How can I find all objects an ATT&CK Object has a relationship to?

OSS Support
,
1

I have all versions of ATT&CK currently indexed in ArangoDB, imported using stix2arango as follows;

python3 utilities/arango_cti_processor/insert_archive_attack_enterprise.py \
    --database forum_demo && \
python3 utilities/arango_cti_processor/insert_archive_attack_ics.py \
    --database forum_demo && \
python3 utilities/arango_cti_processor/insert_archive_attack_mobile.py \
    --database forum_demo

Let’s say I have T1113 (`attack-pattern–0259baeb-9f63-4c69-bf10-eb038c390688). I want to know what objects this Technique is related to (sub-techs, groups, software, etc.).

Is this possible?

2

Yes!

FOR attackPattern IN mitre_attack_enterprise_vertex_collection
  FILTER attackPattern._stix2arango_note != "automatically imported on collection creation"
  AND attackPattern._stix2arango_note == "v15.1"
  AND HAS(attackPattern, "external_references") // Ensure the field exists
  FOR extRef IN attackPattern.external_references
    FILTER extRef.external_id == "T1113"
    AND extRef.source_name == "mitre-attack"
    LET attackPatternId = attackPattern.id
    FOR relationship IN mitre_attack_enterprise_edge_collection
      FILTER relationship._stix2arango_note != "automatically imported on collection creation"
      AND relationship._is_ref == false
      AND relationship._stix2arango_note == "v15.1"
      AND relationship.target_ref == attackPatternId
      RETURN relationship

You can switch out T1113 with the ATT&CK ID you want.

You can also filter the results to only include certain results, e.g. only show linked groups know to use T1113

FOR attackPattern IN mitre_attack_enterprise_vertex_collection
  FILTER attackPattern._stix2arango_note != "automatically imported on collection creation"
  AND attackPattern._stix2arango_note == "v15.1"
  AND HAS(attackPattern, "external_references")
  FOR extRef IN attackPattern.external_references
    FILTER extRef.external_id == "T1113"
    AND extRef.source_name == "mitre-attack"
    LET attackPatternId = attackPattern.id
    FOR relationship IN mitre_attack_enterprise_edge_collection
      FILTER relationship._stix2arango_note != "automatically imported on collection creation"
      AND relationship._is_ref == false
      AND relationship._stix2arango_note == "v15.1"
      AND relationship.target_ref == attackPatternId
      AND (
        CONTAINS(relationship.source_ref, "intrusion-set--") 
        OR CONTAINS(relationship.target_ref, "intrusion-set--")
      )
      RETURN relationship