL_DEVICE_DISCOVERY,"@element" ~="T1069", XDM_CONST.MITRE_TECHNIQUE_PERMISSION_GROUPS_DISCOVERY,"@element" ~="T1069.003", XDM_CONST.MITRE_TECHNIQUE_PERMISSION_GROUPS_DISCOVERY_CLOUD_GROUPS,"@element" ~="T1069.002", XDM_CONST.MITRE_TECHNIQUE_PERMISSION_GROUPS_DISCOVERY_DOMAIN_GROUPS,"@element" ~="T1069.001", XDM_CONST.MITRE_TECHNIQUE_PERMISSION_GROUPS_DISCOVERY_LOCAL_GROUPS,"@element" ~="T1566", XDM_CONST.MITRE_TECHNIQUE_PHISHING,"@element" ~="T1598", XDM_CONST.MITRE_TECHNIQUE_PHISHING_FOR_INFORMATION,"@element" ~="T1598.002", XDM_CONST.MITRE_TECHNIQUE_PHISHING_FOR_INFORMATION_SPEARPHISHING_ATTACHMENT,"@element" ~="T1598.003", XDM_CONST.MITRE_TECHNIQUE_PHISHING_FOR_INFORMATION_SPEARPHISHING_LINK,"@element" ~="T1598.001", XDM_CONST.MITRE_TECHNIQUE_PHISHING_FOR_INFORMATION_SPEARPHISHING_SERVICE,"@element" ~="T1566.001", XDM_CONST.MITRE_TECHNIQUE_PHISHING_SPEARPHISHING_ATTACHMENT,"@element" ~="T1566.002", XDM_CONST.MITRE_TECHNIQUE_PHISHING_SPEARPHISHING_LINK,"@element" ~="T1566.003", XDM_CONST.MITRE_TECHNIQUE_PHISHING_SPEARPHISHING_VIA_SERVICE,"@element" ~="T1542", XDM_CONST.MITRE_TECHNIQUE_PRE_OS_BOOT,"@element" ~="T1542.003", XDM_CONST.MITRE_TECHNIQUE_PRE_OS_BOOT_BOOTKIT,"@element" ~="T1542.002", XDM_CONST.MITRE_TECHNIQUE_PRE_OS_BOOT_COMPONENT_FIRMWARE,"@element" ~="T1542.004", XDM_CONST.MITRE_TECHNIQUE_PRE_OS_BOOT_ROMMONKIT,"@element" ~="T1542.001", XDM_CONST.MITRE_TECHNIQUE_PRE_OS_BOOT_SYSTEM_FIRMWARE,"@element" ~="T1542.005", XDM_CONST.MITRE_TECHNIQUE_PRE_OS_BOOT_TFTP_BOOT,"@element" ~="T1057", XDM_CONST.MITRE_TECHNIQUE_PROCESS_DISCOVERY,"@element" ~="T1055", XDM_CONST.MITRE_TECHNIQUE_PROCESS_INJECTION,"@element" ~="T1055.004", XDM_CONST.MITRE_TECHNIQUE_PROCESS_INJECTION_ASYNCHRONOUS_PROCEDURE_CALL,"@element" ~="T1055.001", XDM_CONST.MITRE_TECHNIQUE_PROCESS_INJECTION_DYNAMIC_LINK_LIBRARY_INJECTION,"@element" ~="T1055.011", XDM_CONST.MITRE_TECHNIQUE_PROCESS_INJECTION_EXTRA_WINDOW_MEMORY_INJECTION,"@element" ~="T1055.002", XDM_CONST.MITRE_TECHNIQUE_PROCESS_INJECTION_PORTABLE_EXECUTABLE_INJECTION,"@element" ~="T1055.009", XDM_CONST.MITRE_TECHNIQUE_PROCESS_INJECTION_PROC_MEMORY,"@element" ~="T1055.013", XDM_CONST.MITRE_TECHNIQUE_PROCESS_INJECTION_PROCESS_DOPPELGANGING,"@element" ~="T1055.012", XDM_CONST.MITRE_TECHNIQUE_PROCESS_INJECTION_PROCESS_HOLLOWING,"@element" ~="T1055.008", XDM_CONST.MITRE_TECHNIQUE_PROCESS_INJECTION_PTRACE_SYSTEM_CALLS,"@element" ~="T1055.003", XDM_CONST.MITRE_TECHNIQUE_PROCESS_INJECTION_THREAD_EXECUTION_HIJACKING,"@element" ~="T1055.005", XDM_CONST.MITRE_TECHNIQUE_PROCESS_INJECTION_THREAD_LOCAL_STORAGE,"@element" ~="T1055.014", XDM_CONST.MITRE_TECHNIQUE_PROCESS_INJECTION_VDSO_HIJACKING,"@element" ~="T1572", XDM_CONST.MITRE_TECHNIQUE_PROTOCOL_TUNNELING,"@element" ~="T1090", XDM_CONST.MITRE_TECHNIQUE_PROXY,"@element" ~="T1090.004", XDM_CONST.MITRE_TECHNIQUE_PROXY_DOMAIN_FRONTING,"@element" ~="T1090.002", XDM_CONST.MITRE_TECHNIQUE_PROXY_EXTERNAL_PROXY,"@element" ~="T1090.001", XDM_CONST.MITRE_TECHNIQUE_PROXY_INTERNAL_PROXY,"@element" ~="T1090.003", XDM_CONST.MITRE_TECHNIQUE_PROXY_MULTI_HOP_PROXY,"@element" ~="T1012", XDM_CONST.MITRE_TECHNIQUE_QUERY_REGISTRY,"@element" ~="T1620", XDM_CONST.MITRE_TECHNIQUE_REFLECTIVE_CODE_LOADING,"@element" ~="T1219", XDM_CONST.MITRE_TECHNIQUE_REMOTE_ACCESS_SOFTWARE,"@element" ~="T1563", XDM_CONST.MITRE_TECHNIQUE_REMOTE_SERVICE_SESSION_HIJACKING,"@element" ~="T1563.002", XDM_CONST.MITRE_TECHNIQUE_REMOTE_SERVICE_SESSION_HIJACKING_RDP_HIJACKING,"@element" ~="T1563.001", XDM_CONST.MITRE_TECHNIQUE_REMOTE_SERVICE_SESSION_HIJACKING_SSH_HIJACKING,"@element" ~="T1021", XDM_CONST.MITRE_TECHNIQUE_REMOTE_SERVICES,"@element" ~="T1021.003", XDM_CONST.MITRE_TECHNIQUE_REMOTE_SERVICES_DISTRIBUTED_COMPONENT_OBJECT_MODEL,"@element" ~="T1021.001", XDM_CONST.MITRE_TECHNIQUE_REMOTE_SERVICES_REMOTE_DESKTOP_PROTOCOL,"@element" ~="T1021.002", XDM_CONST.MITRE_TECHNIQUE_REMOTE_SERVICES_SMB_OR_ADMIN_SHARES,"@element" ~="T1021.004", XDM_CONST.MITRE_TECHNIQUE_REMOTE_SERVICES_SSH,"@element" ~="T1021.005", XDM_CONST.MITRE_TECHNIQUE_REMOTE_SERVICES_VNC,"@element" ~="T1021.006", XDM_CONST.MITRE_TECHNIQUE_REMOTE_SERVICES_WINDOWS_REMOTE_MANAGEMENT,"@element" ~="T1018", XDM_CONST.MITRE_TECHNIQUE_REMOTE_SYSTEM_DISCOVERY,"@element" ~="T1091", XDM_CONST.MITRE_TECHNIQUE_REPLICATION_THROUGH_REMOVABLE_MEDIA,"@element" ~="T1496", XDM_CONST.MITRE_TECHNIQUE_RESOURCE_HIJACKING,"@element" ~="T1207", XDM_CONST.MITRE_TECHNIQUE_ROGUE_DOMAIN_CONTROLLER,"@element" ~="T1014", XDM_CONST.MITRE_TECHNIQUE_ROOTKIT,"@element" ~="T1053", XDM_CONST.MITRE_TECHNIQUE_SCHEDULED_TASK,"@element" ~="T1053.001", XDM_CONST.MITRE_TECHNIQUE_SCHEDULED_TASK_LINUX_AT_JOB,"@element" ~="T1053.002", XDM_CONST.MITRE_TECHNIQUE_SCHEDULED_TASK_WINDOWS_AT_JOB,"@element" ~="T1053.007", XDM_CONST.MITRE_TECHNIQUE_SCHEDULED_TASK_OR_CONTAINER_ORCHESTRATION_JOB,"@element" ~="T1053.003", XDM_CONST.MITRE_TECHNIQUE_SCHEDULED_TASK_OR_CRON_JOB,"@element" ~="T1053.006", XDM_CONST.MITRE_TECHNIQUE_SCHEDULED_TASK_OR_SYSTEMD_TIMERS,"@element" ~="T1029", XDM_CONST.MITRE_TECHNIQUE_SCHEDULED_TRANSFER,"@element" ~="T1113", XDM_CONST.MITRE_TECHNIQUE_SCREEN_CAPTURE,"@element" ~="T1597", XDM_CONST.MITRE_TECHNIQUE_SEARCH_CLOSED_SOURCES,"@element" ~="T1597.002", XDM_CONST.MITRE_TECHNIQUE_SEARCH_CLOSED_SOURCES_PURCHASE_TECHNICAL_DATA,"@element" ~="T1597.001", XDM_CONST.MITRE_TECHNIQUE_SEARCH_CLOSED_SOURCES_THREAT_INTEL_VENDORS,"@element" ~="T1596", XDM_CONST.MITRE_TECHNIQUE_SEARCH_OPEN_TECHNICAL_DATABASES,"@element" ~="T1596.004", XDM_CONST.MITRE_TECHNIQUE_SEARCH_OPEN_TECHNICAL_DATABASES_CDNS,"@element" ~="T1596.001", XDM_CONST.MITRE_TECHNIQUE_SEARCH_OPEN_TECHNICAL_DATABASES_DNS_OR_PASSIVE_DNS,"@element" ~="T1596.003", XDM_CONST.MITRE_TECHNIQUE_SEARCH_OPEN_TECHNICAL_DATABASES_DIGITAL_CERTIFICATES,"@element" ~="T1596.005", XDM_CONST.MITRE_TECHNIQUE_SEARCH_OPEN_TECHNICAL_DATABASES_SCAN_DATABASES,"@element" ~="T1596.002", XDM_CONST.MITRE_TECHNIQUE_SEARCH_OPEN_TECHNICAL_DATABASES_WHOIS,"@element" ~="T1593", XDM_CONST.MITRE_TECHNIQUE_SEARCH_OPEN_WEBSITES_DOMAINS,"@element" ~="T1593.002", XDM_CONST.MITRE_TECHNIQUE_SEARCH_OPEN_WEBSITES_DOMAINS_SEARCH_ENGINES,"@element" ~="T1593.001", XDM_CONST.MITRE_TECHNIQUE_SEARCH_OPEN_WEBSITES_OR_DOMAINS_SOCIAL_MEDIA,"@element" ~="T1594", XDM_CONST.MITRE_TECHNIQUE_SEARCH_VICTIM_OWNED_WEBSITES,"@element" ~="T1505", XDM_CONST.MITRE_TECHNIQUE_SERVER_SOFTWARE_COMPONENT,"@element" ~="T1505.004", XDM_CONST.MITRE_TECHNIQUE_SERVER_SOFTWARE_COMPONENT_IIS_COMPONENTS,"@element" ~="T1505.001", XDM_CONST.MITRE_TECHNIQUE_SERVER_SOFTWARE_COMPONENT_SQL_STORED_PROCEDURES,"@element" ~="T1505.002", XDM_CONST.MITRE_TECHNIQUE_SERVER_SOFTWARE_COMPONENT_TRANSPORT_AGENT,"@element" ~="T1505.003", XDM_CONST.MITRE_TECHNIQUE_SERVER_SOFTWARE_COMPONENT_WEB_SHELL,"@element" ~="T1489", XDM_CONST.MITRE_TECHNIQUE_SERVICE_STOP,"@element" ~="T1129", XDM_CONST.MITRE_TECHNIQUE_SHARED_MODULES,"@element" ~="T1218", XDM_CONST.MITRE_TECHNIQUE_SIGNED_BINARY_PROXY_EXECUTION,"@element" ~="T1218.003", XDM_CONST.MITRE_TECHNIQUE_SIGNED_BINARY_PROXY_EXECUTION_CMSTP,"@element" ~="T1218.001", XDM_CONST.MITRE_TECHNIQUE_SIGNED_BINARY_PROXY_EXECUTION_COMPILED_HTML_FILE,"@element" ~="T1218.002", XDM_CONST.MITRE_TECHNIQUE_SIGNED_BINARY_PROXY_EXECUTION_CONTROL_PANEL,"@element" ~="T1218.004", XDM_CONST.MITRE_TECHNIQUE_SIGNED_BINARY_PROXY_EXECUTION_INSTALLUTIL,"@element" ~="T1218.014", XDM_CONST.MITRE_TECHNIQUE_SIGNED_BINARY_PROXY_EXECUTION_MMC,"@element" ~="T1218.013", XDM_CONST.MITRE_TECHNIQUE_SIGNED_BINARY_PROXY_EXECUTION_MAVINJECT,"@element" ~="T1218.005", XDM_CONST.MITRE_TECHNIQUE_SIGNED_BINARY_PROXY_EXECUTION_MSHTA,"@element" ~="T1218.007", XDM_CONST.MITRE_TECHNIQUE_SIGNED_BINARY_PROXY_EXECUTION_MSIEXEC,"@element" ~="T1218.008", XDM_CONST.MITRE_TECHNIQUE_SIGNED_BINARY_PROXY_EXECUTION_ODBCCONF,"@element" ~="T1218.009", XDM_CONST.MITRE_TECHNIQUE_SIGNED_BINARY_PROXY_EXECUTION_REGSVCS_OR_REGASM,"@element" ~="T1218.010", XDM_CONST.MITRE_TECHNIQUE_SIGNED_BINARY_PROXY_EXECUTION_REGSVR32,"@element" ~="T1218.011", XDM_CONST.MITRE_TECHNIQUE_SIGNED_BINARY_PROXY_EXECUTION_RUNDLL32,"@element" ~="T1218.012", XDM_CONST.MITRE_TECHNIQUE_SIGNED_BINARY_PROXY_EXECUTION_VERCLSID,"@element" ~="T1216", XDM_CONST.MITRE_TECHNIQUE_SIGNED_SCRIPT_PROXY_EXECUTION,"@element" ~="T1216.001", XDM_CONST.MITRE_TECHNIQUE_SIGNED_SCRIPT_PROXY_EXECUTION_PUBPRN,"@element" ~="T1072", XDM_CONST.MITRE_TECHNIQUE_SOFTWARE_DEPLOYMENT_TOOLS,"@element" ~="T1518", XDM_CONST.MITRE_TECHNIQUE_SOFTWARE_DISCOVERY,"@element" ~="T1518.001", XDM_CONST.MITRE_TECHNIQUE_SOFTWARE_DISCOVERY_SECURITY_SOFTWARE_DISCOVERY,"@element" ~="T1608", XDM_CONST.MITRE_TECHNIQUE_STAGE_CAPABILITIES,"@element" ~="T1608.004", XDM_CONST.MITRE_TECHNIQUE_STAGE_CAPABILITIES_DRIVE_BY_TARGET,"@element" ~="T1608.003", XDM_CONST.MITRE_TECHNIQUE_STAGE_CAPABILITIES_INSTALL_DIGITAL_CERTIFICATE,"@element" ~="T1608.005", XDM_CONST.MITRE_TECHNIQUE_STAGE_CAPABILITIES_LINK_TARGET,"@element" ~="T1608.001", XDM_CONST.MITRE_TECHNIQUE_STAGE_CAPABILITIES_UPLOAD_MALWARE,"@element" ~="T1608.002", XDM_CONST.MITRE_TECHNIQUE_STAGE_CAPABILITIES_UPLOAD_TOOL,"@element" ~="T1528", XDM_CONST.MITRE_TECHNIQUE_STEAL_APPLICATION_ACCESS_TOKEN,"@element" ~="T1539", XDM_CONST.MITRE_TECHNIQUE_STEAL_WEB_SESSION_COOKIE,"@element" ~="T1558", XDM_CONST.MITRE_TECHNIQUE_STEAL_OR_FORGE_KERBEROS_TICKETS,"@element" ~="T1558.004", XDM_CONST.MITRE_TECHNIQUE_STEAL_OR_FORGE_KERBEROS_TICKETS_AS_REP_ROASTING,"@element" ~="T1558.001", XDM_CONST.MITRE_TECHNIQUE_STEAL_OR_FORGE_KERBEROS_TICKETS_GOLDEN_TICKET,"@element" ~="T1558.003", XDM_CONST.MITRE_TECHNIQUE_STEAL_OR_FORGE_KERBEROS_TICKETS_KERBEROASTING,"@element" ~="T1558.002", XDM_CONST.MITRE_TECHNIQUE_STEAL_OR_FORGE_KERBEROS_TICKETS_SILVER_TICKET,"@element" ~="T1553", XDM_CONST.MITRE_TECHNIQUE_SUBVERT_TRUST_CONTROLS,"@element" ~="T1553.002", XDM_CONST.MITRE_TECHNIQUE_SUBVERT_TRUST_CONTROLS_CODE_SIGNING,"@element" ~="T1553.006", XDM_CONST.MITRE_TECHNIQUE_SUBVERT_TRUST_CONTROLS_CODE_SIGNING_POLICY_MODIFICATION,"@element" ~="T1553.001", XDM_CONST.MITRE_TECHNIQUE_SUBVERT_TRUST_CONTROLS_GATEKEEPER_BYPASS,"@element" ~="T1553.004", XDM_CONST.MITRE_TECHNIQUE_SUBVERT_TRUST_CONTROLS_INSTALL_ROOT_CERTIFICATE,"@element" ~="T1553.005", XDM_CONST.MITRE_TECHNIQUE_SUBVERT_TRUST_CONTROLS_MARK_OF_THE_WEB_BYPASS,"@element" ~="T1553.003", XDM_CONST.MITRE_TECHNIQUE_SUBVERT_TRUST_CONTROLS_SIP_AND_TRUST_PROVIDER_HIJACKING,"@element" ~="T1195", XDM_CONST.MITRE_TECHNIQUE_SUPPLY_CHAIN_COMPROMISE,"@element" ~="T1195.003", XDM_CONST.MITRE_TECHNIQUE_SUPPLY_CHAIN_COMPROMISE_COMPROMISE_HARDWARE_SUPPLY_CHAIN,
"@element" ~="T1195.001",XDM_CONST.MITRE_TECHNIQUE_MITRE_TECHNIQUE_SUPPLY_CHAIN_COMPROMISE_COMPROMISE_SOFTWARE_DEPENDENCIES_AND_DEVELOPMENT_TOOLS,"@element" ~="T1195.002", XDM_CONST.MITRE_TECHNIQUE_SUPPLY_CHAIN_COMPROMISE_COMPROMISE_SOFTWARE_SUPPLY_CHAIN,"@element" ~="T1082", XDM_CONST.MITRE_TECHNIQUE_SYSTEM_INFORMATION_DISCOVERY,"@element" ~="T1614", XDM_CONST.MITRE_TECHNIQUE_SYSTEM_LOCATION_DISCOVERY,"@element" ~="T1614.001", XDM_CONST.MITRE_TECHNIQUE_SYSTEM_LOCATION_DISCOVERY_SYSTEM_LANGUAGE_DISCOVERY,"@element" ~="T1016", XDM_CONST.MITRE_TECHNIQUE_SYSTEM_NETWORK_CONFIGURATION_DISCOVERY,"@element" ~="T1016.001", XDM_CONST.MITRE_TECHNIQUE_SYSTEM_NETWORK_CONFIGURATION_DISCOVERY_INTERNET_CONNECTION_DISCOVERY,"@element" ~="T1049", XDM_CONST.MITRE_TECHNIQUE_SYSTEM_NETWORK_CONNECTIONS_DISCOVERY,"@element" ~="T1033", XDM_CONST.MITRE_TECHNIQUE_SYSTEM_OWNER_USER_DISCOVERY,"@element" ~="T1007", XDM_CONST.MITRE_TECHNIQUE_SYSTEM_SERVICE_DISCOVERY,"@element" ~="T1569", XDM_CONST.MITRE_TECHNIQUE_SYSTEM_SERVICES,"@element" ~="T1569.001", XDM_CONST.MITRE_TECHNIQUE_SYSTEM_SERVICES_LAUNCHCTL,"@element" ~="T1569.002", XDM_CONST.MITRE_TECHNIQUE_SYSTEM_SERVICES_SERVICE_EXECUTION,"@element" ~="T1529", XDM_CONST.MITRE_TECHNIQUE_SYSTEM_SHUTDOWN_OR_REBOOT,"@element" ~="T1124", XDM_CONST.MITRE_TECHNIQUE_SYSTEM_TIME_DISCOVERY,"@element" ~="T1080", XDM_CONST.MITRE_TECHNIQUE_TAINT_SHARED_CONTENT,"@element" ~="T1221", XDM_CONST.MITRE_TECHNIQUE_TEMPLATE_INJECTION,"@element" ~="T1205", XDM_CONST.MITRE_TECHNIQUE_TRAFFIC_SIGNALING,"@element" ~="T1205.001", XDM_CONST.MITRE_TECHNIQUE_TRAFFIC_SIGNALING_PORT_KNOCKING,"@element" ~="T1537", XDM_CONST.MITRE_TECHNIQUE_TRANSFER_DATA_TO_CLOUD_ACCOUNT,"@element" ~="T1127", XDM_CONST.MITRE_TECHNIQUE_TRUSTED_DEVELOPER_UTILITIES_PROXY_EXECUTION,"@element" ~="T1127.001", XDM_CONST.MITRE_TECHNIQUE_TRUSTED_DEVELOPER_UTILITIES_PROXY_EXECUTION_MSBUILD,"@element" ~="T1199", XDM_CONST.MITRE_TECHNIQUE_TRUSTED_RELATIONSHIP,"@element" ~="T1111", XDM_CONST.MITRE_TECHNIQUE_TWO_FACTOR_AUTHENTICATION_INTERCEPTION,"@element" ~="T1552", XDM_CONST.MITRE_TECHNIQUE_UNSECURED_CREDENTIALS,"@element" ~="T1552.003", XDM_CONST.MITRE_TECHNIQUE_UNSECURED_CREDENTIALS_BASH_HISTORY,"@element" ~="T1552.005", XDM_CONST.MITRE_TECHNIQUE_UNSECURED_CREDENTIALS_CLOUD_INSTANCE_METADATA_API,"@element" ~="T1552.007", XDM_CONST.MITRE_TECHNIQUE_UNSECURED_CREDENTIALS_CONTAINER_API,"@element" ~="T1552.001", XDM_CONST.MITRE_TECHNIQUE_UNSECURED_CREDENTIALS_CREDENTIALS_IN_FILES,"@element" ~="T1552.002", XDM_CONST.MITRE_TECHNIQUE_UNSECURED_CREDENTIALS_CREDENTIALS_IN_REGISTRY,"@element" ~="T1552.006", XDM_CONST.MITRE_TECHNIQUE_UNSECURED_CREDENTIALS_GROUP_POLICY_PREFERENCES,"@element" ~="T1552.004", XDM_CONST.MITRE_TECHNIQUE_UNSECURED_CREDENTIALS_PRIVATE_KEYS,"@element" ~="T1535", XDM_CONST.MITRE_TECHNIQUE_UNSUPPORTED_CLOUD_REGIONS,"@element" ~="T1550", XDM_CONST.MITRE_TECHNIQUE_USE_ALTERNATE_AUTHENTICATION_MATERIAL,"@element" ~="T1550.001", XDM_CONST.MITRE_TECHNIQUE_USE_ALTERNATE_AUTHENTICATION_MATERIAL_APPLICATION_ACCESS_TOKEN,"@element" ~="T1550.002", XDM_CONST.MITRE_TECHNIQUE_USE_ALTERNATE_AUTHENTICATION_MATERIAL_PASS_THE_HASH,"@element" ~="T1550.003", XDM_CONST.MITRE_TECHNIQUE_USE_ALTERNATE_AUTHENTICATION_MATERIAL_PASS_THE_TICKET,"@element" ~="T1550.004", XDM_CONST.MITRE_TECHNIQUE_USE_ALTERNATE_AUTHENTICATION_MATERIAL_WEB_SESSION_COOKIE,"@element" ~="T1204", XDM_CONST.MITRE_TECHNIQUE_USER_EXECUTION,"@element" ~="T1204.002", XDM_CONST.MITRE_TECHNIQUE_USER_EXECUTION_MALICIOUS_FILE,"@element" ~="T1204.003", XDM_CONST.MITRE_TECHNIQUE_USER_EXECUTION_MALICIOUS_IMAGE,"@element" ~="T1204.001", XDM_CONST.MITRE_TECHNIQUE_USER_EXECUTION_MALICIOUS_LINK,"@element" ~="T1078", XDM_CONST.MITRE_TECHNIQUE_VALID_ACCOUNTS,"@element" ~="T1078.004", XDM_CONST.MITRE_TECHNIQUE_VALID_ACCOUNTS_CLOUD_ACCOUNTS,"@element" ~="T1078.001", XDM_CONST.MITRE_TECHNIQUE_VALID_ACCOUNTS_DEFAULT_ACCOUNTS,"@element" ~="T1078.002", XDM_CONST.MITRE_TECHNIQUE_VALID_ACCOUNTS_DOMAIN_ACCOUNTS,"@element" ~="T1078.003", XDM_CONST.MITRE_TECHNIQUE_VALID_ACCOUNTS_LOCAL_ACCOUNTS,"@element" ~="T1125", XDM_CONST.MITRE_TECHNIQUE_VIDEO_CAPTURE,"@element" ~="T1497", XDM_CONST.MITRE_TECHNIQUE_SANDBOX_EVASION,"@element" ~="T1497.001", XDM_CONST.MITRE_TECHNIQUE_SANDBOX_EVASION_SYSTEM_CHECKS,"@element" ~="T1497.003", XDM_CONST.MITRE_TECHNIQUE_SANDBOX_EVASION_TIME_BASED_EVASION,"@element" ~="T1497.002", XDM_CONST.MITRE_TECHNIQUE_SANDBOX_EVASION_USER_ACTIVITY_BASED_CHECKS,"@element" ~="T1600", XDM_CONST.MITRE_TECHNIQUE_WEAKEN_ENCRYPTION,"@element" ~="T1600.002", XDM_CONST.MITRE_TECHNIQUE_WEAKEN_ENCRYPTION_DISABLE_CRYPTO_HARDWARE,"@element" ~="T1600.001", XDM_CONST.MITRE_TECHNIQUE_WEAKEN_ENCRYPTION_REDUCE_KEY_SPACE,"@element" ~="T1102", XDM_CONST.MITRE_TECHNIQUE_WEB_SERVICE,"@element" ~="T1102.002", XDM_CONST.MITRE_TECHNIQUE_WEB_SERVICE_BIDIRECTIONAL_COMMUNICATION,"@element" ~="T1102.001", XDM_CONST.MITRE_TECHNIQUE_WEB_SERVICE_DEAD_DROP_RESOLVER,"@element" ~="T1102.003", XDM_CONST.MITRE_TECHNIQUE_WEB_SERVICE_ONE_WAY_COMMUNICATION,"@element" ~="T1047", XDM_CONST.MITRE_TECHNIQUE_WINDOWS_MANAGEMENT_INSTRUMENTATION,"@element" ~="T1220", XDM_CONST.MITRE_TECHNIQUE_XSL_SCRIPT_PROCESSING));