APT3_+_APT29_with_software.json

{
    "name": "APT3 + APT29 with software",
    "version": "3.0",
    "description": "This layer shows techniques (including techniques from software used by the groups) used by APT3 only in blue, APT29 only in yellow, and both APT3 and APT29 in green.",
    "domain": "mitre-enterprise",
    "techniques": [
        {
            "techniqueID": "T1569.002",
            "color": "#74c476",
            "comment": "used by APT3, APT29, Cobalt Strike, RemoteCMD, PsExec"
        },
        {
            "techniqueID": "T1053.005",
            "color": "#74c476",
            "comment": "used by APT3, APT29, schtasks, CozyCar, RemoteCMD, CosmicDuke"
        },
        {
            "techniqueID": "T1105",
            "color": "#74c476",
            "comment": "used by APT3, APT29, POSHSPY, CloudDuke, PowerDuke, MiniDuke, SeaDuke, PlugX, RemoteCMD"
        },
        {
            "techniqueID": "T1074.001",
            "color": "#6baed6",
            "comment": "used by APT3"
        },
        {
            "techniqueID": "T1087.001",
            "color": "#74c476",
            "comment": "used by APT3, APT29, SHOTPUT, GeminiDuke, OSInfo"
        },
        {
            "techniqueID": "T1056.001",
            "color": "#74c476",
            "comment": "used by APT3, APT29, Cobalt Strike, PlugX, CosmicDuke"
        },
        {
            "techniqueID": "T1016",
            "color": "#74c476",
            "comment": "used by APT3, APT29, GeminiDuke, OSInfo, PowerDuke"
        },
        {
            "techniqueID": "T1546.008",
            "color": "#74c476",
            "comment": "used by APT3, APT29"
        },
        {
            "techniqueID": "T1021.001",
            "color": "#74c476",
            "comment": "used by APT3, APT29, Cobalt Strike"
        },
        {
            "techniqueID": "T1005",
            "color": "#74c476",
            "comment": "used by APT3, APT29, PinchDuke, Cobalt Strike, CosmicDuke"
        },
        {
            "techniqueID": "T1083",
            "color": "#74c476",
            "comment": "used by APT3, APT29, CosmicDuke, PinchDuke, PowerDuke, GeminiDuke, SHOTPUT, PlugX"
        },
        {
            "techniqueID": "T1090.002",
            "color": "#6baed6",
            "comment": "used by APT3"
        },
        {
            "techniqueID": "T1018",
            "color": "#74c476",
            "comment": "used by APT3, APT29, SHOTPUT, Cobalt Strike, OSInfo"
        },
        {
            "techniqueID": "T1059.003",
            "color": "#74c476",
            "comment": "used by APT3, APT29, Cobalt Strike, PowerDuke, SeaDuke, CozyCar, PlugX"
        },
        {
            "techniqueID": "T1078.002",
            "color": "#74c476",
            "comment": "used by APT3, APT29, Cobalt Strike"
        },
        {
            "techniqueID": "T1069",
            "color": "#6baed6",
            "comment": "used by APT3"
        },
        {
            "techniqueID": "T1057",
            "color": "#74c476",
            "comment": "used by APT3, APT29, Cobalt Strike, PowerDuke, GeminiDuke, SHOTPUT, PlugX"
        },
        {
            "techniqueID": "T1003.001",
            "color": "#74c476",
            "comment": "used by APT3, APT29, CozyCar, LaZagne, Mimikatz"
        },
        {
            "techniqueID": "T1059.001",
            "color": "#74c476",
            "comment": "used by APT3, APT29, Cobalt Strike, SeaDuke, POSHSPY, HAMMERTOSS"
        },
        {
            "techniqueID": "T1543.003",
            "color": "#74c476",
            "comment": "used by APT3, APT29, CozyCar, Cobalt Strike, PlugX, CosmicDuke"
        },
        {
            "techniqueID": "T1104",
            "color": "#6baed6",
            "comment": "used by APT3"
        },
        {
            "techniqueID": "T1049",
            "color": "#6baed6",
            "comment": "used by APT3, SHOTPUT, PlugX, OSInfo"
        },
        {
            "techniqueID": "T1041",
            "color": "#6baed6",
            "comment": "used by APT3"
        },
        {
            "techniqueID": "T1218.011",
            "color": "#74c476",
            "comment": "used by APT3, APT29, CozyCar, PowerDuke"
        },
        {
            "techniqueID": "T1106",
            "color": "#74c476",
            "comment": "used by APT3, APT29, Cobalt Strike, PlugX"
        },
        {
            "techniqueID": "T1140",
            "color": "#6baed6",
            "comment": "used by APT3, PlugX"
        },
        {
            "techniqueID": "T1574.002",
            "color": "#6baed6",
            "comment": "used by APT3, PlugX"
        },
        {
            "techniqueID": "T1071.001",
            "color": "#74c476",
            "comment": "used by APT3, APT29, Cobalt Strike, CloudDuke, CosmicDuke, PinchDuke, OnionDuke, GeminiDuke, MiniDuke, SeaDuke, CozyCar, PlugX, HAMMERTOSS"
        },
        {
            "techniqueID": "T1113",
            "color": "#74c476",
            "comment": "used by APT3, APT29, Cobalt Strike, PlugX, CosmicDuke"
        },
        {
            "techniqueID": "T1112",
            "color": "#6baed6",
            "comment": "used by APT3, PlugX"
        },
        {
            "techniqueID": "T1012",
            "color": "#6baed6",
            "comment": "used by APT3, PlugX, OSInfo"
        },
        {
            "techniqueID": "T1102.001",
            "color": "#74c476",
            "comment": "used by APT3, APT29, MiniDuke, PlugX"
        },
        {
            "techniqueID": "T1036.004",
            "color": "#6baed6",
            "comment": "used by APT3, PlugX"
        },
        {
            "techniqueID": "T1095",
            "color": "#74c476",
            "comment": "used by APT3, APT29, PlugX"
        },
        {
            "techniqueID": "T1547.001",
            "color": "#74c476",
            "comment": "used by APT3, APT29, CozyCar, PlugX, SeaDuke, PowerDuke"
        },
        {
            "techniqueID": "T1135",
            "color": "#74c476",
            "comment": "used by APT3, APT29, Cobalt Strike, PlugX, OSInfo"
        },
        {
            "techniqueID": "T1497.001",
            "color": "#6baed6",
            "comment": "used by APT3, PlugX"
        },
        {
            "techniqueID": "T1071.004",
            "color": "#74c476",
            "comment": "used by APT3, APT29, Cobalt Strike, PlugX"
        },
        {
            "techniqueID": "T1127.001",
            "color": "#6baed6",
            "comment": "used by APT3, PlugX"
        },
        {
            "techniqueID": "T1027.002",
            "color": "#74c476",
            "comment": "used by APT3, APT29, SeaDuke"
        },
        {
            "techniqueID": "T1027",
            "color": "#74c476",
            "comment": "used by APT3, APT29, SHOTPUT, CozyCar, POSHSPY"
        },
        {
            "techniqueID": "T1033",
            "color": "#74c476",
            "comment": "used by APT3, APT29, PowerDuke"
        },
        {
            "techniqueID": "T1136.001",
            "color": "#6baed6",
            "comment": "used by APT3"
        },
        {
            "techniqueID": "T1560.001",
            "color": "#6baed6",
            "comment": "used by APT3"
        },
        {
            "techniqueID": "T1027.005",
            "color": "#74c476",
            "comment": "used by APT3, APT29, Cobalt Strike"
        },
        {
            "techniqueID": "T1087.002",
            "color": "#6baed6",
            "comment": "used by APT3, OSInfo"
        },
        {
            "techniqueID": "T1069.001",
            "color": "#6baed6",
            "comment": "used by APT3, OSInfo"
        },
        {
            "techniqueID": "T1082",
            "color": "#74c476",
            "comment": "used by APT3, APT29, CozyCar, PinchDuke, OSInfo, PowerDuke"
        },
        {
            "techniqueID": "T1069.002",
            "color": "#6baed6",
            "comment": "used by APT3, OSInfo"
        },
        {
            "techniqueID": "T1098",
            "color": "#74c476",
            "comment": "used by APT3, APT29, Mimikatz"
        },
        {
            "techniqueID": "T1021.002",
            "color": "#74c476",
            "comment": "used by APT3, APT29, Cobalt Strike, PsExec"
        },
        {
            "techniqueID": "T1110.002",
            "color": "#6baed6",
            "comment": "used by APT3"
        },
        {
            "techniqueID": "T1070.004",
            "color": "#74c476",
            "comment": "used by APT3, APT29, SeaDuke, SDelete, PowerDuke"
        },
        {
            "techniqueID": "T1555",
            "color": "#74c476",
            "comment": "used by APT3, APT29, PinchDuke, LaZagne, Mimikatz, CosmicDuke"
        },
        {
            "techniqueID": "T1555.003",
            "color": "#74c476",
            "comment": "used by APT3, APT29, PinchDuke, LaZagne, Mimikatz, CosmicDuke"
        },
        {
            "techniqueID": "T1552.001",
            "color": "#6baed6",
            "comment": "used by APT3, LaZagne"
        },
        {
            "techniqueID": "T1003.004",
            "color": "#74c476",
            "comment": "used by APT3, APT29, LaZagne, Mimikatz, CosmicDuke"
        },
        {
            "techniqueID": "T1003.005",
            "color": "#6baed6",
            "comment": "used by APT3, LaZagne"
        },
        {
            "techniqueID": "T1555.001",
            "color": "#6baed6",
            "comment": "used by APT3, LaZagne"
        },
        {
            "techniqueID": "T1003.007",
            "color": "#6baed6",
            "comment": "used by APT3, LaZagne"
        },
        {
            "techniqueID": "T1003.008",
            "color": "#6baed6",
            "comment": "used by APT3, LaZagne"
        },
        {
            "techniqueID": "T1564.003",
            "color": "#74c476",
            "comment": "used by APT3, APT29, HAMMERTOSS"
        },
        {
            "techniqueID": "T1203",
            "color": "#fce93b",
            "comment": "used by APT29"
        },
        {
            "techniqueID": "T1548.002",
            "color": "#fce93b",
            "comment": "used by APT29, Cobalt Strike"
        },
        {
            "techniqueID": "T1204.002",
            "color": "#fce93b",
            "comment": "used by APT29"
        },
        {
            "techniqueID": "T1546.003",
            "color": "#fce93b",
            "comment": "used by APT29, SeaDuke, POSHSPY"
        },
        {
            "techniqueID": "T1090.004",
            "color": "#fce93b",
            "comment": "used by APT29, meek"
        },
        {
            "techniqueID": "T1003",
            "color": "#fce93b",
            "comment": "used by APT29, PinchDuke, OnionDuke"
        },
        {
            "techniqueID": "T1090.003",
            "color": "#fce93b",
            "comment": "used by APT29, Tor"
        },
        {
            "techniqueID": "T1566.001",
            "color": "#fce93b",
            "comment": "used by APT29"
        },
        {
            "techniqueID": "T1573.002",
            "color": "#fce93b",
            "comment": "used by APT29, Tor, POSHSPY"
        },
        {
            "techniqueID": "T1102.002",
            "color": "#fce93b",
            "comment": "used by APT29, CozyCar, CloudDuke"
        },
        {
            "techniqueID": "T1518.001",
            "color": "#fce93b",
            "comment": "used by APT29, CozyCar"
        },
        {
            "techniqueID": "T1036.003",
            "color": "#fce93b",
            "comment": "used by APT29, CozyCar"
        },
        {
            "techniqueID": "T1003.002",
            "color": "#fce93b",
            "comment": "used by APT29, CozyCar, Cobalt Strike, Mimikatz, CosmicDuke"
        },
        {
            "techniqueID": "T1497",
            "color": "#fce93b",
            "comment": "used by APT29, CozyCar"
        },
        {
            "techniqueID": "T1047",
            "color": "#fce93b",
            "comment": "used by APT29, Cobalt Strike"
        },
        {
            "techniqueID": "T1550.003",
            "color": "#fce93b",
            "comment": "used by APT29, SeaDuke, Mimikatz"
        },
        {
            "techniqueID": "T1564.004",
            "color": "#fce93b",
            "comment": "used by APT29, PowerDuke"
        },
        {
            "techniqueID": "T1010",
            "color": "#fce93b",
            "comment": "used by APT29, PowerDuke"
        },
        {
            "techniqueID": "T1124",
            "color": "#fce93b",
            "comment": "used by APT29, PowerDuke"
        },
        {
            "techniqueID": "T1485",
            "color": "#fce93b",
            "comment": "used by APT29, SDelete, PowerDuke"
        },
        {
            "techniqueID": "T1027.003",
            "color": "#fce93b",
            "comment": "used by APT29, PowerDuke"
        },
        {
            "techniqueID": "T1553.002",
            "color": "#fce93b",
            "comment": "used by APT29, SDelete"
        },
        {
            "techniqueID": "T1007",
            "color": "#fce93b",
            "comment": "used by APT29, GeminiDuke"
        },
        {
            "techniqueID": "T1566.002",
            "color": "#fce93b",
            "comment": "used by APT29"
        },
        {
            "techniqueID": "T1020",
            "color": "#fce93b",
            "comment": "used by APT29, CosmicDuke"
        },
        {
            "techniqueID": "T1025",
            "color": "#fce93b",
            "comment": "used by APT29, CosmicDuke"
        },
        {
            "techniqueID": "T1114.001",
            "color": "#fce93b",
            "comment": "used by APT29, CosmicDuke"
        },
        {
            "techniqueID": "T1068",
            "color": "#fce93b",
            "comment": "used by APT29, Cobalt Strike, CosmicDuke"
        },
        {
            "techniqueID": "T1573.001",
            "color": "#fce93b",
            "comment": "used by APT29, SeaDuke, HAMMERTOSS, CosmicDuke"
        },
        {
            "techniqueID": "T1039",
            "color": "#fce93b",
            "comment": "used by APT29, CosmicDuke"
        },
        {
            "techniqueID": "T1048.003",
            "color": "#fce93b",
            "comment": "used by APT29, CosmicDuke"
        },
        {
            "techniqueID": "T1115",
            "color": "#fce93b",
            "comment": "used by APT29, CosmicDuke"
        },
        {
            "techniqueID": "T1008",
            "color": "#fce93b",
            "comment": "used by APT29, MiniDuke"
        },
        {
            "techniqueID": "T1102.003",
            "color": "#fce93b",
            "comment": "used by APT29, HAMMERTOSS, OnionDuke"
        },
        {
            "techniqueID": "T1001.002",
            "color": "#fce93b",
            "comment": "used by APT29, HAMMERTOSS"
        },
        {
            "techniqueID": "T1567.002",
            "color": "#fce93b",
            "comment": "used by APT29, HAMMERTOSS"
        },
        {
            "techniqueID": "T1547.005",
            "color": "#fce93b",
            "comment": "used by APT29, Mimikatz"
        },
        {
            "techniqueID": "T1134.005",
            "color": "#fce93b",
            "comment": "used by APT29, Mimikatz"
        },
        {
            "techniqueID": "T1550.002",
            "color": "#fce93b",
            "comment": "used by APT29, Cobalt Strike, Mimikatz"
        },
        {
            "techniqueID": "T1207",
            "color": "#fce93b",
            "comment": "used by APT29, Mimikatz"
        },
        {
            "techniqueID": "T1552.004",
            "color": "#fce93b",
            "comment": "used by APT29, Mimikatz"
        },
        {
            "techniqueID": "T1558.002",
            "color": "#fce93b",
            "comment": "used by APT29, Mimikatz"
        },
        {
            "techniqueID": "T1558.001",
            "color": "#fce93b",
            "comment": "used by APT29, Mimikatz"
        },
        {
            "techniqueID": "T1003.006",
            "color": "#fce93b",
            "comment": "used by APT29, Mimikatz"
        },
        {
            "techniqueID": "T1030",
            "color": "#fce93b",
            "comment": "used by APT29, POSHSPY"
        },
        {
            "techniqueID": "T1070.006",
            "color": "#fce93b",
            "comment": "used by APT29, Cobalt Strike, POSHSPY"
        },
        {
            "techniqueID": "T1568.002",
            "color": "#fce93b",
            "comment": "used by APT29, POSHSPY"
        },
        {
            "techniqueID": "T1570",
            "color": "#fce93b",
            "comment": "used by APT29, PsExec"
        },
        {
            "techniqueID": "T1029",
            "color": "#fce93b",
            "comment": "used by APT29, Cobalt Strike"
        },
        {
            "techniqueID": "T1046",
            "color": "#fce93b",
            "comment": "used by APT29, Cobalt Strike"
        },
        {
            "techniqueID": "T1078.003",
            "color": "#fce93b",
            "comment": "used by APT29, Cobalt Strike"
        },
        {
            "techniqueID": "T1021.006",
            "color": "#fce93b",
            "comment": "used by APT29, Cobalt Strike"
        },
        {
            "techniqueID": "T1021.004",
            "color": "#fce93b",
            "comment": "used by APT29, Cobalt Strike"
        },
        {
            "techniqueID": "T1090.001",
            "color": "#fce93b",
            "comment": "used by APT29, Cobalt Strike"
        },
        {
            "techniqueID": "T1572",
            "color": "#fce93b",
            "comment": "used by APT29, Cobalt Strike"
        },
        {
            "techniqueID": "T1055",
            "color": "#fce93b",
            "comment": "used by APT29, Cobalt Strike"
        },
        {
            "techniqueID": "T1134.001",
            "color": "#fce93b",
            "comment": "used by APT29, Cobalt Strike"
        },
        {
            "techniqueID": "T1185",
            "color": "#fce93b",
            "comment": "used by APT29, Cobalt Strike"
        },
        {
            "techniqueID": "T1197",
            "color": "#fce93b",
            "comment": "used by APT29, Cobalt Strike"
        },
        {
            "techniqueID": "T1055.012",
            "color": "#fce93b",
            "comment": "used by APT29, Cobalt Strike"
        },
        {
            "techniqueID": "T1021.003",
            "color": "#fce93b",
            "comment": "used by APT29, Cobalt Strike"
        },
        {
            "techniqueID": "T1134.004",
            "color": "#fce93b",
            "comment": "used by APT29, Cobalt Strike"
        },
        {
            "techniqueID": "T1134.003",
            "color": "#fce93b",
            "comment": "used by APT29, Cobalt Strike"
        },
        {
            "techniqueID": "T1071",
            "color": "#fce93b",
            "comment": "used by APT29, Cobalt Strike"
        },
        {
            "techniqueID": "T1059.005",
            "color": "#fce93b",
            "comment": "used by APT29, Cobalt Strike"
        },
        {
            "techniqueID": "T1059.006",
            "color": "#fce93b",
            "comment": "used by APT29, Cobalt Strike"
        },
        {
            "techniqueID": "T1560.002",
            "color": "#fce93b",
            "comment": "used by APT29, SeaDuke"
        },
        {
            "techniqueID": "T1547.009",
            "color": "#fce93b",
            "comment": "used by APT29, SeaDuke"
        },
        {
            "techniqueID": "T1078",
            "color": "#fce93b",
            "comment": "used by APT29, SeaDuke"
        },
        {
            "techniqueID": "T1132.001",
            "color": "#fce93b",
            "comment": "used by APT29, SeaDuke"
        },
        {
            "techniqueID": "T1114.002",
            "color": "#fce93b",
            "comment": "used by APT29, SeaDuke"
        }
    ],
    "legendItems": [
        {
            "label": "Used by APT3 or a software APT3 uses",
            "color": "#6baed6"
        },
        {
            "label": "Used by APT29 or a software APT29 uses",
            "color": "#fce93b"
        },
        {
            "label": "Used by both APT3 or a softare APT3 uses and APT29 or a software APT29 uses",
            "color": "#74c476"
        }
    ]
}