GoogleCloudSecuritycenterV2MitreAttack
import type { GoogleCloudSecuritycenterV2MitreAttack } from "https://googleapis.deno.dev/v1/securitycenter:v1.ts";MITRE ATT&CK tactics and techniques related to this finding. See: https://attack.mitre.org
interface GoogleCloudSecuritycenterV2MitreAttack {
additionalTactics?:
| "TACTIC_UNSPECIFIED"
| "RECONNAISSANCE"
| "RESOURCE_DEVELOPMENT"
| "INITIAL_ACCESS"
| "EXECUTION"
| "PERSISTENCE"
| "PRIVILEGE_ESCALATION"
| "DEFENSE_EVASION"
| "CREDENTIAL_ACCESS"
| "DISCOVERY"
| "LATERAL_MOVEMENT"
| "COLLECTION"
| "COMMAND_AND_CONTROL"
| "EXFILTRATION"
| "IMPACT"[];
additionalTechniques?:
| "TECHNIQUE_UNSPECIFIED"
| "MASQUERADING"
| "MATCH_LEGITIMATE_NAME_OR_LOCATION"
| "BOOT_OR_LOGON_INITIALIZATION_SCRIPTS"
| "STARTUP_ITEMS"
| "NETWORK_SERVICE_DISCOVERY"
| "PROCESS_DISCOVERY"
| "COMMAND_AND_SCRIPTING_INTERPRETER"
| "UNIX_SHELL"
| "PYTHON"
| "PERMISSION_GROUPS_DISCOVERY"
| "CLOUD_GROUPS"
| "APPLICATION_LAYER_PROTOCOL"
| "DNS"
| "SOFTWARE_DEPLOYMENT_TOOLS"
| "VALID_ACCOUNTS"
| "DEFAULT_ACCOUNTS"
| "LOCAL_ACCOUNTS"
| "CLOUD_ACCOUNTS"
| "PROXY"
| "EXTERNAL_PROXY"
| "MULTI_HOP_PROXY"
| "ACCOUNT_MANIPULATION"
| "ADDITIONAL_CLOUD_CREDENTIALS"
| "SSH_AUTHORIZED_KEYS"
| "ADDITIONAL_CONTAINER_CLUSTER_ROLES"
| "INGRESS_TOOL_TRANSFER"
| "NATIVE_API"
| "BRUTE_FORCE"
| "SHARED_MODULES"
| "ACCESS_TOKEN_MANIPULATION"
| "TOKEN_IMPERSONATION_OR_THEFT"
| "EXPLOIT_PUBLIC_FACING_APPLICATION"
| "DOMAIN_POLICY_MODIFICATION"
| "DATA_DESTRUCTION"
| "SERVICE_STOP"
| "INHIBIT_SYSTEM_RECOVERY"
| "RESOURCE_HIJACKING"
| "NETWORK_DENIAL_OF_SERVICE"
| "CLOUD_SERVICE_DISCOVERY"
| "STEAL_APPLICATION_ACCESS_TOKEN"
| "ACCOUNT_ACCESS_REMOVAL"
| "STEAL_WEB_SESSION_COOKIE"
| "CREATE_OR_MODIFY_SYSTEM_PROCESS"
| "ABUSE_ELEVATION_CONTROL_MECHANISM"
| "UNSECURED_CREDENTIALS"
| "MODIFY_AUTHENTICATION_PROCESS"
| "IMPAIR_DEFENSES"
| "DISABLE_OR_MODIFY_TOOLS"
| "EXFILTRATION_OVER_WEB_SERVICE"
| "EXFILTRATION_TO_CLOUD_STORAGE"
| "DYNAMIC_RESOLUTION"
| "LATERAL_TOOL_TRANSFER"
| "MODIFY_CLOUD_COMPUTE_INFRASTRUCTURE"
| "CREATE_SNAPSHOT"
| "CLOUD_INFRASTRUCTURE_DISCOVERY"
| "OBTAIN_CAPABILITIES"
| "ACTIVE_SCANNING"
| "SCANNING_IP_BLOCKS"
| "CONTAINER_AND_RESOURCE_DISCOVERY"[];
primaryTactic?:
| "TACTIC_UNSPECIFIED"
| "RECONNAISSANCE"
| "RESOURCE_DEVELOPMENT"
| "INITIAL_ACCESS"
| "EXECUTION"
| "PERSISTENCE"
| "PRIVILEGE_ESCALATION"
| "DEFENSE_EVASION"
| "CREDENTIAL_ACCESS"
| "DISCOVERY"
| "LATERAL_MOVEMENT"
| "COLLECTION"
| "COMMAND_AND_CONTROL"
| "EXFILTRATION"
| "IMPACT";
primaryTechniques?:
| "TECHNIQUE_UNSPECIFIED"
| "MASQUERADING"
| "MATCH_LEGITIMATE_NAME_OR_LOCATION"
| "BOOT_OR_LOGON_INITIALIZATION_SCRIPTS"
| "STARTUP_ITEMS"
| "NETWORK_SERVICE_DISCOVERY"
| "PROCESS_DISCOVERY"
| "COMMAND_AND_SCRIPTING_INTERPRETER"
| "UNIX_SHELL"
| "PYTHON"
| "PERMISSION_GROUPS_DISCOVERY"
| "CLOUD_GROUPS"
| "APPLICATION_LAYER_PROTOCOL"
| "DNS"
| "SOFTWARE_DEPLOYMENT_TOOLS"
| "VALID_ACCOUNTS"
| "DEFAULT_ACCOUNTS"
| "LOCAL_ACCOUNTS"
| "CLOUD_ACCOUNTS"
| "PROXY"
| "EXTERNAL_PROXY"
| "MULTI_HOP_PROXY"
| "ACCOUNT_MANIPULATION"
| "ADDITIONAL_CLOUD_CREDENTIALS"
| "SSH_AUTHORIZED_KEYS"
| "ADDITIONAL_CONTAINER_CLUSTER_ROLES"
| "INGRESS_TOOL_TRANSFER"
| "NATIVE_API"
| "BRUTE_FORCE"
| "SHARED_MODULES"
| "ACCESS_TOKEN_MANIPULATION"
| "TOKEN_IMPERSONATION_OR_THEFT"
| "EXPLOIT_PUBLIC_FACING_APPLICATION"
| "DOMAIN_POLICY_MODIFICATION"
| "DATA_DESTRUCTION"
| "SERVICE_STOP"
| "INHIBIT_SYSTEM_RECOVERY"
| "RESOURCE_HIJACKING"
| "NETWORK_DENIAL_OF_SERVICE"
| "CLOUD_SERVICE_DISCOVERY"
| "STEAL_APPLICATION_ACCESS_TOKEN"
| "ACCOUNT_ACCESS_REMOVAL"
| "STEAL_WEB_SESSION_COOKIE"
| "CREATE_OR_MODIFY_SYSTEM_PROCESS"
| "ABUSE_ELEVATION_CONTROL_MECHANISM"
| "UNSECURED_CREDENTIALS"
| "MODIFY_AUTHENTICATION_PROCESS"
| "IMPAIR_DEFENSES"
| "DISABLE_OR_MODIFY_TOOLS"
| "EXFILTRATION_OVER_WEB_SERVICE"
| "EXFILTRATION_TO_CLOUD_STORAGE"
| "DYNAMIC_RESOLUTION"
| "LATERAL_TOOL_TRANSFER"
| "MODIFY_CLOUD_COMPUTE_INFRASTRUCTURE"
| "CREATE_SNAPSHOT"
| "CLOUD_INFRASTRUCTURE_DISCOVERY"
| "OBTAIN_CAPABILITIES"
| "ACTIVE_SCANNING"
| "SCANNING_IP_BLOCKS"
| "CONTAINER_AND_RESOURCE_DISCOVERY"[];
version?: string;
}§Properties
§
additionalTactics?: "TACTIC_UNSPECIFIED" | "RECONNAISSANCE" | "RESOURCE_DEVELOPMENT" | "INITIAL_ACCESS" | "EXECUTION" | "PERSISTENCE" | "PRIVILEGE_ESCALATION" | "DEFENSE_EVASION" | "CREDENTIAL_ACCESS" | "DISCOVERY" | "LATERAL_MOVEMENT" | "COLLECTION" | "COMMAND_AND_CONTROL" | "EXFILTRATION" | "IMPACT"[]
[src]Additional MITRE ATT&CK tactics related to this finding, if any.
§
additionalTechniques?: "TECHNIQUE_UNSPECIFIED" | "MASQUERADING" | "MATCH_LEGITIMATE_NAME_OR_LOCATION" | "BOOT_OR_LOGON_INITIALIZATION_SCRIPTS" | "STARTUP_ITEMS" | "NETWORK_SERVICE_DISCOVERY" | "PROCESS_DISCOVERY" | "COMMAND_AND_SCRIPTING_INTERPRETER" | "UNIX_SHELL" | "PYTHON" | "PERMISSION_GROUPS_DISCOVERY" | "CLOUD_GROUPS" | "APPLICATION_LAYER_PROTOCOL" | "DNS" | "SOFTWARE_DEPLOYMENT_TOOLS" | "VALID_ACCOUNTS" | "DEFAULT_ACCOUNTS" | "LOCAL_ACCOUNTS" | "CLOUD_ACCOUNTS" | "PROXY" | "EXTERNAL_PROXY" | "MULTI_HOP_PROXY" | "ACCOUNT_MANIPULATION" | "ADDITIONAL_CLOUD_CREDENTIALS" | "SSH_AUTHORIZED_KEYS" | "ADDITIONAL_CONTAINER_CLUSTER_ROLES" | "INGRESS_TOOL_TRANSFER" | "NATIVE_API" | "BRUTE_FORCE" | "SHARED_MODULES" | "ACCESS_TOKEN_MANIPULATION" | "TOKEN_IMPERSONATION_OR_THEFT" | "EXPLOIT_PUBLIC_FACING_APPLICATION" | "DOMAIN_POLICY_MODIFICATION" | "DATA_DESTRUCTION" | "SERVICE_STOP" | "INHIBIT_SYSTEM_RECOVERY" | "RESOURCE_HIJACKING" | "NETWORK_DENIAL_OF_SERVICE" | "CLOUD_SERVICE_DISCOVERY" | "STEAL_APPLICATION_ACCESS_TOKEN" | "ACCOUNT_ACCESS_REMOVAL" | "STEAL_WEB_SESSION_COOKIE" | "CREATE_OR_MODIFY_SYSTEM_PROCESS" | "ABUSE_ELEVATION_CONTROL_MECHANISM" | "UNSECURED_CREDENTIALS" | "MODIFY_AUTHENTICATION_PROCESS" | "IMPAIR_DEFENSES" | "DISABLE_OR_MODIFY_TOOLS" | "EXFILTRATION_OVER_WEB_SERVICE" | "EXFILTRATION_TO_CLOUD_STORAGE" | "DYNAMIC_RESOLUTION" | "LATERAL_TOOL_TRANSFER" | "MODIFY_CLOUD_COMPUTE_INFRASTRUCTURE" | "CREATE_SNAPSHOT" | "CLOUD_INFRASTRUCTURE_DISCOVERY" | "OBTAIN_CAPABILITIES" | "ACTIVE_SCANNING" | "SCANNING_IP_BLOCKS" | "CONTAINER_AND_RESOURCE_DISCOVERY"[]
[src]Additional MITRE ATT&CK techniques related to this finding, if any, along with any of their respective parent techniques.
§
primaryTactic?: "TACTIC_UNSPECIFIED" | "RECONNAISSANCE" | "RESOURCE_DEVELOPMENT" | "INITIAL_ACCESS" | "EXECUTION" | "PERSISTENCE" | "PRIVILEGE_ESCALATION" | "DEFENSE_EVASION" | "CREDENTIAL_ACCESS" | "DISCOVERY" | "LATERAL_MOVEMENT" | "COLLECTION" | "COMMAND_AND_CONTROL" | "EXFILTRATION" | "IMPACT"
[src]The MITRE ATT&CK tactic most closely represented by this finding, if any.
§
primaryTechniques?: "TECHNIQUE_UNSPECIFIED" | "MASQUERADING" | "MATCH_LEGITIMATE_NAME_OR_LOCATION" | "BOOT_OR_LOGON_INITIALIZATION_SCRIPTS" | "STARTUP_ITEMS" | "NETWORK_SERVICE_DISCOVERY" | "PROCESS_DISCOVERY" | "COMMAND_AND_SCRIPTING_INTERPRETER" | "UNIX_SHELL" | "PYTHON" | "PERMISSION_GROUPS_DISCOVERY" | "CLOUD_GROUPS" | "APPLICATION_LAYER_PROTOCOL" | "DNS" | "SOFTWARE_DEPLOYMENT_TOOLS" | "VALID_ACCOUNTS" | "DEFAULT_ACCOUNTS" | "LOCAL_ACCOUNTS" | "CLOUD_ACCOUNTS" | "PROXY" | "EXTERNAL_PROXY" | "MULTI_HOP_PROXY" | "ACCOUNT_MANIPULATION" | "ADDITIONAL_CLOUD_CREDENTIALS" | "SSH_AUTHORIZED_KEYS" | "ADDITIONAL_CONTAINER_CLUSTER_ROLES" | "INGRESS_TOOL_TRANSFER" | "NATIVE_API" | "BRUTE_FORCE" | "SHARED_MODULES" | "ACCESS_TOKEN_MANIPULATION" | "TOKEN_IMPERSONATION_OR_THEFT" | "EXPLOIT_PUBLIC_FACING_APPLICATION" | "DOMAIN_POLICY_MODIFICATION" | "DATA_DESTRUCTION" | "SERVICE_STOP" | "INHIBIT_SYSTEM_RECOVERY" | "RESOURCE_HIJACKING" | "NETWORK_DENIAL_OF_SERVICE" | "CLOUD_SERVICE_DISCOVERY" | "STEAL_APPLICATION_ACCESS_TOKEN" | "ACCOUNT_ACCESS_REMOVAL" | "STEAL_WEB_SESSION_COOKIE" | "CREATE_OR_MODIFY_SYSTEM_PROCESS" | "ABUSE_ELEVATION_CONTROL_MECHANISM" | "UNSECURED_CREDENTIALS" | "MODIFY_AUTHENTICATION_PROCESS" | "IMPAIR_DEFENSES" | "DISABLE_OR_MODIFY_TOOLS" | "EXFILTRATION_OVER_WEB_SERVICE" | "EXFILTRATION_TO_CLOUD_STORAGE" | "DYNAMIC_RESOLUTION" | "LATERAL_TOOL_TRANSFER" | "MODIFY_CLOUD_COMPUTE_INFRASTRUCTURE" | "CREATE_SNAPSHOT" | "CLOUD_INFRASTRUCTURE_DISCOVERY" | "OBTAIN_CAPABILITIES" | "ACTIVE_SCANNING" | "SCANNING_IP_BLOCKS" | "CONTAINER_AND_RESOURCE_DISCOVERY"[]
[src]The MITRE ATT&CK technique most closely represented by this finding, if
any. primary_techniques is a repeated field because there are multiple
levels of MITRE ATT&CK techniques. If the technique most closely
represented by this finding is a sub-technique (e.g. SCANNING_IP_BLOCKS),
both the sub-technique and its parent technique(s) will be listed (e.g.
SCANNING_IP_BLOCKS, ACTIVE_SCANNING).