Threat intelligence: adversaries, techniques and malware

Part ofResearch a threat or a vulnerability

This page shows you how to look up threat groups, the MITRE ATT&CK techniques they use, and the malware and tools linked to them. It also explains how to read the graphs on the Adversaries, Techniques and Malware pages.

Who can do this

Everyone with access to SPECTER can browse these pages and open every record. Nothing on these pages changes the catalogue.

How the pages fit together

An adversary is a threat group, such as an APT group. Its record says who the group is, what it targets and which techniques it uses.

A technique is a way of attacking, as described in MITRE ATT&CK, for example "T1566 · Phishing". Some techniques have subtechniques, for example "T1566.001 · Spearphishing Attachment".

Malware covers malware families and threat tools. Their records link to the groups that use them and to the techniques they carry out.

Records link to each other, so you can start anywhere and follow the connections. For how lists, records, the graph and its filters work in general, see Getting around and Graph views.

Watch: exploring an adversary and its techniques (under 1 min)

Adversaries

Adversaries is the page SPECTER opens on. It shows one APT group and the techniques it uses as a graph. SPECTER selects the first group on the page for you.

In the graph:

a hexagon is an adversary;

a circle is a technique;

a square is a subtechnique;

a line labelled Uses connects a group to a technique it uses.

In List view, the table shows Name, Kind, Country, Motive, Technique Count and Confidence Tier for each group.

Show other groups in the graph

On Adversaries, open Filters above the graph.

Under APT selection, choose Select APTs. A list of the groups on the current page opens, each with its number of techniques.

Tick the groups you want to compare. The button now shows how many groups are selected, for example "3 APTs selected".

To take a group out of the graph, choose the × on its chip.

The graph shows the selected groups and all their techniques. Techniques that several groups share are connected to each of them, so you can see where the groups overlap. To see groups from another page, use Next first.

Open an adversary

On Adversaries, switch to List view (or click a group in the graph).

Optionally, type part of the name in Search this page… to find the group on the current page.

Choose the group's name.

The record of the Chimera group with its profile, targeting and techniques

The record of an APT group shows the group's country and motive under its name, and four summary figures: Techniques, Confidence, Skill and Status. Then:

Section	What it shows
Profile	A description of the group, the other names it is known by (Also known as), and its Group type
Targeting	The Sectors and Countries the group is known to target
Techniques	One button per technique the group uses, for example "T1566.001 · Spearphishing Attachment". Select a technique to inspect its tactics, platforms and description.
Intelligence source	Where the profile comes from (Source, for example "MITRE ATT&CK G0016 · MISP Galaxy …"), the group's ATT&CK ID, and a link to its page on the MITRE ATT&CK website

If a group has no techniques in the catalogue, the record says "No techniques published for this group."

Techniques

Techniques lists the MITRE ATT&CK techniques and subtechniques. In the graph, each technique is drawn as "T1059 · Command and Scripting Interpreter", and a Subtechnique line connects a technique to each of its subtechniques. In List view, the table shows Technique Id, Name, Actor Count (the number of groups that use it) and Status.

Open a technique

Choose a technique's ID in List view, click its node in the graph, or choose a technique button in an adversary's or malware record.

The technique opens. If you came from another record, a back button (Back to followed by that record's name) returns you there.

The PowerShell technique opened from the Chimera record, with its tactic cards

The record shows whether it is an ATT&CK technique or an ATT&CK subtechnique. Under the title it says MITRE ATT&CK, or for a subtechnique, which technique it is part of. The summary figures are APT groups (how many groups use it) and Status. Then:

Technique: the description.

Coverage: the ATT&CK Tactics the technique belongs to, as cards, and the Platforms it applies to. Each tactic card names its matrix (Enterprise ATT&CK, Mobile ATT&CK or ICS ATT&CK) and opens the tactic on the MITRE ATT&CK website in a new tab. For a subtechnique, Open parent followed by the parent's ID opens the parent technique.

Reference: a link to the technique on the MITRE ATT&CK website.

Malware

Malware covers both malware families and threat tools. In List view, the table shows Name, Kind, Actor Count, Technique Count and Status. The status line shows how many families and tools the catalogue holds and how many are shown, for example "_N_ families & tools · 50 shown · Page 1".

Unlike the other threat pages, the search box here (Search names, aliases or IDs…) searches the whole malware catalogue, not only the current page. You can search by name, by alias, or by ATT&CK or Malpedia ID.

Explore malware in the graph

The graph shows the selected families and tools, the APT groups that use them, and their ATT&CK techniques. SPECTER selects a well-known family for you to start with.

On Malware, open Filters above the graph.

Under Malware selection, choose Select malware.

In Find a malware family…, type a name or alias. Up to 40 matches are listed, each with its ATT&CK or Malpedia ID.

Tick the families you want to see. Remove one with the × on its chip.

When you type in the page's search box instead, the graph shows up to three matching families.

The lines between a family and a group show how sure the catalogue is of the link:

"Uses · Tier A" or "Uses · Tier B": the group is known to use the family.

"Possible usage · Tier C": the link is possible but less certain.

Click a line to see its details: Name, Relation, Confidence and Source.

Open a malware family or tool

On Malware, switch to List view and type the name in Search names, aliases or IDs…, or click the node in the graph.

Choose the name.

The record of the Mimikatz tool with its associated APT groups and techniques

The record shows whether it is a Malware family or a Threat tool, with its ATT&CK ID and Malpedia ID under the name. The summary figures are APT groups, Techniques and Status. Then:

Section	What it shows
Family profile	A description, and the other names it is known by (Also known as)
Associated APT groups	One button per group that uses it, with the confidence tier and the source of the link. These groups use this family. The relationship does not attribute every sample or indicator to a group.
ATT&CK techniques	One button per technique it carries out
Sources & references	The sources the record is built from, and links to the MITRE ATT&CK and Malpedia family pages where they exist
Possible identity matches	Collapsed. Other records that may describe the same family. These are candidates; the catalogue has not merged their identities.

Troubleshooting

Message	What it means	What to do
"This APT group is unavailable in the published catalogue."	You followed a link to a group the catalogue no longer contains.	Go back and choose another group.
"Details for … are unavailable in the current catalogue."	You followed a link to a technique or record the catalogue no longer contains.	Go back with the back button.
"No matching families."	No malware family or tool matches what you typed in Find a malware family….	Check the spelling, or try an alias or ID.
"No visible nodes"	Your filters hide every node in the graph.	Choose Restore graph categories, or change your search or selection.
"No matching resources"	Nothing on the current page matches your search.	Clear the search, or use Next to look on the next page.