Skip to content

Instantly share code, notes, and snippets.

@wietze
Created June 29, 2021 13:55
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save wietze/5904485851d22e830b346d9fb6ef6341 to your computer and use it in GitHub Desktop.
Save wietze/5904485851d22e830b346d9fb6ef6341 to your computer and use it in GitHub Desktop.
Returns the full MITRE ATT&CK technique name for a given TID
import requests
MITRE_ATTACK_DATA = requests.get('https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json').json()
TECHNIQUES = {technique['external_references'][0]['external_id']:technique['name'] for technique in MITRE_ATTACK_DATA['objects'] if technique['type'] == 'attack-pattern' and not technique.get('revoked')}
def get_technique(tid):
return TECHNIQUES[tid] if '.' not in tid else "{}: {}".format(TECHNIQUES[tid[:5]], TECHNIQUES[tid])
# Usage:
# get_technique('T1059.001')
# will return:
# 'Command and Scripting Interpreter: PowerShell'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment