{
  "id": "mitre_attack_technique_id",
  "kind": "datatype",
  "status": "draft",
  "name": "MITRE ATT&CK technique ID",
  "doc": "Identifier of a technique in MITRE ATT&CK, the knowledge base of adversary behavior: T followed by four digits. A sub-technique adds a dot and three digits, so T1059.001 (PowerShell) is a sub-technique of T1059 (Command and Scripting Interpreter). The Enterprise, Mobile and ICS matrices share the format.",
  "is_pii": false,
  "categories": [
    "software"
  ],
  "langs": [
    "common"
  ],
  "classification": "identifier",
  "regexp": "^T[0-9]{4}(?:\\.[0-9]{3})?$",
  "examples": [
    {
      "value": "T1059",
      "description": "Command and Scripting Interpreter",
      "valid": true
    },
    {
      "value": "T1059.001",
      "description": "PowerShell, a sub-technique of T1059",
      "valid": true
    },
    {
      "value": "T1059.1",
      "description": "Sub-technique part needs three digits",
      "valid": false
    },
    {
      "value": "TA0001",
      "description": "Tactic ID",
      "valid": false
    }
  ],
  "links": [
    {
      "type": "wikipedia",
      "url": "https://en.wikipedia.org/wiki/ATT%26CK"
    },
    {
      "type": "doc",
      "url": "https://attack.mitre.org/techniques/T1059/001"
    },
    {
      "type": "other",
      "url": "https://github.com/mitre-attack/attack-stix-data"
    }
  ],
  "quality": {
    "score": 75,
    "missing": [
      "mapping (Wikidata, Schema.org, ...)",
      "translation",
      "detector coverage"
    ]
  },
  "source": {
    "path": "data/datatypes/any/software/mitre_attack_technique_id.yaml",
    "url": "https://github.com/apicrafter/metacrafter-registry/blob/main/data/datatypes/any/software/mitre_attack_technique_id.yaml",
    "edit_url": "https://github.com/apicrafter/metacrafter-registry/edit/main/data/datatypes/any/software/mitre_attack_technique_id.yaml"
  },
  "urls": {
    "html": "http://registry.apicrafter.io/datatype/mitre_attack_technique_id",
    "json": "http://registry.apicrafter.io/api/v1/datatypes/mitre_attack_technique_id.json"
  }
}