Review and update killchains

Author: cyber-cyril

_kill-chains/account-takeover-bot.md

@@ -2,7 +2,7 @@
 title: Account Takeover Bot
 layout: kill-chain
 phases: [Resource Development, Reconnaissance, Defence Bypass, Attack Execution, Actions on the Objective, Post-Attack]
-tactics: [Credential Acquisition, Infrastructure Acquisition, Tool Development, Specific Target, Loose Target, Mitigation Bypass, Human Emulation, Proxying, Smokescreening, Account Takeover, Fake Interaction, Exfiltration, Sale]
-techniques: [Data Dumps, Malware, Person in the Middle, Social Engineering, Botnet, Command & Control, Proxies, Supply Chain Compromise, Development of Tools, Testing of Tools, Campaign Reuse, Technical Reconnaissance, CAPTCHA Farm, Automated CAPTCHA Bypass, MFA Bypass, Token Bypass, Cookie Abuse, Credential Pinning, User Agent Spoofing, Device Fingerprint Emulation, IP Rotation, Volumetric Traffic Disguise, Target Diversification, Smurfing, Credential Cracking, SSO Compromise, Overlay Attack, Credential Dumping, Payment Detail Dumping, PII Dumping, Information Brokerage, Automated Sale, Manual Sale]
+tactics: [Credential Acquisition, Infrastructure Acquisition, Tool Development, Attack Surface Identification, Vulnerability Identification, Device Emulation, Proxying, CAPTCHA Bypass, Human Emulation, Impersonation, Session Manipulation, Geolocation Spoofing, Smokescreening, Account Takeover, Data Extraction, Information Release, Sale]
+techniques: [Data Dumps, Infostealer, Person in the Middle, Social Engineering, Botnet, Proxies, Trusted Infrastructure, Development of Tools, Testing of Tools, Campaign Reuse, Path Enumeration, Endpoint Enumeration, Fuzzing, CAPTCHA Farm, Automated CAPTCHA Bypass, Mouse Usage, IP Rotation, Volumetric Traffic Disguise, Target Diversification, MFA Bypass, Credential Pinning, Token Bypass, Cookie Abuse, User Agent Spoofing, Device Configuration Emulation, TLS Spoofing, Header Spoofing, Credential Cracking, Credential Stuffing, SSO Compromise, Credential Extraction, Payment Detail Extraction, PII Extraction, Automated Sale, Manual Sale, Information Brokerage, Credential Dumping, Payment Detail Dumping, PII Dumping]
 short-desc: An account takeover bot is used by adversaries to gain unauthorised access to user accounts through automation, giving them the ability to use, manipulate, and/or extract information from the account as though they were the legitimate owner.
 ---

_kill-chains/ad-click-bot-own-ads.md

@@ -2,7 +2,7 @@
 title: Ad Click Bot (Own Ads)
 layout: kill-chain
 phases: [Resource Development, Defence Bypass, Attack Execution]
-tactics: [Website Creation, Infrastructure Acquisition, Human Emulation, Proxying, Fake Interaction]
-techniques: [Cloning, New Site Creation, URL Disguise, Botnet, Proxies, Command & Control, Fake Credibility Generation, Mouse Usage, User Agent Spoofing, IP Rotation, Click Interaction]
+tactics: [Website Creation, Infrastructure Acquisition, Device Emulation, Proxying, Human Emulation, Geolocation Spoofing, Fake Interaction]
+techniques: [Cloning, New Site Creation, URL Disguise, Botnet, Proxies, Mouse Usage, IP Rotation, User Agent Spoofing, Device Configuration Emulation, Click Interaction]
 short-desc: Ad click bots are used to commit digital ad fraud by automatically clicking on digital advertisements to inflate the number of clicks the advertisement receives. With adversary owned ads, the objective for the adversary is to gain payment for clicks on these ads. 
 ---

_kill-chains/ad-click-bot-target-ads.md

@@ -2,7 +2,7 @@
 title: Ad Click Bot (Target Ads)
 layout: kill-chain
 phases: [Resource Development, Reconnaissance, Defence Bypass, Attack Execution]
-tactics: [Infrastructure Acquisition, Specific Target, Mitigation Bypass, Human Emulation, Proxying, Smokescreening, Fake Interaction]
-techniques: [Botnet, Proxies, Command & Control, Continual Content Scraping, CAPTCHA Farm, Automated CAPTCHA Bypass, Token Bypass, Fake Credibility Generation, Mouse Usage, User Agent Spoofing, IP Rotation, Domain Fronting, Volumetric Traffic Disguise, Click Interaction]
+tactics: [Credential Acquisition, Infrastructure Acquisition, Attack Surface Identification, Device Emulation, Proxying, CAPTCHA Bypass, Human Emulation, Session Manipulation, Geolocation Spoofing, Smokescreening, Fake Interaction]
+techniques: [Botnet, Proxies, Valid Accounts, Path Enumeration, CAPTCHA Farm, Automated CAPTCHA Bypass, Mouse Usage, IP Rotation, Domain Fronting, Multi-Accounting, Volumetric Traffic Disguise, Token Bypass, User Agent Spoofing, Device Configuration Emulation, TLS Spoofing, Header Spoofing, Click Interaction]
 short-desc: Ad click bots are used to commit digital ad fraud by automatically clicking on digital advertisements to inflate the number of clicks the advertisement receives. With non-adversary owned ads, the objective for the adversary is to extinguish the advertising budget of their target. 
 ---

_kill-chains/arb-betting-bot.md

@@ -2,7 +2,7 @@
 title: Arbitrage Betting Bot
 layout: kill-chain
 phases: [Resource Development, Reconnaissance, Defence Bypass, Attack Execution, Actions on the Objective, Post-Attack]
-tactics: [Credential Acquisition, Infrastructure Acquisition, Tool Development, Specific Target, Loose Target, Mitigation Bypass, Human Emulation, Proxying, Stock Purchase, Sniping, Policy Abuse, Transaction Redirect, Invoice Abuse]
-techniques: [Valid Accounts, Botnet, Proxies, Command & Control, Development of Tools, Campaign Reuse, Continual Content Scraping, Periodic Content Scraping, Technical Reconnaissance, CAPTCHA Farm, Automated CAPTCHA Bypass, Token Bypass, Cookie Abuse, Mouse Usage, User Agent Spoofing, Device Fingerprint Emulation, Botnet, IP Rotation, Domain Fronting, Automated Purchase, Terms of Use Abuse, Fund Withdrawal, Fake Identity]
+tactics: [Credential Acquisition, Infrastructure Acquisition, Tool Development, Attack Surface Identification, CAPTCHA Bypass, Human Emulation, Proxying, Session Manipulation, Device Emulation, Purchase, Fake Credibility Generation, Policy Abuse, Cashout, Invoice Abuse]
+techniques: [Valid Accounts, Botnet, Proxies, Development of Tools, Campaign Reuse, Path Enumeration, Endpoint Enumeration, CAPTCHA Farm, Automated CAPTCHA Bypass, Mouse Usage, IP Rotation, Multi-Accounting, Token Bypass, Cookie Abuse, User Agent Spoofing, Device Configuration Emulation, TLS Spoofing, Header Spoofing, Account Ageing, Automated Purchase, Terms of Use Abuse, Account Balance Withdrawal, Fake Identity]
 short-desc: Arbitrage betting, or as it is more commonly known “arb” betting, is a form of gambling where the gambler exploits the differences in bookmakers’ opinions on certain odds, thereby ensuring that whatever the outcome of the event the gambler will always turn a profit. Arbitrage betting bots automatically bet on all possible outcomes of the same event simultaneously, placing these bets with different bookmakers who disagree on odds, to guarantee that at least a small return will be made. 
----
+---

_kill-chains/carding-bot.md

@@ -2,8 +2,7 @@
 title: Carding Bot
 layout: kill-chain
 phases: [Resource Development, Reconnaissance, Defence Bypass, Attack Execution, Actions on the Objective, Post-Attack]
-tactics: [Payment Detail Acquisition, Infrastructure Acquisition, Tool Development, Specific Target, Loose Target, Mitigation Bypass, Human Emulation, Proxying, Smokescreening, Payment Detail Abuse, Fake Interaction, Stock Purchase, Exfiltration, Sale]
-techniques: [Data Dumps, Malware, Person in the Middle, Social Engineering, Botnet, Command & Control, Proxies, Supply Chain Compromise, Development of Tools, Testing of Tools, Campaign Reuse, Technical Reconnaissance, CAPTCHA Farm, Automated CAPTCHA Bypass, MFA Bypass, Token Bypass, Cookie Abuse, Credential Pinning, User Agent Spoofing, Device Fingerprint Emulation, IP Rotation, Volumetric Traffic Disguise, Target Diversification, Credit/Debit Card Abuse, Overlay Attack, Automated Purchase, Payment Detail Dumping, Automated Advertisement of Stock, Information Brokerage, Automated Sale, Manual Sale]
+tactics: [Payment Detail Acquisition, Infrastructure Acquisition, Tool Development, Identity Acquisition, Attack Surface Identification, CAPTCHA Bypass, Human Emulation, Proxying, Smokescreening, Accessibility Options Abuse, Impersonation, Session Manipulation, Geolocation Spoofing, Device Emulation, Payment Card Enumeration, Payment Detail Abuse, Purchase, Data Extraction, Sale, Information Release]
+techniques: [Botnet, Proxies, Trusted Infrastructure, Data Dumps, Infostealer, Person in the Middle, Social Engineering, Development of Tools, Testing of Tools, Campaign Reuse, Path Enumeration, Endpoint Enumeration, CAPTCHA Farm, Automated CAPTCHA Bypass, Mouse Usage, Deepfakes, IP Rotation, Volumetric Traffic Disguise, Target Diversification, Accessibility Downgrade, MFA Bypass, Credential Pinning, Token Bypass, Cookie Abuse, GPS Spoofing, Mobile Network Spoofing, Accept-Language Manipulation, User Agent Spoofing, Device Configuration Emulation, TLS Spoofing, Header Spoofing, Credit/Debit Card Cracking, Credit/Debit Card Abuse, Automated Purchase, Payment Detail Extraction, Automated Sale, Manual Sale, Information Brokerage, Payment Detail Dumping]
 short-desc: A carding bot is used by adversaries to illegally validate stolen credit or debit card details without the permission of the payment card owner.
----
-
+---

_kill-chains/credential-stuffing-bot.md

@@ -2,7 +2,7 @@
 title: Credential Stuffing Bot
 layout: kill-chain
 phases: [Resource Development, Reconnaissance, Defence Bypass, Attack Execution, Actions on the Objective, Post-Attack]
-tactics: [Credential Acquisition, Infrastructure Acquisition, Tool Development, Specific Target, Mitigation Bypass, Human Emulation, Proxying, Smokescreening, Account Takeover, Exfiltration, Sale]
-techniques: [Data Dumps, Botnet, Command & Control, Proxies, Development of Tools, Campaign Reuse, Technical Reconnaissance, CAPTCHA Farm, Automated CAPTCHA Bypass, MFA Bypass, User Agent Spoofing, IP Rotation, Volumetric Traffic Disguise, Target Diversification, Credential Stuffing, Credential Dumping, Information Brokerage, Automated Sale, Manual Sale]
+tactics: [Credential Acquisition, Infrastructure Acquisition, Tool Development, Attack Surface Identification, Vulnerability Identification, CAPTCHA Bypass, Human Emulation, Proxying, Smokescreening, Impersonation, Session Manipulation, Geolocation Spoofing, Device Emulation, Account Takeover, Data Extraction, Sale, Information Release]
+techniques: [Data Dumps, Botnet, Proxies, Trusted Infrastructure, Development of Tools, Testing of Tools, Campaign Reuse, Endpoint Enumeration, Fuzzing, CAPTCHA Farm, Automated CAPTCHA Bypass, Mouse Usage, IP Rotation, Volumetric Traffic Disguise, Target Diversification, MFA Bypass, Token Bypass, Cookie Abuse, User Agent Spoofing, Device Configuration Emulation, TLS Spoofing, Header Spoofing, Credential Stuffing, Credential Extraction, Payment Detail Extraction, PII Extraction, Automated Sale, Manual Sale, Information Brokerage, Credential Dumping, Payment Detail Dumping, PII Dumping]
 short-desc: A credential stuffing bot is used to test previously leaked credentials (typically username and password pairs) to determine if they are valid on a target webservice or API. These bots validate credential pairs against their target webservice or API by automating login attempts, allowing adversaries to test and validate credentials at mass scale.
 ---

_kill-chains/fake-account-creation-bot.md

@@ -2,8 +2,7 @@
 title: Fake Account Creation Bot
 layout: kill-chain
 phases: [Resource Development, Reconnaissance, Defence Bypass, Attack Execution, Post-Attack]
-tactics: [Infrastructure Acquisition, Payment Detail Acquisition, Tool Development, Specific Target, Loose Target, Mitigation Bypass, Human Emulation, Proxying, Account Creation, Sale]
-techniques: [Botnet, Command & Control, Proxies, Data Dumps, Development of Tools, Testing of Tools, Campaign Reuse, Periodic Content Scraping, Technical Reconnaissance, CAPTCHA Farm, Automated CAPTCHA Bypass, Cookie Abuse, Fake Credibility Generation, User Agent Spoofing, IP Rotation, Smurfing, Volumetric Traffic Disguise, Social Media Creation, Email Generator, Call/SMS Generator, Virtual Wallet Creation, Manual Sale, Automated Sale]
-short-desc: Fake account creation bots abuse the signup process of a webservice to create user accounts in bulk, using stolen or fake identities. These bots automate multiple signup requests, which can be spread out over long periods of time or using IP addresses from different geolocations to hide the fact that they are controlled by one person. Many advanced fake account creation bots can also bypass email, phone, and CAPTCHA verifications. 
----
-
+tactics: [Identity Acquisition, Infrastructure Acquisition, Tool Development, Attack Surface Identification, CAPTCHA Bypass, Human Emulation, Proxying, Accessibility Options Abuse, Geolocation Spoofing, Device Emulation, Account Creation, Sale]
+techniques: [Botnet, Proxies, Trusted Infrastructure, Development of Tools, Testing of Tools, Campaign Reuse, Social Media Creation, Email Generator, Call/SMS Generator, Virtual Wallet Creation, Endpoint Enumeration, CAPTCHA Farm, Automated CAPTCHA Bypass, Mouse Usage, IP Rotation, Accessibility Downgrade, GPS Spoofing, Mobile Network Spoofing, Accept-Language Manipulation, User Agent Spoofing, Device Configuration Emulation, TLS Spoofing, Header Spoofing, Fake Account Creation, Automated Sale, Manual Sale]
+short-desc: Fake account creation bots abuse the signup process of a webservice to create user accounts in bulk using fake identities. These bots automate multiple signup requests, which can be spread out over long periods of time or using IP addresses from different geolocations to hide the fact that they are controlled by one person. Many advanced fake account creation bots can also bypass email, phone, and CAPTCHA verifications. 
+---

_kill-chains/form-spam-bot.md

@@ -1,8 +1,8 @@
 ---
 title: Form Spam Bot
 layout: kill-chain
-phases: [Resource Development, Reconnaissance, Defence Bypass, Attack Execution]
-tactics: [Credential Acquisition, Infrastructure Acquisition, Tool Development, Specific Target, Loose Target, Mitigation Bypass, Human Emulation, Proxying, Fake Interaction]
-techniques: [Valid Accounts, Botnet, Command & Control, Proxies, Development of Tools, Testing of Tools, Campaign Reuse, Continual Content Scraping, Periodic Content Scraping, Automated CAPTCHA Bypass, CAPTCHA Farm, Fake Credibility Generation, User Agent Spoofing, IP Rotation, Smurfing, Form Filling, Comment Flooding, Written Interaction]
+phases: [Resource Development, Defence Bypass, Attack Execution]
+tactics: [Credential Acquisition, Infrastructure Acquisition, Tool Development, CAPTCHA Bypass, Human Emulation, Proxying, Accessibility Options Abuse, Device Emulation, Fake Credibility Generation, Fake Interaction]
+techniques: [Valid Accounts, Botnet, Proxies, Trusted Infrastructure, Development of Tools, Testing of Tools, Campaign Reuse, CAPTCHA Farm, Automated CAPTCHA Bypass, Mouse Usage, IP Rotation, Multi-Accounting, Accessibility Downgrade, User Agent Spoofing, Device Configuration Emulation, TLS Spoofing, Header Spoofing, Account Ageing, Content Posting, Form Submission]
 short-desc: A form spam bot allows adversaries to automate submitting unwanted content, for example, phishing messages or advertising links, into website forms.
----
+---

_kill-chains/gift-card-bot.md

@@ -2,10 +2,7 @@
 title: Gift Card Cracking Bot
 layout: kill-chain
 phases: [Resource Development, Reconnaissance, Defence Bypass, Attack Execution, Actions on the Objective, Post-Attack]
-tactics: [Payment Detail Acquisition, Infrastructure Acquisition, Tool Development, Attack Surface Identification, CAPTCHA Bypass, Human Emulation, Proxying, Smokescreening, Payment Detail Abuse, Fake Interaction, Purchase, Data Extraction, Sale]
-techniques: [Data Dumps, Infostealer, Person in the Middle, Path Enumeration, Endpoint Enumeration, Social Engineering, Botnet, Proxies, Trusted Infrastructure, Development of Tools, Testing of Tools, Campaign Reuse, CAPTCHA Farm, Automated CAPTCHA Bypass, MFA Bypass, Token Bypass, Cookie Abuse, Credential Pinning, User Agent Spoofing, Device Configuration Emulation, IP Rotation, Target Diversification, Gift Card Abuse, Automated Purchase, Payment Detail Dumping, Inventory Information Release, Automated Sale, Manual Sale]
+tactics: [Payment Detail Acquisition, Infrastructure Acquisition, Tool Development, Attack Surface Identification, Device Emulation, Proxying, CAPTCHA Bypass, Session Manipulation, Impersonation, Smokescreening, Payment Card Enumeration, Payment Detail Abuse, Purchase, Data Extraction, Information Release, Sale]
+techniques: [Data Dumps, Infostealer, Person in the Middle, Path Enumeration, Endpoint Enumeration, Social Engineering, Botnet, Proxies, Trusted Infrastructure, Development of Tools, Testing of Tools, Campaign Reuse, CAPTCHA Farm, Automated CAPTCHA Bypass, MFA Bypass, Token Bypass, Cookie Abuse, Credential Pinning, User Agent Spoofing, Device Configuration Emulation, Header Spoofing, TLS Spoofing, IP Rotation, Target Diversification, Gift Card Cracking, Gift Card Abuse, Automated Purchase, Payment Detail Extraction, Payment Detail Dumping, Automated Sale, Manual Sale]
 short-desc: A gift carding bot is used by adversaries to validate stolen gift cards or enumerate gift card codes for subsequent use or sale.
----
-
-
-
+---

_kill-chains/inventory-hoarding-bot.md

@@ -2,7 +2,7 @@
 title: Inventory Hoarding Bot
 layout: kill-chain
 phases: [Resource Development, Reconnaissance, Defence Bypass, Attack Execution, Actions on the Objective, Post-Attack]
-tactics: [Credential Acquisition, Infrastructure Acquisition, Tool Development, Attack Surface Identification, CAPTCHA Bypass, Human Emulation, Proxying, Data Extraction, Sale]
-techniques: [Valid Accounts, Botnet, Proxies, Development of Tools, Testing of Tools, Campaign Reuse, Path Enumeration, Endpoint Enumeration, CAPTCHA Farm, Automated CAPTCHA Bypass, User Agent Spoofing, IP Rotation, Automated Add to Cart, Inventory Hoarding, Transfer of Cart, Automated Purchase, Inventory Information Release, Automated Sale]
+tactics: [Credential Acquisition, Infrastructure Acquisition, Tool Development, Attack Surface Identification, Device Emulation, Proxying, CAPTCHA Bypass, Human Emulation, Fake Credibility Generation, Add to Cart, Session Transfer, Inventory Manipulation, Data Extraction, Sale]
+techniques: [Valid Accounts, Botnet, Proxies, Development of Tools, Testing of Tools, Campaign Reuse, Path Enumeration, Endpoint Enumeration, User Agent Spoofing, Device Configuration Emulation, TLS Spoofing, Header Spoofing, IP Rotation, CAPTCHA Farm, Automated CAPTCHA Bypass, Mouse Usage, Account Ageing, Automated Add to Cart, Mass Add to Cart, Automated Purchase, Transfer of Cart, Inventory Hoarding, Inventory Information Extraction, Inventory Information Release, Automated Sale, Manual Sale]
 short-desc: An inventory hoarding bot (also known as a spinner bot) is an automated tool that adds items to a basket and holds them there held until the bot operator decides to complete the checkout process. Some inventory hoarding bots will automatically relist the item on a third party reselling platform and only complete the checkout process once their relisting is sold.
 ---