Take the Attack Actions for this post
How can I take one, say “Route traffic through proxies/port-forwards”, and find all posts that describe the action?
Attack Actions are unique to a post, because in many cases they talk about specifics of what is being described (you can see this most clearly in the description of the attack-action)
{
"created": "2025-12-19T04:37:54.419562Z",
"description": "Using tools like Chisel and ReverseSSH, the actor sets up SOCKS/port-forwarding and proxy-like channels to relay C2 and operational traffic through intermediate endpoints.",
"effect_refs": [
"attack-action--bf3c3635-4ec7-5fe8-a0bc-4069fba22ee8"
],
"extensions": {
"extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
"extension_type": "new-sdo"
}
},
"id": "attack-action--f8ffe069-6a81-5d40-9afe-4776f63f6910",
"modified": "2025-12-19T04:37:54.419562Z",
"name": "Route traffic through proxies/port-forwards",
"spec_version": "2.1",
"tactic_id": "TA0011",
"tactic_ref": "x-mitre-tactic--f72804c5-f15a-449e-a5da-2eecd181f813",
"technique_id": "T1090",
"technique_ref": "attack-pattern--731f4f55-b6d0-41d1-a7a9-072a66389aea",
"type": "attack-action"
}
In short, the ID attack-action will only ever be linked to one post.
However, the MITRE ATT&CK Technique level can be used to do what you want.
In the Attack Action above you can see it is linked to T1090: Proxy.
So you can use this object as the pivot point for your search to get what you want.
