{
  "schema_version": 1,
  "classification": "offline-defensive-reference-record",
  "reviewed_at": "2026-08-25",
  "attck": {
    "name": "MITRE ATT&CK",
    "content_version": "19.2",
    "archive_url": "https://attack.mitre.org/versions/v19/",
    "use_note": "These short course records support the supplied synthetic case only. Confirm current definitions on the official site outside the offline lab.",
    "records": [
      { "id": "T1195.002", "label": "Compromise Software Supply Chain", "course_scope": "Review an unexplained release-integrity change; the mapping does not prove compromise." },
      { "id": "T1204.002", "label": "Malicious File", "course_scope": "Use only as an alternative hypothesis when evidence shows user execution; the course fixture does not." },
      { "id": "T1059", "label": "Command and Scripting Interpreter", "course_scope": "Map only observed interpreter use and context; do not infer an unknown command." },
      { "id": "T1071.001", "label": "Web Protocols", "course_scope": "A synthetic HTTPS flow supports protocol context, not command-and-control intent." },
      { "id": "T1486", "label": "Data Encrypted for Impact", "course_scope": "Rapid file changes alone do not support this mapping; encryption evidence is required." }
    ]
  },
  "d3fend": {
    "name": "MITRE D3FEND",
    "ontology_version": "1.5.0",
    "source_url": "https://d3fend.mitre.org/",
    "use_note": "Countermeasure labels are planning vocabulary. A coverage claim still needs an implementation point, owner, evidence, test, and limitation.",
    "records": [
      { "id": "D3-TL", "label": "Trusted Library", "course_application": "Constrain dependencies to approved, verified sources and record policy results." },
      { "id": "D3-SU", "label": "Software Update", "course_application": "Verify product, channel, signer authorization, provenance, digest, health, and rollback." },
      { "id": "D3-CH", "label": "Credential Hardening", "course_application": "Use narrowly scoped, short-lived build and release identities." },
      { "id": "D3-DI", "label": "Data Inventory", "course_application": "Maintain released artifact, deployment, owner, and evidence inventories for response." },
      { "id": "D3-PE", "label": "Process Eviction", "course_application": "Treat process containment as an authorized response option with verification and rollback." }
    ]
  }
}