get_software_using_technique
Find software (malware/tools) that leverage a specific MITRE ATT&CK technique via reverse lookup from technique STIX ID.
Instructions
Get all software (malware/tools) that use a specific technique.
This is a reverse lookup: Technique → Software.
It follows 'uses' relationships from a technique STIX ID to software
(malware and tools) that implement or leverage that technique.
Args:
technique_stix_id: STIX ID of the technique
(e.g., "attack-pattern--UUID").
domain: ATT&CK domain ("enterprise", "mobile", "ics").
include_description: Whether to include software descriptions.
Returns:
{
"technique": {
"attack_id": "TXXXX or TXXXX.YYY" | null,
"name": "<technique name or null>",
"stix_id": "<attack-pattern--UUID>",
"description": "<text or null>",
} | null,
"count": <number of software objects>,
"software": [
{
"attack_id": "SXXXX or similar" | null,
"name": "<software name>",
"stix_id": "<software STIX ID>",
"type": "<malware|tool|...>",
"description": "<text or null>",
"relationships": [
{
"stix_id": "<relationship--UUID>",
"relationship_type": "uses",
"description": "<relationship description or null>",
"source_ref": "<source STIX ID>",
"target_ref": "<target STIX ID>",
},
...
]
},
...
],
"formatted": "<human-readable list of software>",
"message": "<status summary>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| technique_stix_id | Yes | ||
| include_description | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |