Skip to content

Countermeasures

DISARM is a framework designed for describing and understanding disinformation incidents.

Authors
Authors and/or Contributors
DISARM Project

Charge for social media

Include a paid-for privacy option, e.g. pay Facebook for an option of them not collecting your personal information. There are examples of this not working, e.g. most people don’t use proton mail etc.

Internal MISP references

UUID 0aa00b22-361f-5e5b-ac46-901cf6d2dfcc which can be used as unique global reference for Charge for social media in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00006
kill_chain ['tactics:Plan Strategy', 'responsetypes:Deny', 'metatechniques:Friction']
Related clusters

To see the related clusters, click here.

Create shared fact-checking database

Share fact-checking resources - tips, responses, countermessages, across respose groups.

Internal MISP references

UUID 26781c01-b62d-5091-99f4-047e4a0e825e which can be used as unique global reference for Create shared fact-checking database in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00008
kill_chain ['tactics:Plan Strategy', 'responsetypes:Degrade', 'metatechniques:Scoring']
Related clusters

To see the related clusters, click here.

Educate high profile influencers on best practices

Find online influencers. Provide training in the mechanisms of disinformation, how to spot campaigns, and/or how to contribute to responses by countermessaging, boosting information sites etc.

Internal MISP references

UUID 60e783f2-4e22-5495-abdf-cb73e1a5a4c1 which can be used as unique global reference for Educate high profile influencers on best practices in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00009
kill_chain ['tactics:Plan Objectives', 'responsetypes:Deny', 'metatechniques:Resilience']
Related clusters

To see the related clusters, click here.

Enhanced privacy regulation for social media

Implement stronger privacy standards, to reduce the ability to microtarget community members.

Internal MISP references

UUID 57f70a3c-63a7-5873-a0ce-49a05d5f4eb7 which can be used as unique global reference for Enhanced privacy regulation for social media in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00010
kill_chain ['tactics:Plan Strategy', 'responsetypes:Deny', 'metatechniques:Friction']
Related clusters

To see the related clusters, click here.

Media literacy. Games to identify fake news

Create and use games to show people the mechanics of disinformation, and how to counter them.

Internal MISP references

UUID 523a0f1c-bb9e-5784-8838-ca7bc389688b which can be used as unique global reference for Media literacy. Games to identify fake news in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00011
kill_chain ['tactics:Plan Objectives', 'responsetypes:Deny', 'metatechniques:Resilience']
Related clusters

To see the related clusters, click here.

Platform regulation

Empower existing regulators to govern social media. Also covers Destroy. Includes: Include the role of social media in the regulatory framework for media. The U.S. approach will need to be carefully crafted to protect First Amendment principles, create needed transparency, ensure liability, and impose costs for noncompliance. Includes Create policy that makes social media police disinformation. Includes: Use fraud legislation to clean up social media

Internal MISP references

UUID 27acb21d-afef-52b5-be75-886d2af18067 which can be used as unique global reference for Platform regulation in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00012
kill_chain ['tactics:Plan Strategy', 'responsetypes:Deny', 'metatechniques:Metatechnique']
Related clusters

To see the related clusters, click here.

Rating framework for news

This is "strategic innoculation", raising the standards of what people expect in terms of evidence when consuming news. Example: journalistic ethics, or journalistic licencing body. Include full transcripts, link source, add items.

Internal MISP references

UUID 2fd47294-5af0-591d-8f6d-ca6db61f1ead which can be used as unique global reference for Rating framework for news in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00013
kill_chain ['tactics:Plan Strategy', 'responsetypes:Deny', 'metatechniques:Scoring']
Related clusters

To see the related clusters, click here.

Real-time updates to fact-checking database

Update fact-checking databases and resources in real time. Especially import for time-limited events like natural disasters.

Internal MISP references

UUID 5036147d-f885-5d57-98ea-2e0c478611cc which can be used as unique global reference for Real-time updates to fact-checking database in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00014
kill_chain ['tactics:Develop Content', 'responsetypes:Degrade', 'metatechniques:Scoring']
Related clusters

To see the related clusters, click here.

Censorship

Alter and/or block the publication/dissemination of information controlled by disinformation creators. Not recommended.

Internal MISP references

UUID bb1f5f27-16da-59da-9972-32bb25568d02 which can be used as unique global reference for Censorship in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00016
kill_chain ['tactics:Plan Strategy', 'responsetypes:Deny', 'metatechniques:Removal']
Related clusters

To see the related clusters, click here.

Repair broken social connections

For example, use a media campaign to promote in-group to out-group in person communication / activities . Technique could be in terms of forcing a reality-check by talking to people instead of reading about bogeymen.

Internal MISP references

UUID f5764785-ced5-5faa-8e11-e442d2d3f79d which can be used as unique global reference for Repair broken social connections in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00017
kill_chain ['tactics:Plan Strategy', 'responsetypes:Disrupt', 'metatechniques:Countermessaging']
Related clusters

To see the related clusters, click here.

Reduce effect of division-enablers

includes Promote constructive communication by shaming division-enablers, and Promote playbooks to call out division-enablers

Internal MISP references

UUID cad55f3b-3244-5b10-ab09-4ca0b0ff8675 which can be used as unique global reference for Reduce effect of division-enablers in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00019
kill_chain ['tactics:Plan Strategy', 'responsetypes:Disrupt', 'metatechniques:Daylight']
Related clusters

To see the related clusters, click here.

Encourage in-person communication

Encourage offline communication

Internal MISP references

UUID 68dc4436-e658-523b-a2ef-a3cbc40a7c67 which can be used as unique global reference for Encourage in-person communication in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00021
kill_chain ['tactics:Plan Strategy', 'responsetypes:Degrade', 'metatechniques:Resilience']
Related clusters

To see the related clusters, click here.

Innoculate. Positive campaign to promote feeling of safety

Used to counter ability based and fear based attacks

Internal MISP references

UUID f5322bd4-271e-5387-b725-5b19404227c9 which can be used as unique global reference for Innoculate. Positive campaign to promote feeling of safety in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00022
kill_chain ['tactics:Plan Strategy', 'responsetypes:Degrade', 'metatechniques:Resilience']
Related clusters

To see the related clusters, click here.

Promote healthy narratives

Includes promoting constructive narratives i.e. not polarising (e.g. pro-life, pro-choice, pro-USA). Includes promoting identity neutral narratives.

Internal MISP references

UUID 74f42c1b-7e24-5c78-b6a2-49c9c09922e2 which can be used as unique global reference for Promote healthy narratives in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00024
kill_chain ['tactics:Plan Strategy', 'responsetypes:Degrade', 'metatechniques:Resilience']
Related clusters

To see the related clusters, click here.

Shore up democracy based messages

Messages about e.g. peace, freedom. And make it sexy. Includes Deploy Information and Narrative-Building in Service of Statecraft: Promote a narrative of transparency, truthfulness, liberal values, and democracy. Implement a compelling narrative via effective mechanisms of communication. Continually reassess messages, mechanisms, and audiences over time. Counteract efforts to manipulate media, undermine free markets, and suppress political freedoms via public diplomacy

Internal MISP references

UUID 713f0bb0-e9c4-5584-b923-a87365e39f3c which can be used as unique global reference for Shore up democracy based messages in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00026
kill_chain ['tactics:Plan Strategy', 'responsetypes:Degrade', 'metatechniques:Countermessaging']
Related clusters

To see the related clusters, click here.

Create culture of civility

This is passive. Includes promoting civility as an identity that people will defend.

Internal MISP references

UUID 5837bb64-0baf-53fa-8b73-3e9fb0d63a9b which can be used as unique global reference for Create culture of civility in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00027
kill_chain ['tactics:Plan Strategy', 'responsetypes:Deter', 'metatechniques:Resilience']
Related clusters

To see the related clusters, click here.

Make information provenance available

Blockchain audit log and validation with collaborative decryption to post comments. Use blockchain technology to require collaborative validation before posts or comments are submitted. This could be used to adjust upvote weight via a trust factor of people and organisations you trust, or other criteria.

Internal MISP references

UUID dd7ad75d-dc4d-5408-ac00-1f1e3c52a632 which can be used as unique global reference for Make information provenance available in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00028
kill_chain ['tactics:Plan Objectives', 'responsetypes:Disrupt', 'metatechniques:Verification']
Related clusters

To see the related clusters, click here.

Create fake website to issue counter narrative and counter narrative through physical merchandise

Create websites in disinformation voids - spaces where people are looking for known disinformation.

Internal MISP references

UUID 559c0ffb-5098-55bd-a173-fbd335bb4ba7 which can be used as unique global reference for Create fake website to issue counter narrative and counter narrative through physical merchandise in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00029
kill_chain ['tactics:Plan Objectives', 'responsetypes:Disrupt', 'metatechniques:Diversion']
Related clusters

To see the related clusters, click here.

Develop a compelling counter narrative (truth based)

Internal MISP references

UUID eededb33-c7f5-5c1b-bacd-924af3b6e332 which can be used as unique global reference for Develop a compelling counter narrative (truth based) in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00030
kill_chain ['tactics:Plan Objectives', 'responsetypes:Disrupt', 'metatechniques:Diversion']
Related clusters

To see the related clusters, click here.

Dilute the core narrative - create multiple permutations, target / amplify

Create competing narratives. Included "Facilitate State Propaganda" as diluting the narrative could have an effect on the pro-state narrative used by volunteers, or lower their involvement.

Internal MISP references

UUID e6e01a8f-bb6f-5b16-b77d-61f0abbc84a5 which can be used as unique global reference for Dilute the core narrative - create multiple permutations, target / amplify in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00031
kill_chain ['tactics:Plan Objectives', 'responsetypes:Disrupt', 'metatechniques:Dilution']
Related clusters

To see the related clusters, click here.

Link to platform

Internal MISP references

UUID 0cb15351-72d8-5ffa-ab9a-1d71685881e1 which can be used as unique global reference for Hijack content and link to truth- based info in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00032
kill_chain ['tactics:Develop Content', 'responsetypes:Disrupt', 'metatechniques:Diversion']
Related clusters

To see the related clusters, click here.

Create more friction at account creation

Counters fake account

Internal MISP references

UUID 486790ce-6083-5403-b971-d4c0b291b6a4 which can be used as unique global reference for Create more friction at account creation in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00034
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Degrade', 'metatechniques:Friction']
Related clusters

To see the related clusters, click here.

Infiltrate the in-group to discredit leaders (divide)

All of these would be highly affected by infiltration or false-claims of infiltration.

Internal MISP references

UUID 2925512b-480b-52fb-a2b6-75ab3efbfef9 which can be used as unique global reference for Infiltrate the in-group to discredit leaders (divide) in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00036
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Deny', 'metatechniques:Targeting']
Related clusters

To see the related clusters, click here.

third party verification for people

counters fake experts

Internal MISP references

UUID a374c7de-23fd-5cae-805c-83817cb66d66 which can be used as unique global reference for third party verification for people in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00040
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Deny', 'metatechniques:Verification']
Related clusters

To see the related clusters, click here.

Address truth contained in narratives

Focus on and boost truths in misinformation narratives, removing misinformation from them.

Internal MISP references

UUID d14b6626-052a-5d30-a0da-598e1490bdaa which can be used as unique global reference for Address truth contained in narratives in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00042
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Degrade', 'metatechniques:Countermessaging']
Related clusters

To see the related clusters, click here.

Keep people from posting to social media immediately

Platforms can introduce friction to slow down activities, force a small delay between posts, or replies to posts.

Internal MISP references

UUID e23dbc10-0eca-5100-bf14-cf2db9db31b8 which can be used as unique global reference for Keep people from posting to social media immediately in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00044
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Disrupt', 'metatechniques:Friction']
Related clusters

To see the related clusters, click here.

Marginalise and discredit extremist groups

Reduce the credibility of extremist groups posting misinformation.

Internal MISP references

UUID e4a0a68e-dbf8-56b6-8029-2d670aad813c which can be used as unique global reference for Marginalise and discredit extremist groups in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00046
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Degrade', 'metatechniques:Targeting']
Related clusters

To see the related clusters, click here.

Honeypot with coordinated inauthentics

Flood disinformation spaces with obviously fake content, to dilute core misinformation narratives in them.

Internal MISP references

UUID 71d1408a-5cb7-58a9-a9ff-0534141b78de which can be used as unique global reference for Honeypot with coordinated inauthentics in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00047
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Deceive', 'metatechniques:Data Pollution']
Related clusters

To see the related clusters, click here.

Name and Shame Influencers

Think about the different levels: individual vs state-sponsored account. Includes “call them out” and “name and shame”. Identify social media accounts as sources of propaganda—“calling them out”— might be helpful to prevent the spread of their message to audiences that otherwise would consider them factual. Identify, monitor, and, if necessary, target externally-based nonattributed social media accounts. Impact of and Dealing with Trolls - "Chatham House has observed that trolls also sometimes function as decoys, as a way of “keeping the infantry busy” that “aims to wear down the other side” (Lough et al., 2014). Another type of troll involves “false accounts posing as authoritative information sources on social media”.

Internal MISP references

UUID 70fb13e3-1d1f-5064-bf27-c3644f0a2045 which can be used as unique global reference for Name and Shame Influencers in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00048
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Deter', 'metatechniques:Daylight']
Related clusters

To see the related clusters, click here.

Counter social engineering training

Includes anti-elicitation training, phishing prevention education.

Internal MISP references

UUID 943ccc85-a339-5e32-ade9-09bc4bf6b4fd which can be used as unique global reference for Counter social engineering training in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00051
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Deny', 'metatechniques:Resilience']
Related clusters

To see the related clusters, click here.

Infiltrate platforms

Detect and degrade

Internal MISP references

UUID d7895c21-5e79-58db-b055-1e065abf524b which can be used as unique global reference for Infiltrate platforms in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00052
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Degrade', 'metatechniques:Targeting']
Related clusters

To see the related clusters, click here.

Delete old accounts / Remove unused social media accounts

remove or remove access to (e.g. stop the ability to update) old social media accounts, to reduce the pool of accounts available for takeover, botnets etc.

Internal MISP references

UUID 5481cc36-5af8-5ddf-bcb7-638d3be3f583 which can be used as unique global reference for Delete old accounts / Remove unused social media accounts in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00053
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Degrade', 'metatechniques:Cleaning']
Related clusters

To see the related clusters, click here.

Encourage people to leave social media

Encourage people to leave spcial media. We don't expect this to work

Internal MISP references

UUID ea193641-bdc6-591e-80bb-18061f0f3220 which can be used as unique global reference for Encourage people to leave social media in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00056
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Deny', 'metatechniques:Friction']
Related clusters

To see the related clusters, click here.

Report crowdfunder as violator

counters crowdfunding. Includes ‘Expose online funding as fake”.

Internal MISP references

UUID 99575145-b81a-5c7d-8107-e2ad419b3e20 which can be used as unique global reference for Report crowdfunder as violator in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00058
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Deny', 'metatechniques:Removal']
Related clusters

To see the related clusters, click here.

Verification of project before posting fund requests

third-party verification of projects posting funding campaigns before those campaigns can be posted.

Internal MISP references

UUID c112eafc-0f31-5bd7-9083-20ef706c8d57 which can be used as unique global reference for Verification of project before posting fund requests in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00059
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Deny', 'metatechniques:Verification']
Related clusters

To see the related clusters, click here.

Take legal action against for-profit "factories" creating misinformation.

Internal MISP references

UUID 5682293b-d9d8-5db0-90df-4bb4cedc6882 which can be used as unique global reference for Legal action against for-profit engagement factories in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00060
kill_chain ['tactics:Plan Objectives', 'responsetypes:Disrupt', 'metatechniques:Targeting']
Related clusters

To see the related clusters, click here.

Free open library sources worldwide

Open-source libraries could be created that aid in some way for each technique. Even for Strategic Planning, some open-source frameworks such as DISARM can be created to counter the adversarial efforts.

Internal MISP references

UUID c34fec02-a908-5b61-8e98-5ae1b5453fee which can be used as unique global reference for Free open library sources worldwide in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00062
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Degrade', 'metatechniques:Countermessaging']
Related clusters

To see the related clusters, click here.

Reduce political targeting

Includes “ban political micro targeting” and “ban political ads”

Internal MISP references

UUID 14dad601-4ddd-5cfd-a48d-9b53212769ce which can be used as unique global reference for Reduce political targeting in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00065
kill_chain ['tactics:Microtarget', 'responsetypes:Disrupt', 'metatechniques:Removal']
Related clusters

To see the related clusters, click here.

Co-opt a hashtag and drown it out (hijack it back)

Flood a disinformation-related hashtag with other content.

Internal MISP references

UUID 677c9e22-42b6-5b78-985c-e72936ae1b3f which can be used as unique global reference for Co-opt a hashtag and drown it out (hijack it back) in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00066
kill_chain ['tactics:Microtarget', 'responsetypes:Disrupt', 'metatechniques:Dilution']
Related clusters

To see the related clusters, click here.

Denigrate the recipient/ project (of online funding)

Reduce the credibility of groups behind misinformation-linked funding campaigns.

Internal MISP references

UUID f3cd91e7-b21a-529f-82bd-dd3aa3c3106b which can be used as unique global reference for Denigrate the recipient/ project (of online funding) in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00067
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Disrupt', 'metatechniques:Targeting']
Related clusters

To see the related clusters, click here.

Block access to disinformation resources

Resources = accounts, channels etc. Block access to platform. DDOS an attacker. TA02*: DDOS at the critical time, to deny an adversary's time-bound objective. T0008: A quick response to a proto-viral story will affect it's ability to spread and raise questions about their legitimacy. Hashtag: Against the platform, by drowning the hashtag. T0046 - Search Engine Optimisation: Sub-optimal website performance affect its search engine rank, which I interpret as "blocking access to a platform".

Internal MISP references

UUID 6da6cc36-cd42-5008-b3ea-bddf271f49df which can be used as unique global reference for Block access to disinformation resources in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00070
kill_chain ['tactics:Plan Objectives', 'responsetypes:Deny', 'metatechniques:Removal']
Related clusters

To see the related clusters, click here.

Block source of pollution

Block websites, accounts, groups etc connected to misinformation and other information pollution.

Internal MISP references

UUID 731ffe0e-0225-583e-9ef0-f39851b725c7 which can be used as unique global reference for Block source of pollution in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00071
kill_chain ['tactics:Develop Content', 'responsetypes:Deny', 'metatechniques:Removal']
Related clusters

To see the related clusters, click here.

Check special-interest groups (e.g. medical, knitting) for unrelated and misinformation-linked content, and remove it.

Internal MISP references

UUID fe5266c1-0af6-59f3-8a0a-f4e5b3f67513 which can be used as unique global reference for Remove non-relevant content from special interest groups - not recommended in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00072
kill_chain ['tactics:Develop Content', 'responsetypes:Deny', 'metatechniques:Removal']
Related clusters

To see the related clusters, click here.

Inoculate populations through media literacy training

Use training to build the resilience of at-risk populations. Educate on how to handle info pollution. Push out targeted education on why it's pollution. Build cultural resistance to false content, e.g. cultural resistance to bullshit. Influence literacy training, to inoculate against “cult” recruiting. Media literacy training: leverage librarians / library for media literacy training. Inoculate at language. Strategic planning included as inoculating population has strategic value. Concepts of media literacy to a mass audience that authorities launch a public information campaign that teaches the programme will take time to develop and establish impact, recommends curriculum-based training. Covers detect, deny, and degrade.

Internal MISP references

UUID c52274ce-09fe-5b50-b2f2-741be794da6e which can be used as unique global reference for Inoculate populations through media literacy training in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00073
kill_chain ['tactics:Plan Strategy', 'responsetypes:Deny', 'metatechniques:Resilience']
Related clusters

To see the related clusters, click here.

Identify and delete or rate limit identical content

C00000

Internal MISP references

UUID dae93cbd-eb65-5fb0-9d4e-4571ff54b6ff which can be used as unique global reference for Identify and delete or rate limit identical content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00074
kill_chain ['tactics:Develop Content', 'responsetypes:Deny', 'metatechniques:Cleaning']
Related clusters

To see the related clusters, click here.

normalise language

normalise the language around disinformation and misinformation; give people the words for artefact and effect types.

Internal MISP references

UUID da3fffda-ef2a-5408-8bde-4726ac2da214 which can be used as unique global reference for normalise language in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00075
kill_chain ['tactics:Develop Content', 'responsetypes:Deny', 'metatechniques:Countermessaging']
Related clusters

To see the related clusters, click here.

Prohibit images in political discourse channels

Make political discussion channels text-only.

Internal MISP references

UUID d8b22aa2-cbb6-5a97-b9ad-32eaf3514768 which can be used as unique global reference for Prohibit images in political discourse channels in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00076
kill_chain ['tactics:Develop Content', 'responsetypes:Deny', 'metatechniques:Removal']
Related clusters

To see the related clusters, click here.

Develop networks of communities and influencers around counter-misinformation. Match them to misinformation creators

Internal MISP references

UUID bddf930a-5d96-5b58-88d1-3afd0b86c316 which can be used as unique global reference for Active defence: run TA15 "develop people” - not recommended in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00077
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Disrupt', 'metatechniques:Targeting']
Related clusters

To see the related clusters, click here.

Change Search Algorithms for Disinformation Content

Includes “change image search algorithms for hate groups and extremists” and “Change search algorithms for hate and extremist queries to show content sympathetic to opposite side”

Internal MISP references

UUID ccea6ead-1274-54b7-82fc-8b0774211658 which can be used as unique global reference for Change Search Algorithms for Disinformation Content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00078
kill_chain ['tactics:Develop Content', 'responsetypes:Disrupt', 'metatechniques:Diversion']
Related clusters

To see the related clusters, click here.

Create competing narrative

Create counternarratives, or narratives that compete in the same spaces as misinformation narratives. Could also be degrade

Internal MISP references

UUID a706cf86-2170-58ea-a6d4-79cc47f23e54 which can be used as unique global reference for Create competing narrative in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00080
kill_chain ['tactics:Develop Content', 'responsetypes:Disrupt', 'metatechniques:Diversion']
Related clusters

To see the related clusters, click here.

Highlight flooding and noise, and explain motivations

Discredit by pointing out the "noise" and informing public that "flooding" is a technique of disinformation campaigns; point out intended objective of "noise"

Internal MISP references

UUID c14e8f7d-3c10-5cb5-a654-9d23315d631c which can be used as unique global reference for Highlight flooding and noise, and explain motivations in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00081
kill_chain ['tactics:Develop Content', 'responsetypes:Disrupt', 'metatechniques:Daylight']
Related clusters

To see the related clusters, click here.

Ground truthing as automated response to pollution

Also inoculation.

Internal MISP references

UUID 5f6e9165-2d53-52af-883a-13fff2749308 which can be used as unique global reference for Ground truthing as automated response to pollution in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00082
kill_chain ['tactics:Develop Content', 'responsetypes:Disrupt', 'metatechniques:Countermessaging']
Related clusters

To see the related clusters, click here.

Modify disinformation narratives, and rebroadcast them

Includes “poison pill recasting of message” and “steal their truths”. Many techniques involve promotion which could be manipulated. For example, online fundings or rallies could be advertised, through compromised or fake channels, as being associated with "far-up/down/left/right" actors. "Long Game" narratives could be subjected in a similar way with negative connotations. Can also replay technique T0003.

Internal MISP references

UUID 4fc5ef29-5af2-5630-b57a-4df9844932c1 which can be used as unique global reference for Modify disinformation narratives, and rebroadcast them in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00084
kill_chain ['tactics:Develop Content', 'responsetypes:Disrupt', 'metatechniques:Diversion']
Related clusters

To see the related clusters, click here.

Mute content

Rate-limit disinformation content. Reduces its effects, whilst not running afoul of censorship concerns. Online archives of content (archives of websites, social media profiles, media, copies of published advertisements; or archives of comments attributed to bad actors, as well as anonymized metadata about users who interacted with them and analysis of the effect) is useful for intelligence analysis and public transparency, but will need similar muting or tagging/ shaming as associated with bad actors.

Internal MISP references

UUID 96e5e0dc-7cfd-5c3c-9bcd-40b14f2c7380 which can be used as unique global reference for Mute content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00085
kill_chain ['tactics:Develop Content', 'responsetypes:Disrupt', 'metatechniques:Daylight']
Related clusters

To see the related clusters, click here.

Distract from noise with addictive content

Example: Interject addictive links or contents into discussions of disinformation materials and measure a "conversion rate" of users who engage with your content and away from the social media channel's "information bubble" around the disinformation item. Use bots to amplify and upvote the addictive content.

Internal MISP references

UUID 2ab07267-614d-538b-8fef-bc6ed250a483 which can be used as unique global reference for Distract from noise with addictive content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00086
kill_chain ['tactics:Develop Content', 'responsetypes:Degrade', 'metatechniques:Diversion']
Related clusters

To see the related clusters, click here.

Make more noise than the disinformation

Internal MISP references

UUID 47ad777e-029c-5afa-9c37-50c3d86f3d39 which can be used as unique global reference for Make more noise than the disinformation in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00087
kill_chain ['tactics:Develop Content', 'responsetypes:Degrade', 'metatechniques:Dilution']
Related clusters

To see the related clusters, click here.

Fake engagement system

Create honeypots for misinformation creators to engage with, and reduce the resources they have available for misinformation campaigns.

Internal MISP references

UUID fd9e1e82-0c60-5bf6-a9a2-4f29ca6d39ba which can be used as unique global reference for Fake engagement system in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00090
kill_chain ['tactics:Select Channels and Affordances', 'responsetypes:Deceive', 'metatechniques:Diversion']
Related clusters

To see the related clusters, click here.

Honeypot social community

Set honeypots, e.g. communities, in networks likely to be used for disinformation.

Internal MISP references

UUID d3dabb18-e543-5295-be8f-f61cac2a5d99 which can be used as unique global reference for Honeypot social community in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00091
kill_chain ['tactics:Develop Content', 'responsetypes:Deceive', 'metatechniques:Diversion']
Related clusters

To see the related clusters, click here.

Establish a truth teller reputation score for influencers

Includes "Establish a truth teller reputation score for influencers” and “Reputation scores for social media users”. Influencers are individuals or accounts with many followers.

Internal MISP references

UUID 9167d3c2-1f91-58f1-9dc2-fbe948f6b31c which can be used as unique global reference for Establish a truth teller reputation score for influencers in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00092
kill_chain ['tactics:Plan Objectives', 'responsetypes:Deter', 'metatechniques:Scoring']
Related clusters

To see the related clusters, click here.

Influencer code of conduct

Establish tailored code of conduct for individuals with many followers. Can be platform code of conduct; can also be community code.

Internal MISP references

UUID 4a21e1e9-4601-5fd0-b713-747bfe498e76 which can be used as unique global reference for Influencer code of conduct in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00093
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Deter', 'metatechniques:Resilience']
Related clusters

To see the related clusters, click here.

Force full disclosure on corporate sponsor of research

Accountability move: make sure research is published with its funding sources.

Internal MISP references

UUID 25a7c801-c8e1-5977-8ac4-8795c30df5bc which can be used as unique global reference for Force full disclosure on corporate sponsor of research in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00094
kill_chain ['tactics:Develop Content', 'responsetypes:Degrade', 'metatechniques:Daylight']
Related clusters

To see the related clusters, click here.

Strengthen institutions that are always truth tellers

Increase credibility, visibility, and reach of positive influencers in the information space.

Internal MISP references

UUID 90ec53d1-ed62-516d-b530-49cb3e9e851c which can be used as unique global reference for Strengthen institutions that are always truth tellers in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00096
kill_chain ['tactics:Plan Strategy', 'responsetypes:Deter', 'metatechniques:Scoring']
Related clusters

To see the related clusters, click here.

Require use of verified identities to contribute to poll or comment

Reduce poll flooding by online taking comments or poll entries from verified accounts.

Internal MISP references

UUID 01b3516b-b8b1-5a56-ae24-5300cceb70f8 which can be used as unique global reference for Require use of verified identities to contribute to poll or comment in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00097
kill_chain ['tactics:Select Channels and Affordances', 'responsetypes:Deny', 'metatechniques:Friction']
Related clusters

To see the related clusters, click here.

Revocation of allowlisted or "verified" status

remove blue checkmarks etc from known misinformation accounts.

Internal MISP references

UUID eaef2d36-c5a8-59b9-9075-c6cdaa060e5d which can be used as unique global reference for Revocation of allowlisted or "verified" status in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00098
kill_chain ['tactics:Select Channels and Affordances', 'responsetypes:Deny', 'metatechniques:Friction']
Related clusters

To see the related clusters, click here.

Strengthen verification methods

Improve content veerification methods available to groups, individuals etc.

Internal MISP references

UUID 33d7f540-0adb-5ab5-ae09-1c7a20e125b1 which can be used as unique global reference for Strengthen verification methods in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00099
kill_chain ['tactics:Select Channels and Affordances', 'responsetypes:Deny', 'metatechniques:Friction']
Related clusters

To see the related clusters, click here.

Hashtag jacking

Post large volumes of unrelated content on known misinformation hashtags

Internal MISP references

UUID cb70bca8-f999-59cc-ac98-3868a695334a which can be used as unique global reference for Hashtag jacking in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00100
kill_chain ['tactics:Conduct Pump Priming', 'responsetypes:Disrupt', 'metatechniques:Diversion']
Related clusters

To see the related clusters, click here.

Create friction by rate-limiting engagement

Create participant friction. Includes Make repeat voting hard, and throttle number of forwards.

Internal MISP references

UUID a64a6568-d047-55b9-a3ab-f77fb3c9ada3 which can be used as unique global reference for Create friction by rate-limiting engagement in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00101
kill_chain ['tactics:Select Channels and Affordances', 'responsetypes:Degrade', 'metatechniques:Friction']
Related clusters

To see the related clusters, click here.

Create a bot that engages / distract trolls

This is reactive, not active measure (honeypots are active). It's a platform controlled measure.

Internal MISP references

UUID e21e17e9-3834-59de-bc31-9e43b73c8973 which can be used as unique global reference for Create a bot that engages / distract trolls in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00103
kill_chain ['tactics:Select Channels and Affordances', 'responsetypes:Deceive', 'metatechniques:Diversion']
Related clusters

To see the related clusters, click here.

Buy more advertising than misinformation creators

Shift influence and algorithms by posting more adverts into spaces than misinformation creators.

Internal MISP references

UUID 4880efa6-1123-5703-9c44-9f0600670dd9 which can be used as unique global reference for Buy more advertising than misinformation creators in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00105
kill_chain ['tactics:Select Channels and Affordances', 'responsetypes:Disrupt', 'metatechniques:Dilution']
Related clusters

To see the related clusters, click here.

Click-bait centrist content

Create emotive centrist content that gets more clicks

Internal MISP references

UUID d6182931-a76a-59e6-901e-f63b9f6d2301 which can be used as unique global reference for Click-bait centrist content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00106
kill_chain ['tactics:Develop Content', 'responsetypes:Disrupt', 'metatechniques:Diversion']
Related clusters

To see the related clusters, click here.

Content moderation

includes social media content take-downs, e.g. facebook or Twitter content take-downs

Internal MISP references

UUID e9cf452f-3ebc-5de8-9f21-dde3133c92c0 which can be used as unique global reference for Content moderation in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00107
kill_chain ['tactics:Develop Content', 'responsetypes:Deny', 'metatechniques:Scoring']
Related clusters

To see the related clusters, click here.

Dampen Emotional Reaction

Reduce emotional responses to misinformation through calming messages, etc.

Internal MISP references

UUID 5e6e3272-9320-5c12-a618-f82282b62cb9 which can be used as unique global reference for Dampen Emotional Reaction in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00109
kill_chain ['tactics:Deliver Content', 'responsetypes:Disrupt', 'metatechniques:Resilience']
Related clusters

To see the related clusters, click here.

Reduce polarisation by connecting and presenting sympathetic renditions of opposite views

Internal MISP references

UUID 686ccd43-c358-5d5d-bd42-3e2279151670 which can be used as unique global reference for Reduce polarisation by connecting and presenting sympathetic renditions of opposite views in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00111
kill_chain ['tactics:Plan Strategy', 'responsetypes:Degrade', 'metatechniques:Resilience']
Related clusters

To see the related clusters, click here.

"Prove they are not an op!"

Challenge misinformation creators to prove they're not an information operation.

Internal MISP references

UUID b942a92e-13d5-5726-92bd-4fb5531f381b which can be used as unique global reference for "Prove they are not an op!" in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00112
kill_chain ['tactics:Conduct Pump Priming', 'responsetypes:Deny', 'metatechniques:Friction']
Related clusters

To see the related clusters, click here.

Debunk and defuse a fake expert / credentials.

Debunk fake experts, their credentials, and potentially also their audience quality

Internal MISP references

UUID a44e7e6c-f6ca-5ea4-9fe8-6dc798b2d729 which can be used as unique global reference for Debunk and defuse a fake expert / credentials. in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00113
kill_chain ['tactics:Conduct Pump Priming', 'responsetypes:Deny', 'metatechniques:Daylight']
Related clusters

To see the related clusters, click here.

Don't engage with payloads

Stop passing on misinformation

Internal MISP references

UUID 1744386c-0d46-54a8-a5b8-cba1bd7dc369 which can be used as unique global reference for Don't engage with payloads in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00114
kill_chain ['tactics:Conduct Pump Priming', 'responsetypes:Deny', 'metatechniques:Friction']
Related clusters

To see the related clusters, click here.

Expose actor and intentions

Debunk misinformation creators and posters.

Internal MISP references

UUID 51187e2c-cb58-59ac-900b-54b073dc4c1f which can be used as unique global reference for Expose actor and intentions in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00115
kill_chain ['tactics:Conduct Pump Priming', 'responsetypes:Deny', 'metatechniques:Daylight']
Related clusters

To see the related clusters, click here.

Provide proof of involvement

Build and post information about groups etc's involvement in misinformation incidents.

Internal MISP references

UUID 03816f11-e296-594b-8e7a-441629d9252c which can be used as unique global reference for Provide proof of involvement in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00116
kill_chain ['tactics:Conduct Pump Priming', 'responsetypes:Deny', 'metatechniques:Daylight']
Related clusters

To see the related clusters, click here.

Downgrade / de-amplify so message is seen by fewer people

Label promote counter to disinformation

Internal MISP references

UUID 5b9a74d0-bfa6-5bb9-9297-3938c067f783 which can be used as unique global reference for Downgrade / de-amplify so message is seen by fewer people in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00117
kill_chain ['tactics:Conduct Pump Priming', 'responsetypes:Degrade', 'metatechniques:Countermessaging']
Related clusters

To see the related clusters, click here.

Repurpose images with new text

Add countermessage text to iamges used in misinformation incidents.

Internal MISP references

UUID 3ce6759d-b144-5277-9798-2df09ce9a6c9 which can be used as unique global reference for Repurpose images with new text in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00118
kill_chain ['tactics:Conduct Pump Priming', 'responsetypes:Degrade', 'metatechniques:Countermessaging']
Related clusters

To see the related clusters, click here.

Engage payload and debunk.

debunk misinformation content. Provide link to facts.

Internal MISP references

UUID cbba0c79-9287-5ead-a70a-34f740b4325f which can be used as unique global reference for Engage payload and debunk. in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00119
kill_chain ['tactics:Conduct Pump Priming', 'responsetypes:Deter', 'metatechniques:Countermessaging']
Related clusters

To see the related clusters, click here.

Open dialogue about design of platforms to produce different outcomes

Redesign platforms and algorithms to reduce the effectiveness of disinformation

Internal MISP references

UUID 0eb2eaf4-0c53-527d-8744-70670f6a9736 which can be used as unique global reference for Open dialogue about design of platforms to produce different outcomes in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00120
kill_chain ['tactics:Conduct Pump Priming', 'responsetypes:Deter', 'metatechniques:Metatechnique']
Related clusters

To see the related clusters, click here.

Tool transparency and literacy for channels people follow.

Make algorithms in platforms explainable, and visible to people using those platforms.

Internal MISP references

UUID b8b49628-4c3d-528c-90f1-2fee8722e2c5 which can be used as unique global reference for Tool transparency and literacy for channels people follow. in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00121
kill_chain ['tactics:Conduct Pump Priming', 'responsetypes:Deter', 'metatechniques:Resilience']
Related clusters

To see the related clusters, click here.

Remove or rate limit botnets

reduce the visibility of known botnets online.

Internal MISP references

UUID 0280f954-5654-5d23-8dcf-a1f5334f3e6a which can be used as unique global reference for Remove or rate limit botnets in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00123
kill_chain ['tactics:Deliver Content', 'responsetypes:Disrupt', 'metatechniques:Friction']
Related clusters

To see the related clusters, click here.

Don't feed the trolls

Don't engage with individuals relaying misinformation.

Internal MISP references

UUID 8cfe6ea3-7271-5578-b4f7-8eb3edbe43f5 which can be used as unique global reference for Don't feed the trolls in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00124
kill_chain ['tactics:Deliver Content', 'responsetypes:Disrupt', 'metatechniques:Friction']
Related clusters

To see the related clusters, click here.

Prebunking

Produce material in advance of misinformation incidents, by anticipating the narratives used in them, and debunking them.

Internal MISP references

UUID 3ddf6174-2801-591b-a7e7-6529e75bc10e which can be used as unique global reference for Prebunking in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00125
kill_chain ['tactics:Deliver Content', 'responsetypes:Disrupt', 'metatechniques:Resilience']
Related clusters

To see the related clusters, click here.

Social media amber alert

Create an alert system around disinformation and misinformation artefacts, narratives, and incidents

Internal MISP references

UUID 933609cf-6195-506f-9fb1-b1e5778d45f4 which can be used as unique global reference for Social media amber alert in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00126
kill_chain ['tactics:Deliver Content', 'responsetypes:Disrupt', 'metatechniques:Daylight']
Related clusters

To see the related clusters, click here.

Create friction by marking content with ridicule or other "decelerants"

Repost or comment on misinformation artefacts, using ridicule or other content to reduce the likelihood of reposting.

Internal MISP references

UUID 67bab8b7-908b-5b0f-bf56-26502798d743 which can be used as unique global reference for Create friction by marking content with ridicule or other "decelerants" in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00128
kill_chain ['tactics:Deliver Content', 'responsetypes:Disrupt', 'metatechniques:Dilution']
Related clusters

To see the related clusters, click here.

Use banking to cut off access

fiscal sanctions; parallel to counter terrorism

Internal MISP references

UUID a6b2f9bc-47fd-5303-8df8-0bb4ae4f4cbd which can be used as unique global reference for Use banking to cut off access in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00129
kill_chain ['tactics:Deliver Content', 'responsetypes:Deny', 'metatechniques:Reduce Resources']
Related clusters

To see the related clusters, click here.

Mentorship: elders, youth, credit. Learn vicariously.

Train local influencers in countering misinformation.

Internal MISP references

UUID f99b442a-7c34-5c66-b699-64c3da69374c which can be used as unique global reference for Mentorship: elders, youth, credit. Learn vicariously. in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00130
kill_chain ['tactics:Microtarget', 'responsetypes:Deter', 'metatechniques:Resilience']
Related clusters

To see the related clusters, click here.

Seize and analyse botnet servers

Take botnet servers offline by seizing them.

Internal MISP references

UUID ae4b53ba-9dd6-53af-a624-d5929944117c which can be used as unique global reference for Seize and analyse botnet servers in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00131
kill_chain ['tactics:Persist in the Information Environment', 'responsetypes:Deny', 'metatechniques:Removal']
Related clusters

To see the related clusters, click here.

Deplatform Account*

Note: Similar to Deplatform People but less generic. Perhaps both should be left.

Internal MISP references

UUID 027421d5-7c11-5c13-aa91-5cf6a01b72ef which can be used as unique global reference for Deplatform Account* in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00133
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Disrupt', 'metatechniques:Removal']
Related clusters

To see the related clusters, click here.

Deplatform message groups and/or message boards

Merged two rows here.

Internal MISP references

UUID f3edf130-0096-5a49-a3f1-d97974a70494 which can be used as unique global reference for Deplatform message groups and/or message boards in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00135
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Disrupt', 'metatechniques:Removal']
Related clusters

To see the related clusters, click here.

Microtarget most likely targets then send them countermessages

Find communities likely to be targetted by misinformation campaigns, and send them countermessages or pointers to information sources.

Internal MISP references

UUID 636bef6a-d120-5f5e-9bc1-4b8af99b8e45 which can be used as unique global reference for Microtarget most likely targets then send them countermessages in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00136
kill_chain ['tactics:Conduct Pump Priming', 'responsetypes:Disrupt', 'metatechniques:Countermessaging']
Related clusters

To see the related clusters, click here.

Spam domestic actors with lawsuits

File multiple lawsuits against known misinformation creators and posters, to distract them from disinformation creation.

Internal MISP references

UUID 80730d54-1dd1-5da6-baae-052553fbf27f which can be used as unique global reference for Spam domestic actors with lawsuits in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00138
kill_chain ['tactics:Persist in the Information Environment', 'responsetypes:Disrupt', 'metatechniques:Reduce Resources']
Related clusters

To see the related clusters, click here.

Weaponise youtube content matrices

God knows what this is. Keeping temporarily in case we work it out.

Internal MISP references

UUID 93c6d14f-e6e3-535e-bc58-e2b95dd23b3c which can be used as unique global reference for Weaponise youtube content matrices in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00139
kill_chain ['tactics:Persist in the Information Environment', 'responsetypes:Disrupt', 'metatechniques:Friction']
Related clusters

To see the related clusters, click here.

Applies to most of the content used by exposure techniques except "T0055 - Use hashtag”. Applies to analytics

Internal MISP references

UUID 8274f8d0-0484-51cd-939d-4213ff7f8fca which can be used as unique global reference for "Bomb" link shorteners with lots of calls in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00140
kill_chain ['tactics:Assess Effectiveness', 'responsetypes:Disrupt', 'metatechniques:Data Pollution']
Related clusters

To see the related clusters, click here.

Platform adds warning label and decision point when sharing content

Includes “this has been disproved: do you want to forward it”. Includes “"Hey this story is old" popup when messaging with old URL” - this assumes that this technique is based on visits to an URL shortener or a captured news site that can publish a message of our choice. Includes “mark clickbait visually”.

Internal MISP references

UUID 0acbac2f-7bd4-51d1-aaac-e12cebcddb31 which can be used as unique global reference for Platform adds warning label and decision point when sharing content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00142
kill_chain ['tactics:Develop Content', 'responsetypes:Degrade', 'metatechniques:Friction']
Related clusters

To see the related clusters, click here.

(botnet) DMCA takedown requests to waste group time

Use copyright infringement claims to remove videos etc.

Internal MISP references

UUID 7ef86cff-4401-518b-92fc-a0d88c23f280 which can be used as unique global reference for (botnet) DMCA takedown requests to waste group time in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00143
kill_chain ['tactics:Persist in the Information Environment', 'responsetypes:Degrade', 'metatechniques:Targeting']
Related clusters

To see the related clusters, click here.

Buy out troll farm employees / offer them jobs

Degrade the infrastructure. Could e.g. pay to not act for 30 days. Not recommended

Internal MISP references

UUID bf9c0530-8f8e-5809-a751-5ea8317fd434 which can be used as unique global reference for Buy out troll farm employees / offer them jobs in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00144
kill_chain ['tactics:Plan Objectives', 'responsetypes:Degrade', 'metatechniques:Reduce Resources']
Related clusters

To see the related clusters, click here.

Make amplification of social media posts expire (e.g. can't like/ retweet after n days)

Stop new community activity (likes, comments) on old social media posts.

Internal MISP references

UUID 49f92a32-bac9-56af-ac97-3b09f23b8fa6 which can be used as unique global reference for Make amplification of social media posts expire (e.g. can't like/ retweet after n days) in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00147
kill_chain ['tactics:Deliver Content', 'responsetypes:Disrupt', 'metatechniques:Friction']
Related clusters

To see the related clusters, click here.

If creators are using network analysis to determine how to attack networks, then adding random extra links to those networks might throw that analysis out enough to change attack outcomes. Unsure which DISARM techniques.

Internal MISP references

UUID dcb94d22-45a2-5433-bc4c-634add96088b which can be used as unique global reference for Add random links to network graphs in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00148
kill_chain ['tactics:Assess Effectiveness', 'responsetypes:Degrade', 'metatechniques:Data Pollution']
Related clusters

To see the related clusters, click here.

Poison the monitoring & evaluation data

Includes Pollute the AB-testing data feeds: Polluting A/B testing requires knowledge of MOEs and MOPs. A/B testing must be caught early when there is relatively little data available so infiltration of TAs and understanding of how content is migrated from testing to larger audiences is fundamental.

Internal MISP references

UUID 864f56c1-d966-5b5a-8cc8-91bb4c57b518 which can be used as unique global reference for Poison the monitoring & evaluation data in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00149
kill_chain ['tactics:Assess Effectiveness', 'responsetypes:Degrade', 'metatechniques:Data Pollution']
Related clusters

To see the related clusters, click here.

Take pre-emptive action against actors' infrastructure

Align offensive cyber action with information operations and counter disinformation approaches, where appropriate.

Internal MISP references

UUID 22e5b817-e45b-5f41-8806-8e0c66f181cc which can be used as unique global reference for Take pre-emptive action against actors' infrastructure in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00153
kill_chain ['tactics:Plan Strategy', 'responsetypes:Disrupt', 'metatechniques:Targeting']
Related clusters

To see the related clusters, click here.

Ask media not to report false information

Train media to spot and respond to misinformation, and ask them not to post or transmit misinformation they've found.

Internal MISP references

UUID a1441814-0d69-5b19-9dae-64c61d7dfdbd which can be used as unique global reference for Ask media not to report false information in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00154
kill_chain ['tactics:Conduct Pump Priming', 'responsetypes:Deny', 'metatechniques:Removal']
Related clusters

To see the related clusters, click here.

Ban incident actors from funding sites

Ban misinformation creators and posters from funding sites

Internal MISP references

UUID 5b5c3e04-acf2-50dd-9861-c44bcc8f2cc3 which can be used as unique global reference for Ban incident actors from funding sites in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00155
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Deny', 'metatechniques:Removal']
Related clusters

To see the related clusters, click here.

Better tell your country or organisation story

Civil engagement activities conducted on the part of EFP forces. NATO should likewise provide support and training, where needed, to local public affairs and other communication personnel. Local government and military public affairs personnel can play their part in creating and disseminating entertaining and sharable content that supports the EFP mission.

Internal MISP references

UUID 877c29b5-38ae-570a-93b3-9e4e70ec27ef which can be used as unique global reference for Better tell your country or organisation story in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00156
kill_chain ['tactics:Plan Objectives', 'responsetypes:Disrupt', 'metatechniques:Countermessaging']
Related clusters

To see the related clusters, click here.

Have a disinformation response plan

e.g. Create a campaign plan and toolkit for competition short of armed conflict (this used to be called “the grey zone”). The campaign plan should account for own vulnerabilities and strengths, and not over-rely on any one tool of statecraft or line of effort. It will identify and employ a broad spectrum of national power to deter, compete, and counter (where necessary) other countries’ approaches, and will include understanding of own capabilities, capabilities of disinformation creators, and international standards of conduct to compete in, shrink the size, and ultimately deter use of competition short of armed conflict.

Internal MISP references

UUID 595e5d8a-7e41-5597-9375-86c7d703de29 which can be used as unique global reference for Have a disinformation response plan in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00159
kill_chain ['tactics:Plan Strategy', 'responsetypes:Disrupt', 'metatechniques:Metatechnique']
Related clusters

To see the related clusters, click here.

find and train influencers

Identify key influencers (e.g. use network analysis), then reach out to identified users and offer support, through either training or resources.

Internal MISP references

UUID 590350b9-2614-572b-825b-b2498ebf4c17 which can be used as unique global reference for find and train influencers in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00160
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Deny', 'metatechniques:Resilience']
Related clusters

To see the related clusters, click here.

Coalition Building with stakeholders and Third-Party Inducements

Advance coalitions across borders and sectors, spanning public and private, as well as foreign and domestic, divides. Improve mechanisms to collaborate, share information, and develop coordinated approaches with the private sector at home and allies and partners abroad.

Internal MISP references

UUID 047898ad-129f-5d18-9dea-985e7f68becd which can be used as unique global reference for Coalition Building with stakeholders and Third-Party Inducements in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00161
kill_chain ['tactics:Plan Strategy', 'responsetypes:Deter', 'metatechniques:Metatechnique']
Related clusters

To see the related clusters, click here.

Unravel/target the Potemkin villages

Kremlin’s narrative spin extends through constellations of “civil society” organisations, political parties, churches, and other actors. Moscow leverages think tanks, human rights groups, election observers, Eurasianist integration groups, and orthodox groups. A collection of Russian civil society organisations, such as the Federal Agency for the Commonwealth of Independent States Affairs, Compatriots Living Abroad, and International Humanitarian Cooperation, together receive at least US$100 million per year, in addition to government-organized nongovernmental organisations (NGOs), at least 150 of which are funded by Russian presidential grants totaling US$70 million per year.

Internal MISP references

UUID efd2cf88-94ba-5fdc-8611-660baf44b2e9 which can be used as unique global reference for Unravel/target the Potemkin villages in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00162
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Disrupt', 'metatechniques:Targeting']
Related clusters

To see the related clusters, click here.

compatriot policy

protect the interests of this population and, more importantly, influence the population to support pro-Russia causes and effectively influence the politics of its neighbours

Internal MISP references

UUID af04983d-8531-54df-a7c7-39e5ae6bb523 which can be used as unique global reference for compatriot policy in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00164
kill_chain ['tactics:Plan Objectives', 'responsetypes:Disrupt', 'metatechniques:Targeting']
Related clusters

To see the related clusters, click here.

Ensure integrity of official documents

e.g. for leaked legal documents, use court motions to limit future discovery actions

Internal MISP references

UUID 3ec1f2f8-fe7d-51bc-bdf1-9ec47cd1bb74 which can be used as unique global reference for Ensure integrity of official documents in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00165
kill_chain ['tactics:Develop Content', 'responsetypes:Deny', 'metatechniques:Friction']
Related clusters

To see the related clusters, click here.

develop a creative content hub

international donors will donate to a basket fund that will pay a committee of local experts who will, in turn, manage and distribute the money to Russian-language producers and broadcasters that pitch various projects.

Internal MISP references

UUID babb37b7-5b28-5ba4-8f08-5c7c271937c7 which can be used as unique global reference for develop a creative content hub in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00169
kill_chain ['tactics:Plan Objectives', 'responsetypes:Disrupt', 'metatechniques:Countermessaging']
Related clusters

To see the related clusters, click here.

elevate information as a critical domain of statecraft

Shift from reactive to proactive response, with priority on sharing relevant information with the public and mobilising private-sector engagement. Recent advances in data-driven technologies have elevated information as a source of power to influence the political and economic environment, to foster economic growth, to enable a decision-making advantage over competitors, and to communicate securely and quickly.

Internal MISP references

UUID a61e8719-f78b-58c0-8307-915bdfc5849a which can be used as unique global reference for elevate information as a critical domain of statecraft in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00170
kill_chain ['tactics:Plan Strategy', 'responsetypes:Disrupt', 'metatechniques:Metatechnique']
Related clusters

To see the related clusters, click here.

social media source removal

Removing accounts, pages, groups, e.g. facebook page removal

Internal MISP references

UUID b20e5c17-f2dd-5057-9af2-a9586e72de9e which can be used as unique global reference for social media source removal in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00172
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Deny', 'metatechniques:Removal']
Related clusters

To see the related clusters, click here.

Create a healthier news environment

Free and fair press: create bipartisan, patriotic commitment to press freedom. Note difference between news and editorialising. Build alternative news sources: create alternative local-language news sources to counter local-language propaganda outlets. Delegitimize the 24 hour news cycle. includes Provide an alternative to disinformation content by expanding and improving local content: Develop content that can displace geopolitically-motivated narratives in the entire media environment, both new and old media alike.

Internal MISP references

UUID b666fbe1-04de-547c-abc5-27786c948e50 which can be used as unique global reference for Create a healthier news environment in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00174
kill_chain ['tactics:Plan Strategy', 'responsetypes:Deny', 'metatechniques:Metatechnique']
Related clusters

To see the related clusters, click here.

Improve Coordination amongst stakeholders: public and private

Coordinated disinformation challenges are increasingly multidisciplinary, there are few organisations within the national security structures that are equipped with the broad-spectrum capability to effectively counter large-scale conflict short of war tactics in real-time. Institutional hurdles currently impede diverse subject matter experts, hailing from outside of the traditional national security and foreign policy disciplines (e.g., physical science, engineering, media, legal, and economics fields), from contributing to the direct development of national security countermeasures to emerging conflict short of war threat vectors. A Cognitive Security Action Group (CSAG), akin to the Counterterrorism Security Group (CSG), could drive interagency alignment across equivalents of DHS, DoS, DoD, Intelligence Community, and other implementing agencies, in areas including strategic narrative, and the nexus of cyber and information operations.

Internal MISP references

UUID fea19aab-9522-55bf-9608-addf7d6aaf8d which can be used as unique global reference for Improve Coordination amongst stakeholders: public and private in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00176
kill_chain ['tactics:Plan Strategy', 'responsetypes:Deter', 'metatechniques:Metatechnique']
Related clusters

To see the related clusters, click here.

Fill information voids with non-disinformation content

1) Pollute the data voids with wholesome content (Kittens! Babyshark!). 2) fill data voids with relevant information, e.g. increase Russian-language programming in areas subject to Russian disinformation.

Internal MISP references

UUID e9380fb8-fc55-5ac7-94ab-2af4c13b6361 which can be used as unique global reference for Fill information voids with non-disinformation content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00178
kill_chain ['tactics:Microtarget', 'responsetypes:Degrade', 'metatechniques:Dilution']
Related clusters

To see the related clusters, click here.

Redirection / malware detection/ remediation

Detect redirction or malware, then quarantine or delete.

Internal MISP references

UUID 14b886aa-c023-5a84-9605-e4a9cb22e4f4 which can be used as unique global reference for Redirection / malware detection/ remediation in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00182
kill_chain ['tactics:Deliver Content', 'responsetypes:Deny', 'metatechniques:Removal']
Related clusters

To see the related clusters, click here.

Media exposure

highlight misinformation activities and actors in media

Internal MISP references

UUID 2cd7227b-31be-5999-9f5f-927f9d8c3b6e which can be used as unique global reference for Media exposure in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00184
kill_chain ['tactics:Conduct Pump Priming', 'responsetypes:Degrade', 'metatechniques:Daylight']
Related clusters

To see the related clusters, click here.

Newsroom/Journalist training to counter influence moves

Includes SEO influence. Includes promotion of a “higher standard of journalism”: journalism training “would be helpful, especially for the online community. Includes Strengthen local media: Improve effectiveness of local media outlets.

Internal MISP references

UUID 5c8fc207-b237-58cc-bedd-024fea386a7a which can be used as unique global reference for Newsroom/Journalist training to counter influence moves in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00188
kill_chain ['tactics:Conduct Pump Priming', 'responsetypes:Disrupt', 'metatechniques:Resilience']
Related clusters

To see the related clusters, click here.

Ensure that platforms are taking down flagged accounts

Use ongoing analysis/monitoring of "flagged" profiles. Confirm whether platforms are actively removing flagged accounts, and raise pressure via e.g. government organisations to encourage removal

Internal MISP references

UUID 6151d77a-c3cf-5fc3-853d-dc96ddc34397 which can be used as unique global reference for Ensure that platforms are taking down flagged accounts in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00189
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Destroy', 'metatechniques:Daylight']
Related clusters

To see the related clusters, click here.

open engagement with civil society

Government open engagement with civil society as an independent check on government action and messaging. Government seeks to coordinate and synchronise narrative themes with allies and partners while calibrating action in cases where elements in these countries may have been co-opted by competitor nations. Includes “fight in the light”: Use leadership in the arts, entertainment, and media to highlight and build on fundamental tenets of democracy.

Internal MISP references

UUID 11380b67-28d8-5034-a79b-fbb6150ad302 which can be used as unique global reference for open engagement with civil society in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00190
kill_chain ['tactics:Plan Strategy', 'responsetypes:Disrupt', 'metatechniques:Resilience']
Related clusters

To see the related clusters, click here.

Redirect searches away from disinformation or extremist content

Use Google AdWords to identify instances in which people search Google about particular fake-news stories or propaganda themes. Includes Monetize centrist SEO by subsidising the difference in greater clicks towards extremist content.

Internal MISP references

UUID d12e5fda-c5d3-5cc5-806b-69edb56aac61 which can be used as unique global reference for Redirect searches away from disinformation or extremist content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00195
kill_chain ['tactics:Select Channels and Affordances', 'responsetypes:Deny', 'metatechniques:Diversion']
Related clusters

To see the related clusters, click here.

remove suspicious accounts

Standard reporting for false profiles (identity issues). Includes detecting hijacked accounts and reallocating them - if possible, back to original owners.

Internal MISP references

UUID 2fe43d88-db8f-5156-98fb-4b9db0e5fff3 which can be used as unique global reference for remove suspicious accounts in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00197
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Deny', 'metatechniques:Removal']
Related clusters

To see the related clusters, click here.

Respected figure (influencer) disavows misinfo

FIXIT: standardise language used for influencer/ respected figure.

Internal MISP references

UUID a479d596-6f66-53eb-ae24-d3a67536464f which can be used as unique global reference for Respected figure (influencer) disavows misinfo in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00200
kill_chain ['tactics:Deliver Content', 'responsetypes:Disrupt', 'metatechniques:Countermessaging']
Related clusters

To see the related clusters, click here.

Set data 'honeytraps'

Set honeytraps in content likely to be accessed for disinformation.

Internal MISP references

UUID 01c0791e-7aea-5949-80c4-d3164a914f39 which can be used as unique global reference for Set data 'honeytraps' in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00202
kill_chain ['tactics:Develop Content', 'responsetypes:Deny', 'metatechniques:Diversion']
Related clusters

To see the related clusters, click here.

Stop offering press credentials to propaganda outlets

Remove access to official press events from known misinformation actors.

Internal MISP references

UUID 3055e156-f234-5293-9ab2-d9761a620060 which can be used as unique global reference for Stop offering press credentials to propaganda outlets in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00203
kill_chain ['tactics:Establish Social Assets', 'responsetypes:Disrupt', 'metatechniques:Friction']
Related clusters

To see the related clusters, click here.

strong dialogue between the federal government and private sector to encourage better reporting

Increase civic resilience by partnering with business community to combat grey zone threats and ensuring adequate reporting and enforcement mechanisms.

Internal MISP references

UUID 9133c9a6-500e-537d-aaa8-be8c5da12a93 which can be used as unique global reference for strong dialogue between the federal government and private sector to encourage better reporting in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00205
kill_chain ['tactics:Plan Strategy', 'responsetypes:Disrupt', 'metatechniques:Metatechnique']
Related clusters

To see the related clusters, click here.

Internal MISP references

UUID e81b12d2-491b-534a-88bb-221ab2cbf828 which can be used as unique global reference for Run a competing disinformation campaign - not recommended in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00207
kill_chain ['tactics:Plan Objectives', 'responsetypes:Deter', 'metatechniques:Targeting']
Related clusters

To see the related clusters, click here.

Use humorous counter-narratives

Internal MISP references

UUID 4005deeb-3c1f-55e7-bf15-c6377169a4b6 which can be used as unique global reference for Use humorous counter-narratives in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00211
kill_chain ['tactics:Deliver Content', 'responsetypes:Disrupt', 'metatechniques:Countermessaging']
Related clusters

To see the related clusters, click here.

build public resilience by making civil society more vibrant

Increase public service experience, and support wider civics and history education.

Internal MISP references

UUID d00320eb-5cc4-52e1-ae09-8b2d79affda2 which can be used as unique global reference for build public resilience by making civil society more vibrant in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00212
kill_chain ['tactics:Plan Strategy', 'responsetypes:Disrupt', 'metatechniques:Resilience']
Related clusters

To see the related clusters, click here.

Use advertiser controls to stem flow of funds to bad actors

Prevent ad revenue going to disinformation domains

Internal MISP references

UUID bbb8b174-44b6-5f59-bcf0-eab169bc7be1 which can be used as unique global reference for Use advertiser controls to stem flow of funds to bad actors in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00216
kill_chain ['tactics:Microtarget', 'responsetypes:Deny', 'metatechniques:Reduce Resources']
Related clusters

To see the related clusters, click here.

Add metadata to content that’s out of the control of disinformation creators

Steganography. Adding date, signatures etc to stop issue of photo relabelling etc.

Internal MISP references

UUID e9f8066e-2148-5399-b1b6-741888755067 which can be used as unique global reference for Add metadata to content that’s out of the control of disinformation creators in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00219
kill_chain ['tactics:Develop Content', 'responsetypes:Degrade', 'metatechniques:Daylight']
Related clusters

To see the related clusters, click here.

Develop a monitoring and intelligence plan

Create a plan for misinformation and disinformation response, before it's needed. Include connections / contacts needed, expected counteremessages etc.

Internal MISP references

UUID 1a0acda9-1fd1-5e88-a39f-942c9427eb82 which can be used as unique global reference for Develop a monitoring and intelligence plan in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00220
kill_chain ['tactics:Plan Strategy', 'responsetypes:Disrupt', 'metatechniques:Metatechnique']
Related clusters

To see the related clusters, click here.

Run a disinformation red team, and design mitigation factors

Include PACE plans - Primary, Alternate, Contingency, Emergency

Internal MISP references

UUID 2d17ef98-4701-58c1-8352-e952b0d42954 which can be used as unique global reference for Run a disinformation red team, and design mitigation factors in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00221
kill_chain ['tactics:Plan Strategy', 'responsetypes:Disrupt', 'metatechniques:Metatechnique']
Related clusters

To see the related clusters, click here.

Tabletop simulations

Simulate misinformation and disinformation campaigns, and responses to them, before campaigns happen.

Internal MISP references

UUID a40936f8-d8ff-5956-a7fc-98f9ee02698b which can be used as unique global reference for Tabletop simulations in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00222
kill_chain ['tactics:Plan Objectives', 'responsetypes:Disrupt', 'metatechniques:Metatechnique']
Related clusters

To see the related clusters, click here.

Strengthen Trust in social media platforms

Improve trust in the misinformation responses from social media and other platforms. Examples include creating greater transparancy on their actions and algorithms.

Internal MISP references

UUID b21af50f-96cb-5c88-a6cf-f726c392778c which can be used as unique global reference for Strengthen Trust in social media platforms in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id C00223
kill_chain ['tactics:Plan Strategy', 'responsetypes:Disrupt', 'metatechniques:Resilience']
Related clusters

To see the related clusters, click here.