Skip to content

Techniques

DISARM is a framework designed for describing and understanding disinformation incidents.

Authors
Authors and/or Contributors
DISARM Project

Facilitate State Propaganda

Organise citizens around pro-state messaging. Coordinate paid or volunteer groups to push state propaganda.

Internal MISP references

UUID 782afafa-e997-571a-9b25-d04bb322480c which can be used as unique global reference for Facilitate State Propaganda in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0002
kill_chain ['tactics:Plan Objectives']
Related clusters

To see the related clusters, click here.

Leverage Existing Narratives

Use or adapt existing narrative themes, where narratives are the baseline stories of a target audience. Narratives form the bedrock of our worldviews. New information is understood through a process firmly grounded in this bedrock. If new information is not consitent with the prevailing narratives of an audience, it will be ignored. Effective campaigns will frame their misinformation in the context of these narratives. Highly effective campaigns will make extensive use of audience-appropriate archetypes and meta-narratives throughout their content creation and amplifiction practices.

Internal MISP references

UUID 689e65f1-d834-581a-adf2-4e8a96d32464 which can be used as unique global reference for Leverage Existing Narratives in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0003
kill_chain ['tactics:Develop Narratives']
Related clusters

To see the related clusters, click here.

Develop Competing Narratives

Advance competing narratives connected to same issue ie: on one hand deny incident while at same time expresses dismiss. Suppressing or discouraging narratives already spreading requires an alternative. The most simple set of narrative techniques in response would be the construction and promotion of contradictory alternatives centred on denial, deflection, dismissal, counter-charges, excessive standards of proof, bias in prohibition or enforcement, and so on. These competing narratives allow loyalists cover, but are less compelling to opponents and fence-sitters than campaigns built around existing narratives or highly explanatory master narratives. Competing narratives, as such, are especially useful in the "firehose of misinformation" approach.

Internal MISP references

UUID 73bfaf89-d10a-5515-83fb-bc5ba11f5a2a which can be used as unique global reference for Develop Competing Narratives in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0004
kill_chain ['tactics:Develop Narratives']
Related clusters

To see the related clusters, click here.

Create Inauthentic Social Media Pages and Groups

Create key social engineering assets needed to amplify content, manipulate algorithms, fool public and/or specific incident/campaign targets. Computational propaganda depends substantially on false perceptions of credibility and acceptance. By creating fake users and groups with a variety of interests and commitments, attackers can ensure that their messages both come from trusted sources and appear more widely adopted than they actually are.

Internal MISP references

UUID e3cbbc7a-da73-50fb-9893-4ce88edb211f which can be used as unique global reference for Create Inauthentic Social Media Pages and Groups in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0007
kill_chain ['tactics:Establish Social Assets']
Related clusters

To see the related clusters, click here.

Create Fake Experts

Stories planted or promoted in computational propaganda operations often make use of experts fabricated from whole cloth, sometimes specifically for the story itself.

Internal MISP references

UUID 29768133-b941-5974-ab10-c15bbb86e387 which can be used as unique global reference for Create Fake Experts in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0009
kill_chain ['tactics:Establish Legitimacy']
Related clusters

To see the related clusters, click here.

Utilise Academic/Pseudoscientific Justifications

Utilise Academic/Pseudoscientific Justifications

Internal MISP references

UUID 4c721f5a-101e-5b5e-b260-7b08b92eac83 which can be used as unique global reference for Utilise Academic/Pseudoscientific Justifications in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0009.001
kill_chain ['tactics:Establish Legitimacy']

Cultivate Ignorant Agents

Cultivate propagandists for a cause, the goals of which are not fully comprehended, and who are used cynically by the leaders of the cause. Independent actors use social media and specialised web sites to strategically reinforce and spread messages compatible with their own. Their networks are infiltrated and used by state media disinformation organisations to amplify the state’s own disinformation strategies against target populations. Many are traffickers in conspiracy theories or hoaxes, unified by a suspicion of Western governments and mainstream media. Their narratives, which appeal to leftists hostile to globalism and military intervention and nationalists against immigration, are frequently infiltrated and shaped by state-controlled trolls and altered news items from agencies such as RT and Sputnik. Also know as "useful idiots" or "unwitting agents".

Internal MISP references

UUID 39baec3d-f2ce-5fee-ba7d-3db7d6469946 which can be used as unique global reference for Cultivate Ignorant Agents in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0010
kill_chain ['tactics:Establish Social Assets']
Related clusters

To see the related clusters, click here.

Compromise Legitimate Accounts

Hack or take over legimate accounts to distribute misinformation or damaging content.

Internal MISP references

UUID d05396d6-9701-5ce3-a6cd-abff224310ae which can be used as unique global reference for Compromise Legitimate Accounts in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0011
kill_chain ['tactics:Establish Legitimacy']
Related clusters

To see the related clusters, click here.

Create Inauthentic Websites

Create media assets to support inauthentic organisations (e.g. think tank), people (e.g. experts) and/or serve as sites to distribute malware/launch phishing operations.

Internal MISP references

UUID 534951bc-8d1e-58be-b051-c9243eac96fb which can be used as unique global reference for Create Inauthentic Websites in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0013
kill_chain ['tactics:Establish Social Assets']
Related clusters

To see the related clusters, click here.

Prepare Fundraising Campaigns

Fundraising campaigns refer to an influence operation’s systematic effort to seek financial support for a charity, cause, or other enterprise using online activities that further promote operation information pathways while raising a profit. Many influence operations have engaged in crowdfunding services on platforms including Tipee, Patreon, and GoFundMe. An operation may use its previously prepared fundraising campaigns (see: Develop Information Pathways) to promote operation messaging while raising money to support its activities.

Internal MISP references

UUID f0bb5056-fedb-5507-8554-c958ec8d9fdc which can be used as unique global reference for Prepare Fundraising Campaigns in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0014
kill_chain ['tactics:Establish Social Assets']
Related clusters

To see the related clusters, click here.

Raise Funds from Malign Actors

Raising funds from malign actors may include contributions from foreign agents, cutouts or proxies, shell companies, dark money groups, etc.

Internal MISP references

UUID d23f9cc0-058e-5354-b2c6-90e7b6737922 which can be used as unique global reference for Raise Funds from Malign Actors in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0014.001
kill_chain ['tactics:Establish Social Assets']

Raise Funds from Ignorant Agents

Raising funds from ignorant agents may include scams, donations intended for one stated purpose but then used for another, etc.

Internal MISP references

UUID dc89eee0-bf5e-51f0-957d-0e9e8a2cceff which can be used as unique global reference for Raise Funds from Ignorant Agents in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0014.002
kill_chain ['tactics:Establish Social Assets']

Create Hashtags and Search Artefacts

Create one or more hashtags and/or hashtag groups. Many incident-based campaigns will create hashtags to promote their fabricated event. Creating a hashtag for an incident can have two important effects: 1. Create a perception of reality around an event. Certainly only "real" events would be discussed in a hashtag. After all, the event has a name!, and 2. Publicise the story more widely through trending lists and search behaviour. Asset needed to direct/control/manage "conversation" connected to launching new incident/campaign with new hashtag for applicable social media sites).

Internal MISP references

UUID 6d3c1c71-746e-5e9d-9960-4845d712c899 which can be used as unique global reference for Create Hashtags and Search Artefacts in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0015
kill_chain ['tactics:Develop Content']
Related clusters

To see the related clusters, click here.

Create Clickbait

Create attention grabbing headlines (outrage, doubt, humour) required to drive traffic & engagement. This is a key asset.

Internal MISP references

UUID 9570ebf8-f69b-5064-a627-a19cb429d0f5 which can be used as unique global reference for Create Clickbait in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0016
kill_chain ['tactics:Microtarget']
Related clusters

To see the related clusters, click here.

Conduct Fundraising

Fundraising campaigns refer to an influence operation’s systematic effort to seek financial support for a charity, cause, or other enterprise using online activities that further promote operation information pathways while raising a profit. Many influence operations have engaged in crowdfunding services166 on platforms including Tipee, Patreon, and GoFundMe. An operation may use its previously prepared fundraising campaigns to promote operation messaging while raising money to support its activities.

Internal MISP references

UUID 7f21fe4b-d314-5511-a9b1-0b9fcfee8b5e which can be used as unique global reference for Conduct Fundraising in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0017
kill_chain ['tactics:Drive Offline Activity']
Related clusters

To see the related clusters, click here.

Conduct Crowdfunding Campaigns

An influence operation may Conduct Crowdfunding Campaigns on platforms such as GoFundMe, GiveSendGo, Tipeee, Patreon, etc.

Internal MISP references

UUID 999145bb-914b-5f7e-b47e-8756af2f5484 which can be used as unique global reference for Conduct Crowdfunding Campaigns in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0017.001
kill_chain ['tactics:Drive Offline Activity']

Purchase Targeted Advertisements

Create or fund advertisements targeted at specific populations

Internal MISP references

UUID 87208979-6982-53d5-ad0f-49cef659555c which can be used as unique global reference for Purchase Targeted Advertisements in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0018
kill_chain ['tactics:Microtarget']
Related clusters

To see the related clusters, click here.

Generate Information Pollution

Flood social channels; drive traffic/engagement to all assets; create aura/sense/perception of pervasiveness/consensus (for or against or both simultaneously) of an issue or topic. "Nothing is true, but everything is possible." Akin to astroturfing campaign.

Internal MISP references

UUID cb7d7a14-6e5c-503c-84b8-4a49e69b2627 which can be used as unique global reference for Generate Information Pollution in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0019
kill_chain ['tactics:Develop Content']
Related clusters

To see the related clusters, click here.

Create Fake Research

Create fake academic research. Example: fake social science research is often aimed at hot-button social issues such as gender, race and sexuality. Fake science research can target Climate Science debate or pseudoscience like anti-vaxx

Internal MISP references

UUID b2d72f4b-fa1f-5798-b075-f3f31320ce4d which can be used as unique global reference for Create Fake Research in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0019.001
kill_chain ['tactics:Develop Content']

Hijack Hashtags

Hashtag hijacking occurs when users “[use] a trending hashtag to promote topics that are substantially different from its recent context” (VanDam and Tan, 2016) or “to promote one’s own social media agenda” (Darius and Stephany, 2019).

Internal MISP references

UUID 7452c88a-f6ed-52b6-8fe4-25273bb5bc69 which can be used as unique global reference for Hijack Hashtags in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0019.002
kill_chain ['tactics:Develop Content']

Trial Content

Iteratively test incident performance (messages, content etc), e.g. A/B test headline/content enagagement metrics; website and/or funding campaign conversion rates

Internal MISP references

UUID 635f5592-0e2a-5f06-b164-c5af2ec9ef5e which can be used as unique global reference for Trial Content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0020
kill_chain ['tactics:Conduct Pump Priming']
Related clusters

To see the related clusters, click here.

Leverage Conspiracy Theory Narratives

"Conspiracy narratives" appeal to the human desire for explanatory order, by invoking the participation of poweful (often sinister) actors in pursuit of their own political goals. These narratives are especially appealing when an audience is low-information, marginalised or otherwise inclined to reject the prevailing explanation. Conspiracy narratives are an important component of the "firehose of falsehoods" model.

Internal MISP references

UUID f1d52ce1-f431-5732-a071-215cb3306f3e which can be used as unique global reference for Leverage Conspiracy Theory Narratives in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0022
kill_chain ['tactics:Develop Narratives']
Related clusters

To see the related clusters, click here.

Amplify Existing Conspiracy Theory Narratives

An influence operation may amplify an existing conspiracy theory narrative that aligns with its incident or campaign goals. By amplifying existing conspiracy theory narratives, operators can leverage the power of the existing communities that support and propagate those theories without needing to expend resources creating new narratives or building momentum and buy in around new narratives.

Internal MISP references

UUID f3c7a9c8-9196-5b2f-8d10-46ca31380987 which can be used as unique global reference for Amplify Existing Conspiracy Theory Narratives in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0022.001
kill_chain ['tactics:Develop Narratives']

Develop Original Conspiracy Theory Narratives

While this requires more resources than amplifying existing conspiracy theory narratives, an influence operation may develop original conspiracy theory narratives in order to achieve greater control and alignment over the narrative and their campaign goals. Prominent examples include the USSR's Operation INFEKTION disinformation campaign run by the KGB in the 1980s to plant the idea that the United States had invented HIV/AIDS as part of a biological weapons research project at Fort Detrick, Maryland. More recently, Fort Detrick featured prominently in a new conspiracy theory narratives around the origins of the COVID-19 outbreak and pandemic.

Internal MISP references

UUID b90838cb-7124-5f07-9fa6-94f0b5b21343 which can be used as unique global reference for Develop Original Conspiracy Theory Narratives in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0022.002
kill_chain ['tactics:Develop Narratives']

Distort Facts

Change, twist, or exaggerate existing facts to construct a narrative that differs from reality. Examples: images and ideas can be distorted by being placed in an improper content

Internal MISP references

UUID 1993a35d-d276-569b-ba66-66623f982dc4 which can be used as unique global reference for Distort Facts in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0023
kill_chain ['tactics:Develop Content']

Reframe Context

Reframing context refers to removing an event from its surrounding context to distort its intended meaning. Rather than deny that an event occurred, reframing context frames an event in a manner that may lead the target audience to draw a different conclusion about its intentions.

Internal MISP references

UUID c887503d-e5f5-5f06-a92a-9e50ec908eb6 which can be used as unique global reference for Reframe Context in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0023.001
kill_chain ['tactics:Develop Content']

Edit Open-Source Content

An influence operation may edit open-source content, such as collaborative blogs or encyclopaedias, to promote its narratives on outlets with existing credibility and audiences. Editing open-source content may allow an operation to post content on platforms without dedicating resources to the creation and maintenance of its own assets.

Internal MISP references

UUID b4984f13-619b-54a7-bf2c-acc5cdc01437 which can be used as unique global reference for Edit Open-Source Content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0023.002
kill_chain ['tactics:Develop Content']

Online Polls

Create fake online polls, or manipulate existing online polls. Data gathering tactic to target those who engage, and potentially their networks of friends/followers as well

Internal MISP references

UUID 1a8c4e8c-3543-5ab1-b4d0-939de9e7875f which can be used as unique global reference for Online Polls in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0029
kill_chain ['tactics:Select Channels and Affordances']
Related clusters

To see the related clusters, click here.

Bait Legitimate Influencers

Credibility in a social media environment is often a function of the size of a user's network. "Influencers" are so-called because of their reach, typically understood as: 1) the size of their network (i.e. the number of followers, perhaps weighted by their own influence); and 2) The rate at which their comments are re-circulated (these two metrics are related). Add traditional media players at all levels of credibility and professionalism to this, and the number of potential influencial carriers available for unwitting amplification becomes substantial. By targeting high-influence people and organisations in all types of media with narratives and content engineered to appeal their emotional or ideological drivers, influence campaigns are able to add perceived credibility to their messaging via saturation and adoption by trusted agents such as celebrities, journalists and local leaders.

Internal MISP references

UUID 53e8c51b-c178-5429-8cee-022c6741cc91 which can be used as unique global reference for Bait Legitimate Influencers in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0039
kill_chain ['tactics:Conduct Pump Priming']
Related clusters

To see the related clusters, click here.

Demand Insurmountable Proof

Campaigns often leverage tactical and informational asymmetries on the threat surface, as seen in the Distort and Deny strategies, and the "firehose of misinformation". Specifically, conspiracy theorists can be repeatedly wrong, but advocates of the truth need to be perfect. By constantly escalating demands for proof, propagandists can effectively leverage this asymmetry while also priming its future use, often with an even greater asymmetric advantage. The conspiracist is offered freer rein for a broader range of "questions" while the truth teller is burdened with higher and higher standards of proof.

Internal MISP references

UUID 70218fb2-3d85-5714-b990-2d18e345e184 which can be used as unique global reference for Demand Insurmountable Proof in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0040
kill_chain ['tactics:Develop Narratives']
Related clusters

To see the related clusters, click here.

Seed Kernel of Truth

Wrap lies or altered context/facts around truths. Influence campaigns pursue a variety of objectives with respect to target audiences, prominent among them: 1. undermine a narrative commonly referenced in the target audience; or 2. promote a narrative less common in the target audience, but preferred by the attacker. In both cases, the attacker is presented with a heavy lift. They must change the relative importance of various narratives in the interpretation of events, despite contrary tendencies. When messaging makes use of factual reporting to promote these adjustments in the narrative space, they are less likely to be dismissed out of hand; when messaging can juxtapose a (factual) truth about current affairs with the (abstract) truth explicated in these narratives, propagandists can undermine or promote them selectively. Context matters.

Internal MISP references

UUID ab4b4b44-5f15-5c92-934b-30cc73f67afc which can be used as unique global reference for Seed Kernel of Truth in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0042
kill_chain ['tactics:Conduct Pump Priming']

Chat Apps

Direct messaging via chat app is an increasing method of delivery. These messages are often automated and new delivery and storage methods make them anonymous, viral, and ephemeral. This is a difficult space to monitor, but also a difficult space to build acclaim or notoriety.

Internal MISP references

UUID ebd0aab4-013c-52fa-bae5-8fb3bd7704b8 which can be used as unique global reference for Chat Apps in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0043
kill_chain ['tactics:Select Channels and Affordances']
Related clusters

To see the related clusters, click here.

Use Encrypted Chat Apps

Examples include Signal, WhatsApp, Discord, Wire, etc.

Internal MISP references

UUID 7308289b-5875-5015-bead-adf63a552c28 which can be used as unique global reference for Use Encrypted Chat Apps in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0043.001
kill_chain ['tactics:Select Channels and Affordances']

Use Unencrypted Chats Apps

Examples include SMS, etc.

Internal MISP references

UUID 211e93c2-463a-5271-9384-61a6b8ca4af6 which can be used as unique global reference for Use Unencrypted Chats Apps in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0043.002
kill_chain ['tactics:Select Channels and Affordances']

Seed Distortions

Try a wide variety of messages in the early hours surrounding an incident or event, to give a misleading account or impression.

Internal MISP references

UUID 0fd25b71-ea11-51a3-bb18-545d5e818583 which can be used as unique global reference for Seed Distortions in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0044
kill_chain ['tactics:Conduct Pump Priming']
Related clusters

To see the related clusters, click here.

Use Fake Experts

Use the fake experts that were set up during Establish Legitimacy. Pseudo-experts are disposable assets that often appear once and then disappear. Give "credility" to misinformation. Take advantage of credential bias

Internal MISP references

UUID edc041f8-06ac-513a-a9f9-1353e38f3bcf which can be used as unique global reference for Use Fake Experts in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0045
kill_chain ['tactics:Conduct Pump Priming']
Related clusters

To see the related clusters, click here.

Use Search Engine Optimisation

Manipulate content engagement metrics (ie: Reddit & Twitter) to influence/impact news search results (e.g. Google), also elevates RT & Sputnik headline into Google news alert emails. aka "Black-hat SEO"

Internal MISP references

UUID 68c3a917-fed7-539e-9cf6-091153658ef2 which can be used as unique global reference for Use Search Engine Optimisation in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0046
kill_chain ['tactics:Conduct Pump Priming']
Related clusters

To see the related clusters, click here.

Censor Social Media as a Political Force

Use political influence or the power of state to stop critical social media comments. Government requested/driven content take downs (see Google Transperancy reports).

Internal MISP references

UUID deb56d12-fd4d-515a-9051-89a372d5d4bb which can be used as unique global reference for Censor Social Media as a Political Force in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0047
kill_chain ['tactics:Drive Online Harms']
Related clusters

To see the related clusters, click here.

Harass

Threatening or harassing believers of opposing narratives refers to the use of intimidation techniques, including cyberbullying and doxing, to discourage opponents from voicing their dissent. An influence operation may threaten or harass believers of the opposing narratives to deter individuals from posting or proliferating conflicting content.

Internal MISP references

UUID cb33d6fe-0327-58c1-93ad-10684fe9e099 which can be used as unique global reference for Harass in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0048
kill_chain ['tactics:Drive Online Harms']

Boycott/"Cancel" Opponents

Cancel culture refers to the phenomenon in which individuals collectively refrain from supporting an individual, organisation, business, or other entity, usually following a real or falsified controversy. An influence operation may exploit cancel culture by emphasising an adversary’s problematic or disputed behaviour and presenting its own content as an alternative.

Internal MISP references

UUID 65c98713-cae5-5ae4-ae17-5902d7d1cfc4 which can be used as unique global reference for Boycott/"Cancel" Opponents in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0048.001
kill_chain ['tactics:Drive Online Harms']

Harass People Based on Identities

Examples include social identities like gender, sexuality, race, ethnicity, religion, ability, nationality, etc. as well as roles and occupations like journalist or activist.

Internal MISP references

UUID a40e4177-42f2-5be2-89cf-1dd4eadaad13 which can be used as unique global reference for Harass People Based on Identities in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0048.002
kill_chain ['tactics:Drive Online Harms']

Threaten to Dox

Doxing refers to online harassment in which individuals publicly release private information about another individual, including names, addresses, employment information, pictures, family members, and other sensitive information. An influence operation may dox its opposition to encourage individuals aligned with operation narratives to harass the doxed individuals themselves or otherwise discourage the doxed individuals from posting or proliferating conflicting content.

Internal MISP references

UUID c1df0074-7e66-5b71-85cb-784b1be15c48 which can be used as unique global reference for Threaten to Dox in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0048.003
kill_chain ['tactics:Drive Online Harms']

Dox

Doxing refers to online harassment in which individuals publicly release private information about another individual, including names, addresses, employment information, pictures, family members, and other sensitive information. An influence operation may dox its opposition to encourage individuals aligned with operation narratives to harass the doxed individuals themselves or otherwise discourage the doxed individuals from posting or proliferating conflicting content.

Internal MISP references

UUID 18e83c9c-8e16-55e2-a013-63e583e79e8e which can be used as unique global reference for Dox in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0048.004
kill_chain ['tactics:Drive Online Harms']

Flooding the Information Space

Flooding and/or mobbing social media channels feeds and/or hashtag with excessive volume of content to control/shape online conversations and/or drown out opposing points of view. Bots and/or patriotic trolls are effective tools to acheive this effect.

Internal MISP references

UUID ee7bc41a-9eb0-5732-924a-3885e1c3bee9 which can be used as unique global reference for Flooding the Information Space in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0049
kill_chain ['tactics:Maximise Exposure']
Related clusters

To see the related clusters, click here.

Trolls Amplify and Manipulate

Use trolls to amplify narratives and/or manipulate narratives. Fake profiles/sockpuppets operating to support individuals/narratives from the entire political spectrum (left/right binary). Operating with increased emphasis on promoting local content and promoting real Twitter users generating their own, often divisive political content, as it's easier to amplify existing content than create new/original content. Trolls operate where ever there's a socially divisive issue (issues that can/are be politicized).

Internal MISP references

UUID b126047b-eafa-50aa-891a-31250d13f50e which can be used as unique global reference for Trolls Amplify and Manipulate in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0049.001
kill_chain ['tactics:Maximise Exposure']

Hijack Existing Hashtag

Take over an existing hashtag to drive exposure.

Internal MISP references

UUID 885e8687-3598-5378-b0bf-f09b67c1696e which can be used as unique global reference for Hijack Existing Hashtag in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0049.002
kill_chain ['tactics:Maximise Exposure']

Bots Amplify via Automated Forwarding and Reposting

Automated forwarding and reposting refer to the proliferation of operation content using automated means, such as artificial intelligence or social media bots. An influence operation may use automated activity to increase content exposure without dedicating the resources, including personnel and time, traditionally required to forward and repost content. Use bots to amplify narratives above algorithm thresholds. Bots are automated/programmed profiles designed to amplify content (ie: automatically retweet or like) and give appearance it's more "popular" than it is. They can operate as a network, to function in a coordinated/orchestrated manner. In some cases (more so now) they are an inexpensive/disposable assets used for minimal deployment as bot detection tools improve and platforms are more responsive.

Internal MISP references

UUID 78bd9a95-4aa4-5595-90de-839c65ff6542 which can be used as unique global reference for Bots Amplify via Automated Forwarding and Reposting in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0049.003
kill_chain ['tactics:Maximise Exposure']

Utilise Spamoflauge

Spamoflauge refers to the practice of disguising spam messages as legitimate. Spam refers to the use of electronic messaging systems to send out unrequested or unwanted messages in bulk. Simple methods of spamoflauge include replacing letters with numbers to fool keyword-based email spam filters, for example, "you've w0n our jackp0t!". Spamoflauge may extend to more complex techniques such as modifying the grammar or word choice of the language, casting messages as images which spam detectors cannot automatically read, or encapsulating messages in password protected attachments, such as .pdf or .zip files. Influence operations may use spamoflauge to avoid spam filtering systems and increase the likelihood of the target audience receiving operation messaging.

Internal MISP references

UUID 36635199-0794-5cba-b494-5b54ebd0ca73 which can be used as unique global reference for Utilise Spamoflauge in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0049.004
kill_chain ['tactics:Maximise Exposure']

Conduct Swarming

Swarming refers to the coordinated use of accounts to overwhelm the information space with operation content. Unlike information flooding, swarming centres exclusively around a specific event or actor rather than a general narrative. Swarming relies on “horizontal communication” between information assets rather than a top-down, vertical command-and-control approach.

Internal MISP references

UUID b25835fd-4936-580f-9e40-03728f38badf which can be used as unique global reference for Conduct Swarming in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0049.005
kill_chain ['tactics:Maximise Exposure']

Conduct Keyword Squatting

Keyword squatting refers to the creation of online content, such as websites, articles, or social media accounts, around a specific search engine-optimized term to overwhelm the search results of that term. An influence may keyword squat to increase content exposure to target audience members who query the exploited term in a search engine and manipulate the narrative around the term.

Internal MISP references

UUID 864a3b1d-6a1f-50b0-adef-e46cc4a88933 which can be used as unique global reference for Conduct Keyword Squatting in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0049.006
kill_chain ['tactics:Maximise Exposure']

Inauthentic Sites Amplify News and Narratives

Inauthentic sites circulate cross-post stories and amplify narratives. Often these sites have no masthead, bylines or attribution.

Internal MISP references

UUID d8a87575-9e25-5e93-8bf6-8489fe70b864 which can be used as unique global reference for Inauthentic Sites Amplify News and Narratives in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0049.007
kill_chain ['tactics:Maximise Exposure']

Organise Events

Coordinate and promote real-world events across media platforms, e.g. rallies, protests, gatherings in support of incident narratives.

Internal MISP references

UUID 26c314bb-ed05-5dbe-b672-c16c2f0fff52 which can be used as unique global reference for Organise Events in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0057
kill_chain ['tactics:Drive Offline Activity']
Related clusters

To see the related clusters, click here.

Pay for Physical Action

Paying for physical action occurs when an influence operation pays individuals to act in the physical realm. An influence operation may pay for physical action to create specific situations and frame them in a way that supports operation narratives, for example, paying a group of people to burn a car to later post an image of the burning car and frame it as an act of protest.

Internal MISP references

UUID c4f3903c-0a5f-5764-ab76-a7d3a4ee0afb which can be used as unique global reference for Pay for Physical Action in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0057.001
kill_chain ['tactics:Drive Offline Activity']

Conduct Symbolic Action

Symbolic action refers to activities specifically intended to advance an operation’s narrative by signalling something to the audience, for example, a military parade supporting a state’s narrative of military superiority. An influence operation may use symbolic action to create falsified evidence supporting operation narratives in the physical information space.

Internal MISP references

UUID 055b66cb-0745-5f85-83c9-d9fb8e1684a2 which can be used as unique global reference for Conduct Symbolic Action in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0057.002
kill_chain ['tactics:Drive Offline Activity']

Play the Long Game

Play the long game refers to two phenomena: 1. To plan messaging and allow it to grow organically without conducting your own amplification. This is methodical and slow and requires years for the message to take hold 2. To develop a series of seemingly disconnected messaging narratives that eventually combine into a new narrative.

Internal MISP references

UUID 2a8e8fa2-6ac4-5e0b-b1fb-818362987687 which can be used as unique global reference for Play the Long Game in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0059
kill_chain ['tactics:Persist in the Information Environment']

Continue to Amplify

continue narrative or message amplification after the main incident work has finished

Internal MISP references

UUID 6eb04152-8342-563a-9b9c-1e73aae2cc24 which can be used as unique global reference for Continue to Amplify in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0060
kill_chain ['tactics:Persist in the Information Environment']
Related clusters

To see the related clusters, click here.

Sell Merchandise

Sell mechandise refers to getting the message or narrative into physical space in the offline world while making money

Internal MISP references

UUID e9208787-0c74-5517-bdd5-add8476beb6a which can be used as unique global reference for Sell Merchandise in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0061
kill_chain ['tactics:Drive Offline Activity']

Prepare Physical Broadcast Capabilities

Create or coopt broadcast capabilities (e.g. TV, radio etc).

Internal MISP references

UUID 8c763ea9-83ee-5ea6-91bb-5ab0dd981006 which can be used as unique global reference for Prepare Physical Broadcast Capabilities in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0065
kill_chain ['tactics:Establish Social Assets']

Degrade Adversary

Plan to degrade an adversary’s image or ability to act. This could include preparation and use of harmful information about the adversary’s actions or reputation.

Internal MISP references

UUID 30e32d3b-ece9-545b-b74f-82861e22c133 which can be used as unique global reference for Degrade Adversary in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0066
kill_chain ['tactics:Plan Objectives']

Respond to Breaking News Event or Active Crisis

Media attention on a story or event is heightened during a breaking news event, where unclear facts and incomplete information increase speculation, rumours, and conspiracy theories, which are all vulnerable to manipulation.

Internal MISP references

UUID df8d3fc5-efd3-54bf-baef-eaa6ec375f0f which can be used as unique global reference for Respond to Breaking News Event or Active Crisis in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0068
kill_chain ['tactics:Develop Narratives']

Segment Audiences

Create audience segmentations by features of interest to the influence campaign, including political affiliation, geographic location, income, demographics, and psychographics.

Internal MISP references

UUID d9bbfde8-dda3-5f20-a9ed-fbf021ecd8c1 which can be used as unique global reference for Segment Audiences in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0072
kill_chain ['tactics:Target Audience Analysis']

Geographic Segmentation

An influence operation may target populations in a specific geographic location, such as a region, state, or city. An influence operation may use geographic segmentation to Create Localised Content (see: Establish Legitimacy).

Internal MISP references

UUID 3c3edffe-de30-5b0c-8005-8916dd92eb1e which can be used as unique global reference for Geographic Segmentation in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0072.001
kill_chain ['tactics:Target Audience Analysis']

Demographic Segmentation

An influence operation may target populations based on demographic segmentation, including age, gender, and income. Demographic segmentation may be useful for influence operations aiming to change state policies that affect a specific population sector. For example, an influence operation attempting to influence Medicare funding in the United States would likely target U.S. voters over 65 years of age.

Internal MISP references

UUID d19a9243-0fa0-5140-81c9-57442e8f7e25 which can be used as unique global reference for Demographic Segmentation in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0072.002
kill_chain ['tactics:Target Audience Analysis']

Economic Segmentation

An influence operation may target populations based on their income bracket, wealth, or other financial or economic division.

Internal MISP references

UUID 163b9226-7923-527f-802f-8865450db2f5 which can be used as unique global reference for Economic Segmentation in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0072.003
kill_chain ['tactics:Target Audience Analysis']

Psychographic Segmentation

An influence operation may target populations based on psychographic segmentation, which uses audience values and decision-making processes. An operation may individually gather psychographic data with its own surveys or collection tools or externally purchase data from social media companies or online surveys, such as personality quizzes.

Internal MISP references

UUID 474e292b-e866-5871-9ab6-395cc5aaa097 which can be used as unique global reference for Psychographic Segmentation in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0072.004
kill_chain ['tactics:Target Audience Analysis']

Political Segmentation

An influence operation may target populations based on their political affiliations, especially when aiming to manipulate voting or change policy.

Internal MISP references

UUID 77ab671a-d532-50b7-ac02-2008d331164f which can be used as unique global reference for Political Segmentation in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0072.005
kill_chain ['tactics:Target Audience Analysis']

Determine Target Audiences

Determining the target audiences (segments of the population) who will receive campaign narratives and artefacts intended to achieve the strategic ends.

Internal MISP references

UUID 872a110b-66ad-5854-aae5-a9725d227a5c which can be used as unique global reference for Determine Target Audiences in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0073
kill_chain ['tactics:Plan Strategy']

Determine Strategic Ends

These are the long-term end-states the campaign aims to bring about. They typically involve an advantageous position vis-a-vis competitors in terms of power or influence. The strategic goal may be to improve or simply to hold one’s position. Competition occurs in the public sphere in the domains of war, diplomacy, politics, economics, and ideology, and can play out between armed groups, nation-states, political parties, corporations, interest groups, or individuals.

Internal MISP references

UUID d88805d4-273a-50fb-a24a-63df92592e20 which can be used as unique global reference for Determine Strategic Ends in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0074
kill_chain ['tactics:Plan Strategy']

Geopolitical Advantage

Favourable position on the international stage in terms of great power politics or regional rivalry. Geopolitics plays out in the realms of foreign policy, national security, diplomacy, and intelligence. It involves nation-state governments, heads of state, foreign ministers, intergovernmental organisations, and regional security alliances.

Internal MISP references

UUID 3c362b89-6b61-5ea9-ba32-4873594ee92d which can be used as unique global reference for Geopolitical Advantage in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0074.001
kill_chain ['tactics:Plan Strategy']

Domestic Political Advantage

Favourable position vis-à-vis national or sub-national political opponents such as political parties, interest groups, politicians, candidates.

Internal MISP references

UUID a3ba0d23-3e22-5fb3-a4fd-074ab5bdc05a which can be used as unique global reference for Domestic Political Advantage in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0074.002
kill_chain ['tactics:Plan Strategy']

Economic Advantage

Favourable position domestically or internationally in the realms of commerce, trade, finance, industry. Economics involves nation-states, corporations, banks, trade blocs, industry associations, cartels.

Internal MISP references

UUID 9fc9578f-db6c-5505-ac66-dbdb6e887c6f which can be used as unique global reference for Economic Advantage in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0074.003
kill_chain ['tactics:Plan Strategy']

Ideological Advantage

Favourable position domestically or internationally in the market for ideas, beliefs, and world views. Competition plays out among faith systems, political systems, and value systems. It can involve sub-national, national or supra-national movements.

Internal MISP references

UUID c3156aaf-caf1-5188-836c-d5742cfc89fa which can be used as unique global reference for Ideological Advantage in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0074.004
kill_chain ['tactics:Plan Strategy']

Dismiss

Push back against criticism by dismissing your critics. This might be arguing that the critics use a different standard for you than with other actors or themselves; or arguing that their criticism is biassed.

Internal MISP references

UUID 3c33a91e-af4c-545d-bf54-a15fab753a11 which can be used as unique global reference for Dismiss in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0075
kill_chain ['tactics:Plan Objectives']

Discredit Credible Sources

Plan to delegitimize the media landscape and degrade public trust in reporting, by discrediting credible sources. This makes it easier to promote influence operation content.

Internal MISP references

UUID be2a0989-a95f-5961-ba7d-0597078dca96 which can be used as unique global reference for Discredit Credible Sources in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0075.001
kill_chain ['tactics:Plan Objectives']

Distort

Twist the narrative. Take information, or artefacts like images, and change the framing around them.

Internal MISP references

UUID bd75892f-b84d-5b36-b2d9-34832832296b which can be used as unique global reference for Distort in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0076
kill_chain ['tactics:Plan Objectives']

Distract

Shift attention to a different narrative or actor, for instance by accusing critics of the same activity that they’ve accused you of (e.g. police brutality).

Internal MISP references

UUID 8c807754-1267-5662-99f4-02461410cb3d which can be used as unique global reference for Distract in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0077
kill_chain ['tactics:Plan Objectives']

Dismay

Threaten the critic or narrator of events. For instance, threaten journalists or news outlets reporting on a story.

Internal MISP references

UUID 28400a1a-58f1-51ee-9e96-2c763279b990 which can be used as unique global reference for Dismay in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0078
kill_chain ['tactics:Plan Objectives']

Divide

Create conflict between subgroups, to widen divisions in a community

Internal MISP references

UUID 45926a30-7c89-5c14-bf7b-86f8c9597d15 which can be used as unique global reference for Divide in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0079
kill_chain ['tactics:Plan Objectives']

Map Target Audience Information Environment

Mapping the target audience information environment analyses the information space itself, including social media analytics, web traffic, and media surveys. Mapping the information environment may help the influence operation determine the most realistic and popular information channels to reach its target audience. Mapping the target audience information environment aids influence operations in determining the most vulnerable areas of the information space to target with messaging.

Internal MISP references

UUID 649af4be-031b-55db-ab45-d82b3cec27c2 which can be used as unique global reference for Map Target Audience Information Environment in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0080
kill_chain ['tactics:Target Audience Analysis']

Monitor Social Media Analytics

An influence operation may use social media analytics to determine which factors will increase the operation content’s exposure to its target audience on social media platforms, including views, interactions, and sentiment relating to topics and content types. The social media platform itself or a third-party tool may collect the metrics.

Internal MISP references

UUID a20c76bd-0b45-53f6-8cc5-6bc8a17289cf which can be used as unique global reference for Monitor Social Media Analytics in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0080.001
kill_chain ['tactics:Target Audience Analysis']

Evaluate Media Surveys

An influence operation may evaluate its own or third-party media surveys to determine what type of content appeals to its target audience. Media surveys may provide insight into an audience’s political views, social class, general interests, or other indicators used to tailor operation messaging to its target audience.

Internal MISP references

UUID af0acad2-7020-56cb-9775-56f03bad5bcf which can be used as unique global reference for Evaluate Media Surveys in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0080.002
kill_chain ['tactics:Target Audience Analysis']

An influence operation may identify trending hashtags on social media platforms for later use in boosting operation content. A hashtag40 refers to a word or phrase preceded by the hash symbol (#) on social media used to identify messages and posts relating to a specific topic. All public posts that use the same hashtag are aggregated onto a centralised page dedicated to the word or phrase and sorted either chronologically or by popularity.

Internal MISP references

UUID 269f9f9a-c8a4-5b68-8bf7-f09dd1dbd393 which can be used as unique global reference for Identify Trending Topics/Hashtags in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0080.003
kill_chain ['tactics:Target Audience Analysis']

Conduct Web Traffic Analysis

An influence operation may conduct web traffic analysis to determine which search engines, keywords, websites, and advertisements gain the most traction with its target audience.

Internal MISP references

UUID 8be163d6-9e22-5749-a11c-e1184ec64d33 which can be used as unique global reference for Conduct Web Traffic Analysis in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0080.004
kill_chain ['tactics:Target Audience Analysis']

Assess Degree/Type of Media Access

An influence operation may survey a target audience’s Internet availability and degree of media freedom to determine which target audience members will have access to operation content and on which platforms. An operation may face more difficulty targeting an information environment with heavy restrictions and media control than an environment with independent media, freedom of speech and of the press, and individual liberties.

Internal MISP references

UUID e5b33222-ed53-5da5-9d12-778741c209e2 which can be used as unique global reference for Assess Degree/Type of Media Access in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0080.005
kill_chain ['tactics:Target Audience Analysis']

Identify Social and Technical Vulnerabilities

Identifying social and technical vulnerabilities determines weaknesses within the target audience information environment for later exploitation. Vulnerabilities include decisive political issues, weak cybersecurity infrastructure, search engine data voids, and other technical and non technical weaknesses in the target information environment. Identifying social and technical vulnerabilities facilitates the later exploitation of the identified weaknesses to advance operation objectives.

Internal MISP references

UUID 6870e08f-8a82-592a-91be-71f732281a29 which can be used as unique global reference for Identify Social and Technical Vulnerabilities in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0081
kill_chain ['tactics:Target Audience Analysis']

Find Echo Chambers

Find or plan to create areas (social media groups, search term groups, hashtag groups etc) where individuals only engage with people they agree with.

Internal MISP references

UUID b6698222-4827-5b48-b0f4-b6d160cca97a which can be used as unique global reference for Find Echo Chambers in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0081.001
kill_chain ['tactics:Target Audience Analysis']

Identify Data Voids

A data void refers to a word or phrase that results in little, manipulative, or low-quality search engine data. Data voids are hard to detect and relatively harmless until exploited by an entity aiming to quickly proliferate false or misleading information during a phenomenon that causes a high number of individuals to query the term or phrase. In the Plan phase, an influence operation may identify data voids for later exploitation in the operation. A 2019 report by Michael Golebiewski identifies five types of data voids. (1) “Breaking news” data voids occur when a keyword gains popularity during a short period of time, allowing an influence operation to publish false content before legitimate news outlets have an opportunity to publish relevant information. (2) An influence operation may create a “strategic new terms” data void by creating their own terms and publishing information online before promoting their keyword to the target audience. (3) An influence operation may publish content on “outdated terms” that have decreased in popularity, capitalising on most search engines’ preferences for recency. (4) “Fragmented concepts” data voids separate connections between similar ideas, isolating segment queries to distinct search engine results. (5) An influence operation may use “problematic queries” that previously resulted in disturbing or inappropriate content to promote messaging until mainstream media recontextualizes the term.

Internal MISP references

UUID ab5b0e25-01fa-5a41-9ad8-7445034cf952 which can be used as unique global reference for Identify Data Voids in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0081.002
kill_chain ['tactics:Target Audience Analysis']

Identify Existing Prejudices

An influence operation may exploit existing racial, religious, demographic, or social prejudices to further polarise its target audience from the rest of the public.

Internal MISP references

UUID 0eefce18-09c4-513b-85a7-4441aa5df105 which can be used as unique global reference for Identify Existing Prejudices in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0081.003
kill_chain ['tactics:Target Audience Analysis']

Identify Existing Fissures

An influence operation may identify existing fissures to pit target populations against one another or facilitate a “divide-and-conquer" approach to tailor operation narratives along the divides.

Internal MISP references

UUID b3e586f5-98e3-556c-8d00-2d5be1482438 which can be used as unique global reference for Identify Existing Fissures in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0081.004
kill_chain ['tactics:Target Audience Analysis']

Identify Existing Conspiracy Narratives/Suspicions

An influence operation may assess preexisting conspiracy theories or suspicions in a population to identify existing narratives that support operational objectives.

Internal MISP references

UUID eb4cc97e-5620-5bf9-9b8b-1d6f5e00f81d which can be used as unique global reference for Identify Existing Conspiracy Narratives/Suspicions in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0081.005
kill_chain ['tactics:Target Audience Analysis']

Identify Wedge Issues

A wedge issue is a divisive political issue, usually concerning a social phenomenon, that divides individuals along a defined line. An influence operation may exploit wedge issues by intentionally polarising the public along the wedge issue line and encouraging opposition between factions.

Internal MISP references

UUID ac3f406b-c1dc-561a-ad27-c65c22a3a321 which can be used as unique global reference for Identify Wedge Issues in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0081.006
kill_chain ['tactics:Target Audience Analysis']

Identify Target Audience Adversaries

An influence operation may identify or create a real or imaginary adversary to centre operation narratives against. A real adversary may include certain politicians or political parties while imaginary adversaries may include falsified “deep state”62 actors that, according to conspiracies, run the state behind public view.

Internal MISP references

UUID 302d5e0a-375a-5fc6-a1da-0b33c9268af6 which can be used as unique global reference for Identify Target Audience Adversaries in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0081.007
kill_chain ['tactics:Target Audience Analysis']

Identify Media System Vulnerabilities

An influence operation may exploit existing weaknesses in a target’s media system. These weaknesses may include existing biases among media agencies, vulnerability to false news agencies on social media, or existing distrust of traditional media sources. An existing distrust among the public in the media system’s credibility holds high potential for exploitation by an influence operation when establishing alternative news agencies to spread operation content.

Internal MISP references

UUID 662f0d37-b90a-559f-8685-fa06a69be1cb which can be used as unique global reference for Identify Media System Vulnerabilities in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0081.008
kill_chain ['tactics:Target Audience Analysis']

Develop New Narratives

Actors may develop new narratives to further strategic or tactical goals, especially when existing narratives adequately align with the campaign goals. New narratives provide more control in terms of crafting the message to achieve specific goals. However, new narratives may require more effort to disseminate than adapting or adopting existing narratives.

Internal MISP references

UUID 4896a448-be51-5423-89cd-efb6444b1c75 which can be used as unique global reference for Develop New Narratives in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0082
kill_chain ['tactics:Develop Narratives']

Integrate Target Audience Vulnerabilities into Narrative

An influence operation may seek to exploit the preexisting weaknesses, fears, and enemies of the target audience for integration into the operation’s narratives and overall strategy. Integrating existing vulnerabilities into the operational approach conserves resources by exploiting already weak areas of the target information environment instead of forcing the operation to create new vulnerabilities in the environment.

Internal MISP references

UUID f78a066b-d01b-5f14-8327-4e2856a187d2 which can be used as unique global reference for Integrate Target Audience Vulnerabilities into Narrative in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0083
kill_chain ['tactics:Develop Narratives']

Reuse Existing Content

When an operation recycles content from its own previous operations or plagiarises from external operations. An operation may launder information to conserve resources that would have otherwise been utilised to develop new content.

Internal MISP references

UUID 7828596a-f1b5-563c-bd40-4a876b5cec58 which can be used as unique global reference for Reuse Existing Content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0084
kill_chain ['tactics:Develop Content']

Use Copypasta

Copypasta refers to a piece of text that has been copied and pasted multiple times across various online platforms. A copypasta’s final form may differ from its original source text as users add, delete, or otherwise edit the content as they repost the text.

Internal MISP references

UUID dba75e23-c7f8-504d-83a7-5771148e5951 which can be used as unique global reference for Use Copypasta in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0084.001
kill_chain ['tactics:Develop Content']

Plagiarise Content

An influence operation may take content from other sources without proper attribution. This content may be either misinformation content shared by others without malicious intent but now leveraged by the campaign as disinformation or disinformation content from other sources.

Internal MISP references

UUID 33787c2e-55c8-54a4-9d2d-541a35b5932e which can be used as unique global reference for Plagiarise Content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0084.002
kill_chain ['tactics:Develop Content']

Deceptively Labelled or Translated

An influence operation may take authentic content from other sources and add deceptive labels or deceptively translate the content into other langauges.

Internal MISP references

UUID a1f69093-a97c-561e-80ec-da8c93004205 which can be used as unique global reference for Deceptively Labelled or Translated in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0084.003
kill_chain ['tactics:Develop Content']

Appropriate Content

An influence operation may take content from other sources with proper attribution. This content may be either misinformation content shared by others without malicious intent but now leveraged by the campaign as disinformation or disinformation content from other sources. Examples include the appropriation of content from one inauthentic news site to another inauthentic news site or network in ways that align with the originators licencing or terms of service.

Internal MISP references

UUID f941e002-c556-5621-a80e-c52a38c54bc9 which can be used as unique global reference for Appropriate Content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0084.004
kill_chain ['tactics:Develop Content']

Develop Text-Based Content

Creating and editing false or misleading text-based artefacts, often aligned with one or more specific narratives, for use in a disinformation campaign.

Internal MISP references

UUID bff9c590-c655-5c15-ae4d-13d353a0d9a4 which can be used as unique global reference for Develop Text-Based Content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0085
kill_chain ['tactics:Develop Content']

Develop AI-Generated Text

AI-generated texts refers to synthetic text composed by computers using text-generating AI technology. Autonomous generation refers to content created by a bot without human input, also known as bot-created content generation. Autonomous generation represents the next step in automation after language generation and may lead to automated journalism. An influence operation may use read fakes or autonomous generation to quickly develop and distribute content to the target audience.

Internal MISP references

UUID ed3754e6-bc15-5cf0-8a4b-8737b3814225 which can be used as unique global reference for Develop AI-Generated Text in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0085.001
kill_chain ['tactics:Develop Content']

Develop False or Altered Documents

Develop False or Altered Documents

Internal MISP references

UUID 5b0d1b23-0b48-5f67-8fb4-fe4430f30990 which can be used as unique global reference for Develop False or Altered Documents in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0085.002
kill_chain ['tactics:Develop Content']

Develop Inauthentic News Articles

An influence operation may develop false or misleading news articles aligned to their campaign goals or narratives.

Internal MISP references

UUID 7bbdfe14-8294-54f7-9842-449f2db17a90 which can be used as unique global reference for Develop Inauthentic News Articles in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0085.003
kill_chain ['tactics:Develop Content']

Develop Image-Based Content

Creating and editing false or misleading visual artefacts, often aligned with one or more specific narratives, for use in a disinformation campaign. This may include photographing staged real-life situations, repurposing existing digital images, or using image creation and editing technologies.

Internal MISP references

UUID 9039269a-4975-52f8-92a8-f142978ffcef which can be used as unique global reference for Develop Image-Based Content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0086
kill_chain ['tactics:Develop Content']

Develop Memes

Memes are one of the most important single artefact types in all of computational propaganda. Memes in this framework denotes the narrow image-based definition. But that naming is no accident, as these items have most of the important properties of Dawkins' original conception as a self-replicating unit of culture. Memes pull together reference and commentary; image and narrative; emotion and message. Memes are a powerful tool and the heart of modern influence campaigns.

Internal MISP references

UUID 8c65e301-7dc0-5727-879b-288a643a992b which can be used as unique global reference for Develop Memes in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0086.001
kill_chain ['tactics:Develop Content']

Develop AI-Generated Images (Deepfakes)

Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual’s face, body, voice, and physical gestures.

Internal MISP references

UUID 0fa4f572-63c0-5a60-9e5e-2234e94f0ee6 which can be used as unique global reference for Develop AI-Generated Images (Deepfakes) in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0086.002
kill_chain ['tactics:Develop Content']

Deceptively Edit Images (Cheap Fakes)

Cheap fakes utilise less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.

Internal MISP references

UUID 69161c7b-a90f-5d96-a429-24a0d40d9973 which can be used as unique global reference for Deceptively Edit Images (Cheap Fakes) in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0086.003
kill_chain ['tactics:Develop Content']

Aggregate Information into Evidence Collages

Image files that aggregate positive evidence (Joan Donovan)

Internal MISP references

UUID b8a00aa5-9527-5128-a447-210d43bf11e2 which can be used as unique global reference for Aggregate Information into Evidence Collages in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0086.004
kill_chain ['tactics:Develop Content']

Develop Video-Based Content

Creating and editing false or misleading video artefacts, often aligned with one or more specific narratives, for use in a disinformation campaign. This may include staging videos of purportedly real situations, repurposing existing video artefacts, or using AI-generated video creation and editing technologies (including deepfakes).

Internal MISP references

UUID 97ef881f-9056-5390-8968-2b3d34d2cff8 which can be used as unique global reference for Develop Video-Based Content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0087
kill_chain ['tactics:Develop Content']

Develop AI-Generated Videos (Deepfakes)

Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual’s face, body, voice, and physical gestures.

Internal MISP references

UUID 7a3328b8-0998-5bcd-9646-1e0f593802eb which can be used as unique global reference for Develop AI-Generated Videos (Deepfakes) in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0087.001
kill_chain ['tactics:Develop Content']

Deceptively Edit Video (Cheap Fakes)

Cheap fakes utilise less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.

Internal MISP references

UUID 044465ed-375a-59b8-aece-347c73974cfb which can be used as unique global reference for Deceptively Edit Video (Cheap Fakes) in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0087.002
kill_chain ['tactics:Develop Content']

Develop Audio-Based Content

Creating and editing false or misleading audio artefacts, often aligned with one or more specific narratives, for use in a disinformation campaign. This may include creating completely new audio content, repurposing existing audio artefacts (including cheap fakes), or using AI-generated audio creation and editing technologies (including deepfakes).

Internal MISP references

UUID 32f31f65-b210-57f8-a4e6-396d6f9676f0 which can be used as unique global reference for Develop Audio-Based Content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0088
kill_chain ['tactics:Develop Content']

Develop AI-Generated Audio (Deepfakes)

Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual’s face, body, voice, and physical gestures.

Internal MISP references

UUID 96c96c0a-1e24-5b80-a7c2-2f31767c5fc3 which can be used as unique global reference for Develop AI-Generated Audio (Deepfakes) in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0088.001
kill_chain ['tactics:Develop Content']

Deceptively Edit Audio (Cheap Fakes)

Cheap fakes utilise less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.

Internal MISP references

UUID 482af0a0-50e3-57d6-99af-b8de290d1d00 which can be used as unique global reference for Deceptively Edit Audio (Cheap Fakes) in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0088.002
kill_chain ['tactics:Develop Content']

Obtain Private Documents

Procuring documents that are not publicly available, by whatever means -- whether legal or illegal, highly-resourced or less so. These documents can include authentic non-public documents, authentic non-public documents have been altered, or inauthentic documents intended to appear as if they are authentic non-public documents. All of these types of documents can be "leaked" during later stages in the operation.

Internal MISP references

UUID 31254ebe-90c8-5dc6-8ee2-2f27ceb732c3 which can be used as unique global reference for Obtain Private Documents in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0089
kill_chain ['tactics:Develop Content']

Obtain Authentic Documents

Procure authentic documents that are not publicly available, by whatever means -- whether legal or illegal, highly-resourced or less so. These documents can be "leaked" during later stages in the operation.

Internal MISP references

UUID 0ac164e0-f9ea-55a6-ab2b-8d8710f30b1c which can be used as unique global reference for Obtain Authentic Documents in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0089.001
kill_chain ['tactics:Develop Content']

Create Inauthentic Documents

Create inauthentic documents intended to appear as if they are authentic non-public documents. These documents can be "leaked" during later stages in the operation.

Internal MISP references

UUID da4180d9-4829-5e8d-a0d0-c33bbd22fbc0 which can be used as unique global reference for Create Inauthentic Documents in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0089.002
kill_chain ['tactics:Develop Content']

Alter Authentic Documents

Alter authentic documents (public or non-public) to achieve campaign goals. The altered documents are intended to appear as if they are authentic can be "leaked" during later stages in the operation.

Internal MISP references

UUID 8214610e-69c5-509d-9b04-a393cdc586ec which can be used as unique global reference for Alter Authentic Documents in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0089.003
kill_chain ['tactics:Develop Content']

Create Inauthentic Accounts

Inauthentic accounts include bot accounts, cyborg accounts, sockpuppet accounts, and anonymous accounts.

Internal MISP references

UUID fef2cb67-00a3-5141-88df-c3e6a2ae6d56 which can be used as unique global reference for Create Inauthentic Accounts in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0090
kill_chain ['tactics:Establish Social Assets']

Create Anonymous Accounts

Anonymous accounts or anonymous users refer to users that access network resources without providing a username or password. An influence operation may use anonymous accounts to spread content without direct attribution to the operation.

Internal MISP references

UUID f3927312-d6d3-5124-b831-5446c1fb5e6e which can be used as unique global reference for Create Anonymous Accounts in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0090.001
kill_chain ['tactics:Establish Social Assets']

Create Cyborg Accounts

Cyborg accounts refer to partly manned, partly automated social media accounts. Cyborg accounts primarily act as bots, but a human operator periodically takes control of the account to engage with real social media users by responding to comments and posting original content. Influence operations may use cyborg accounts to reduce the amount of direct human input required to maintain a regular account but increase the apparent legitimacy of the cyborg account by occasionally breaking its bot-like behaviour with human interaction.

Internal MISP references

UUID 8fa7973f-e10d-5367-af06-76f9e0fc7fc7 which can be used as unique global reference for Create Cyborg Accounts in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0090.002
kill_chain ['tactics:Establish Social Assets']

Create Bot Accounts

Bots refer to autonomous internet users that interact with systems or other users while imitating traditional human behaviour. Bots use a variety of tools to stay active without direct human operation, including artificial intelligence and big data analytics. For example, an individual may programme a Twitter bot to retweet a tweet every time it contains a certain keyword or hashtag. An influence operation may use bots to increase its exposure and artificially promote its content across the internet without dedicating additional time or human resources. Amplifier bots promote operation content through reposts, shares, and likes to increase the content’s online popularity. Hacker bots are traditionally covert bots running on computer scripts that rarely engage with users and work primarily as agents of larger cyberattacks, such as a Distributed Denial of Service attacks. Spammer bots are programmed to post content on social media or in comment sections, usually as a supplementary tool. Impersonator bots102 pose as real people by mimicking human behaviour, complicating their detection.

Internal MISP references

UUID 16b41179-d9f3-50ea-aedb-ed9e667d6249 which can be used as unique global reference for Create Bot Accounts in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0090.003
kill_chain ['tactics:Establish Social Assets']

Create Sockpuppet Accounts

Sockpuppet accounts refer to falsified accounts that either promote the influence operation’s own material or attack critics of the material online. Individuals who control sockpuppet accounts also man at least one other user account.67 Sockpuppet accounts help legitimise operation narratives by providing an appearance of external support for the material and discrediting opponents of the operation.

Internal MISP references

UUID 0e5ca353-ba01-5dec-95a4-19ca45cb7717 which can be used as unique global reference for Create Sockpuppet Accounts in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0090.004
kill_chain ['tactics:Establish Social Assets']

Recruit Malign Actors

Operators recruit bad actors paying recruiting, or exerting control over individuals includes trolls, partisans, and contractors.

Internal MISP references

UUID 981baf1f-f9ae-523b-a135-06b2b940e1ea which can be used as unique global reference for Recruit Malign Actors in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0091
kill_chain ['tactics:Establish Social Assets']

Recruit Contractors

Operators recruit paid contractor to support the campaign.

Internal MISP references

UUID 8278b8d9-e056-5d6d-827d-4752bb2d7833 which can be used as unique global reference for Recruit Contractors in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0091.001
kill_chain ['tactics:Establish Social Assets']

Recruit Partisans

Operators recruit partisans (ideologically-aligned individuals) to support the campaign.

Internal MISP references

UUID 6c3ac844-a6fc-545d-9957-a1513949f639 which can be used as unique global reference for Recruit Partisans in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0091.002
kill_chain ['tactics:Establish Social Assets']

Enlist Troll Accounts

An influence operation may hire trolls, or human operators of fake accounts that aim to provoke others by posting and amplifying content about controversial issues. Trolls can serve to discredit an influence operation’s opposition or bring attention to the operation’s cause through debate. Classic trolls refer to regular people who troll for personal reasons, such as attention-seeking or boredom. Classic trolls may advance operation narratives by coincidence but are not directly affiliated with any larger operation. Conversely, hybrid trolls act on behalf of another institution, such as a state or financial organisation, and post content with a specific ideological goal. Hybrid trolls may be highly advanced and institutionalised or less organised and work for a single individual.

Internal MISP references

UUID 0ac30e0e-434d-510a-a2f8-1b330338134d which can be used as unique global reference for Enlist Troll Accounts in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0091.003
kill_chain ['tactics:Establish Social Assets']

Build Network

Operators build their own network, creating links between accounts -- whether authentic or inauthentic -- in order amplify and promote narratives and artefacts, and encourage further growth of ther network, as well as the ongoing sharing and engagement with operational content.

Internal MISP references

UUID ef0c7e64-7702-5624-8318-d6f2d592433b which can be used as unique global reference for Build Network in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0092
kill_chain ['tactics:Establish Social Assets']

Create Organisations

Influence operations may establish organisations with legitimate or falsified hierarchies, staff, and content to structure operation assets, provide a sense of legitimacy to the operation, or provide institutional backing to operation activities.

Internal MISP references

UUID bc78ce0a-1a9a-56b2-9e2d-77df7d14cf82 which can be used as unique global reference for Create Organisations in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0092.001
kill_chain ['tactics:Establish Social Assets']

Use Follow Trains

A follow train is a group of people who follow each other on a social media platform, often as a way for an individual or campaign to grow its social media following. Follow trains may be a violation of platform Terms of Service. They are also known as follow-for-follow groups.

Internal MISP references

UUID 3d9be546-6fd4-5171-b418-f7dc7557f347 which can be used as unique global reference for Use Follow Trains in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0092.002
kill_chain ['tactics:Establish Social Assets']

Create Community or Sub-Group

When there is not an existing community or sub-group that meets a campaign's goals, an influence operation may seek to create a community or sub-group.

Internal MISP references

UUID 0462781b-c754-5d6a-8742-91cb02d81034 which can be used as unique global reference for Create Community or Sub-Group in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0092.003
kill_chain ['tactics:Establish Social Assets']

Acquire/Recruit Network

Operators acquire an existing network by paying, recruiting, or exerting control over the leaders of the existing network.

Internal MISP references

UUID c1512f4a-9f4a-5b67-9f20-dbc40942d136 which can be used as unique global reference for Acquire/Recruit Network in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0093
kill_chain ['tactics:Establish Social Assets']

Fund Proxies

An influence operation may fund proxies, or external entities that work for the operation. An operation may recruit/train users with existing sympathies towards the operation’s narratives and/or goals as proxies. Funding proxies serves various purposes including: - Diversifying operation locations to complicate attribution - Reducing the workload for direct operation assets

Internal MISP references

UUID fb44dd38-07ef-5274-b3c9-c5e59afa1750 which can be used as unique global reference for Fund Proxies in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0093.001
kill_chain ['tactics:Establish Social Assets']

Acquire Botnets

A botnet is a group of bots that can function in coordination with each other.

Internal MISP references

UUID 750ed343-1ad9-5eb3-bbb4-08d680d47f53 which can be used as unique global reference for Acquire Botnets in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0093.002
kill_chain ['tactics:Establish Social Assets']

Infiltrate Existing Networks

Operators deceptively insert social assets into existing networks as group members in order to influence the members of the network and the wider information environment that the network impacts.

Internal MISP references

UUID bb12e908-0783-53cb-9b29-de4bc8786604 which can be used as unique global reference for Infiltrate Existing Networks in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0094
kill_chain ['tactics:Establish Social Assets']

Identify Susceptible Targets in Networks

When seeking to infiltrate an existing network, an influence operation may identify individuals and groups that might be susceptible to being co-opted or influenced.

Internal MISP references

UUID 16aa2680-49bf-531c-a654-2e06dd852ac8 which can be used as unique global reference for Identify Susceptible Targets in Networks in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0094.001
kill_chain ['tactics:Establish Social Assets']

Utilise Butterfly Attacks

Butterfly attacks occur when operators pretend to be members of a certain social group, usually a group that struggles for representation. An influence operation may mimic a group to insert controversial statements into the discourse, encourage the spread of operation content, or promote harassment among group members. Unlike astroturfing, butterfly attacks aim to infiltrate and discredit existing grassroots movements, organisations, and media campaigns.

Internal MISP references

UUID 9748df5d-c55d-5f30-80c9-670bdf312ecd which can be used as unique global reference for Utilise Butterfly Attacks in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0094.002
kill_chain ['tactics:Establish Social Assets']

Develop Owned Media Assets

An owned media asset refers to an agency or organisation through which an influence operation may create, develop, and host content and narratives. Owned media assets include websites, blogs, social media pages, forums, and other platforms that facilitate the creation and organisation of content.

Internal MISP references

UUID 9aff2d75-3898-56bc-b5ae-2d3566ab8de2 which can be used as unique global reference for Develop Owned Media Assets in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0095
kill_chain ['tactics:Establish Social Assets']

Leverage Content Farms

Using the services of large-scale content providers for creating and amplifying campaign artefacts at scale.

Internal MISP references

UUID 845f886a-80e7-587a-a8c2-1473488d290e which can be used as unique global reference for Leverage Content Farms in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0096
kill_chain ['tactics:Establish Social Assets']

Create Content Farms

An influence operation may create an organisation for creating and amplifying campaign artefacts at scale.

Internal MISP references

UUID c07d2615-36a0-52cc-8cbb-84442420df07 which can be used as unique global reference for Create Content Farms in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0096.001
kill_chain ['tactics:Establish Social Assets']

Outsource Content Creation to External Organisations

An influence operation may outsource content creation to external companies to avoid attribution, increase the rate of content creation, or improve content quality, i.e., by employing an organisation that can create content in the target audience’s native language. Employed organisations may include marketing companies for tailored advertisements or external content farms for high volumes of targeted media.

Internal MISP references

UUID ccbc4898-76ec-5bc3-a0d2-39473fb20c2f which can be used as unique global reference for Outsource Content Creation to External Organisations in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0096.002
kill_chain ['tactics:Establish Social Assets']

Create Personas

Creating fake people, often with accounts across multiple platforms. These personas can be as simple as a name, can contain slightly more background like location, profile pictures, backstory, or can be effectively backstopped with indicators like fake identity documents.

Internal MISP references

UUID 7f984091-41b3-5e8f-b723-1d5eb9150d1d which can be used as unique global reference for Create Personas in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0097
kill_chain ['tactics:Establish Legitimacy']

Backstop Personas

Create other assets/dossier/cover/fake relationships and/or connections or documents, sites, bylines, attributions, to establish/augment/inflate crediblity/believability

Internal MISP references

UUID 2341584c-3ca5-5d2e-85f8-2b9c4da81268 which can be used as unique global reference for Backstop Personas in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0097.001
kill_chain ['tactics:Establish Legitimacy']

Establish Inauthentic News Sites

Modern computational propaganda makes use of a cadre of imposter news sites spreading globally. These sites, sometimes motivated by concerns other than propaganda--for instance, click-based revenue--often have some superficial markers of authenticity, such as naming and site-design. But many can be quickly exposed with reference to their owenership, reporting history and adverstising details.

Internal MISP references

UUID abaff1d4-e7b1-597b-bb22-556f54a9602c which can be used as unique global reference for Establish Inauthentic News Sites in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0098
kill_chain ['tactics:Establish Legitimacy']

Create Inauthentic News Sites

Create Inauthentic News Sites

Internal MISP references

UUID b9dceeab-f5d8-50ae-ad8a-365d77fc4a3d which can be used as unique global reference for Create Inauthentic News Sites in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0098.001
kill_chain ['tactics:Establish Legitimacy']

Leverage Existing Inauthentic News Sites

Leverage Existing Inauthentic News Sites

Internal MISP references

UUID 51648b8d-6019-5545-a67b-e2e1e4b901a2 which can be used as unique global reference for Leverage Existing Inauthentic News Sites in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0098.002
kill_chain ['tactics:Establish Legitimacy']

Prepare Assets Impersonating Legitimate Entities

An influence operation may prepare assets impersonating legitimate entities to further conceal its network identity and add a layer of legitimacy to its operation content. Users will more likely believe and less likely fact-check news from recognisable sources rather than unknown sites. Legitimate entities may include authentic news outlets, public figures, organisations, or state entities. An influence operation may use a wide variety of cyber techniques to impersonate a legitimate entity’s website or social media account. Typosquatting87 is the international registration of a domain name with purposeful variations of the impersonated domain name through intentional typos, top-level domain (TLD) manipulation, or punycode. Typosquatting facilitates the creation of falsified websites by creating similar domain names in the URL box, leaving it to the user to confirm that the URL is correct.

Internal MISP references

UUID 9758be4b-0f4d-5438-bc2a-567bffb8cd57 which can be used as unique global reference for Prepare Assets Impersonating Legitimate Entities in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0099
kill_chain ['tactics:Establish Legitimacy']

Astroturfing

Astroturfing occurs when an influence operation disguises itself as grassroots movement or organisation that supports operation narratives. Unlike butterfly attacks, astroturfing aims to increase the appearance of popular support for the operation cause and does not infiltrate existing groups to discredit their objectives.

Internal MISP references

UUID 2710c060-376c-5008-b7e8-791086382a2b which can be used as unique global reference for Astroturfing in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0099.001
kill_chain ['tactics:Establish Legitimacy']

Spoof/Parody Account/Site

An influence operation may prepare assets impersonating legitimate entities to further conceal its network identity and add a layer of legitimacy to its operation content. Users will more likely believe and less likely fact-check news from recognisable sources rather than unknown sites. Legitimate entities may include authentic news outlets, public figures, organisations, or state entities.

Internal MISP references

UUID 8eab0457-f145-56f7-aac6-d46ec8225570 which can be used as unique global reference for Spoof/Parody Account/Site in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0099.002
kill_chain ['tactics:Establish Legitimacy']

Co-Opt Trusted Sources

An influence operation may co-opt trusted sources by infiltrating or repurposing a source to reach a target audience through existing, previously reliable networks. Co-opted trusted sources may include: - National or local new outlets - Research or academic publications - Online blogs or websites

Internal MISP references

UUID 052ea05b-d892-5987-8017-0efad3d88a27 which can be used as unique global reference for Co-Opt Trusted Sources in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0100
kill_chain ['tactics:Establish Legitimacy']

Co-Opt Trusted Individuals

Co-Opt Trusted Individuals

Internal MISP references

UUID 8592f95a-a576-5c9f-8f62-66089345255a which can be used as unique global reference for Co-Opt Trusted Individuals in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0100.001
kill_chain ['tactics:Establish Legitimacy']

Co-Opt Grassroots Groups

Co-Opt Grassroots Groups

Internal MISP references

UUID 8b9308aa-c65d-5e00-bb60-f93873611283 which can be used as unique global reference for Co-Opt Grassroots Groups in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0100.002
kill_chain ['tactics:Establish Legitimacy']

Co-Opt Influencers

Co-opt Influencers

Internal MISP references

UUID 7e763150-56e9-50e0-a180-3faf14734574 which can be used as unique global reference for Co-Opt Influencers in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0100.003
kill_chain ['tactics:Establish Legitimacy']

Create Localised Content

Localised content refers to content that appeals to a specific community of individuals, often in defined geographic areas. An operation may create localised content using local language and dialects to resonate with its target audience and blend in with other local news and social media. Localised content may help an operation increase legitimacy, avoid detection, and complicate external attribution.

Internal MISP references

UUID a2355290-e41e-5210-b03c-6ef88d4b61c2 which can be used as unique global reference for Create Localised Content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0101
kill_chain ['tactics:Microtarget']

Leverage Echo Chambers/Filter Bubbles

An echo chamber refers to an internet subgroup, often along ideological lines, where individuals only engage with “others with which they are already in agreement.” A filter bubble refers to an algorithm's placement of an individual in content that they agree with or regularly engage with, possibly entrapping the user into a bubble of their own making. An operation may create these isolated areas of the internet by match existing groups, or aggregating individuals into a single target audience based on shared interests, politics, values, demographics, and other characteristics. Echo chambers and filter bubbles help to reinforce similar biases and content to the same target audience members.

Internal MISP references

UUID d4e6d8d6-125c-58cf-924f-960e17a795bf which can be used as unique global reference for Leverage Echo Chambers/Filter Bubbles in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0102
kill_chain ['tactics:Microtarget']

Use Existing Echo Chambers/Filter Bubbles

Use existing Echo Chambers/Filter Bubbles

Internal MISP references

UUID bfa744ce-4cbb-5cc3-9cb5-406783d5d5d9 which can be used as unique global reference for Use Existing Echo Chambers/Filter Bubbles in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0102.001
kill_chain ['tactics:Microtarget']

Create Echo Chambers/Filter Bubbles

Create Echo Chambers/Filter Bubbles

Internal MISP references

UUID 1a8c5e95-d053-5cf1-98c9-7e33b04708ab which can be used as unique global reference for Create Echo Chambers/Filter Bubbles in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0102.002
kill_chain ['tactics:Microtarget']

Exploit Data Voids

A data void refers to a word or phrase that results in little, manipulative, or low-quality search engine data. Data voids are hard to detect and relatively harmless until exploited by an entity aiming to quickly proliferate false or misleading information during a phenomenon that causes a high number of individuals to query the term or phrase. In the Plan phase, an influence operation may identify data voids for later exploitation in the operation. A 2019 report by Michael Golebiewski identifies five types of data voids. (1) “Breaking news” data voids occur when a keyword gains popularity during a short period of time, allowing an influence operation to publish false content before legitimate news outlets have an opportunity to publish relevant information. (2) An influence operation may create a “strategic new terms” data void by creating their own terms and publishing information online before promoting their keyword to the target audience. (3) An influence operation may publish content on “outdated terms” that have decreased in popularity, capitalising on most search engines’ preferences for recency. (4) “Fragmented concepts” data voids separate connections between similar ideas, isolating segment queries to distinct search engine results. (5) An influence operation may use “problematic queries” that previously resulted in disturbing or inappropriate content to promote messaging until mainstream media recontextualizes the term.

Internal MISP references

UUID 62a656a7-9e5f-58e3-b563-9396006fadc3 which can be used as unique global reference for Exploit Data Voids in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0102.003
kill_chain ['tactics:Microtarget']

Livestream

A livestream refers to an online broadcast capability that allows for real-time communication to closed or open networks.

Internal MISP references

UUID aead2978-a869-5fc7-96f6-f9c55baf2e09 which can be used as unique global reference for Livestream in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0103
kill_chain ['tactics:Select Channels and Affordances']

Video Livestream

A video livestream refers to an online video broadcast capability that allows for real-time communication to closed or open networks.

Internal MISP references

UUID b8200b83-54c4-5448-86a8-08fa1223b470 which can be used as unique global reference for Video Livestream in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0103.001
kill_chain ['tactics:Select Channels and Affordances']

Audio Livestream

An audio livestream refers to an online audio broadcast capability that allows for real-time communication to closed or open networks.

Internal MISP references

UUID 880869e4-2576-5a33-bea0-f35bb71fcdc0 which can be used as unique global reference for Audio Livestream in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0103.002
kill_chain ['tactics:Select Channels and Affordances']

Social Networks

Social media are interactive digital channels that facilitate the creation and sharing of information, ideas, interests, and other forms of expression through virtual communities and networks.

Internal MISP references

UUID 012be2cf-7aed-5ac4-8fb5-ad7ffff73ea0 which can be used as unique global reference for Social Networks in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0104
kill_chain ['tactics:Select Channels and Affordances']

Mainstream Social Networks

Examples include Facebook, Twitter, LinkedIn, etc.

Internal MISP references

UUID 79364323-1d9e-5e29-8bd8-d0bc7bf32f30 which can be used as unique global reference for Mainstream Social Networks in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0104.001
kill_chain ['tactics:Select Channels and Affordances']

Dating Apps

Dating Apps

Internal MISP references

UUID 96b1a88b-ea2d-51ad-a473-1669e956d387 which can be used as unique global reference for Dating Apps in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0104.002
kill_chain ['tactics:Select Channels and Affordances']

Private/Closed Social Networks

Social networks that are not open to people outside of family, friends, neighbours, or co-workers. Non-work-related examples include Couple, FamilyWall, 23snaps, and Nextdoor. Some of the larger social network platforms enable closed communities: examples are Instagram Close Friends and Twitter (X) Circle. Work-related examples of private social networks include LinkedIn, Facebook Workplace, and enterprise communication platforms such as Slack or Microsoft Teams.

Internal MISP references

UUID ebcad87c-1217-5d90-8f6f-43d078a3d461 which can be used as unique global reference for Private/Closed Social Networks in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0104.003
kill_chain ['tactics:Select Channels and Affordances']

Interest-Based Networks

Examples include smaller and niche networks including Gettr, Truth Social, Parler, etc.

Internal MISP references

UUID 7f80d0ec-c3d9-501f-9688-780ed4fa3720 which can be used as unique global reference for Interest-Based Networks in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0104.004
kill_chain ['tactics:Select Channels and Affordances']

Use Hashtags

Use a dedicated, existing hashtag for the campaign/incident.

Internal MISP references

UUID 6e852d19-6582-5713-bdf0-18a68ee50bd8 which can be used as unique global reference for Use Hashtags in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0104.005
kill_chain ['tactics:Select Channels and Affordances']

Create Dedicated Hashtag

Create a campaign/incident specific hashtag.

Internal MISP references

UUID 732d47a6-ba6a-56d4-828c-6e6612d9c95d which can be used as unique global reference for Create Dedicated Hashtag in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0104.006
kill_chain ['tactics:Select Channels and Affordances']

Media Sharing Networks

Media sharing networks refer to services whose primary function is the hosting and sharing of specific forms of media. Examples include Instagram, Snapchat, TikTok, Youtube, SoundCloud.

Internal MISP references

UUID d201dc16-622a-5da2-b82a-9924607f2e24 which can be used as unique global reference for Media Sharing Networks in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0105
kill_chain ['tactics:Select Channels and Affordances']

Photo Sharing

Examples include Instagram, Snapchat, Flickr, etc

Internal MISP references

UUID 727b8c48-8a62-5804-a1af-fd0b6ec71699 which can be used as unique global reference for Photo Sharing in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0105.001
kill_chain ['tactics:Select Channels and Affordances']

Video Sharing

Examples include Youtube, TikTok, ShareChat, Rumble, etc

Internal MISP references

UUID 84e96b27-ea09-5a88-9ad7-d6420cc06ee8 which can be used as unique global reference for Video Sharing in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0105.002
kill_chain ['tactics:Select Channels and Affordances']

Audio Sharing

Examples include podcasting apps, Soundcloud, etc.

Internal MISP references

UUID 0f5bce10-d1d9-5270-9b54-0214e2353724 which can be used as unique global reference for Audio Sharing in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0105.003
kill_chain ['tactics:Select Channels and Affordances']

Discussion Forums

Platforms for finding, discussing, and sharing information and opinions. Examples include Reddit, Quora, Digg, message boards, interest-based discussion forums, etc.

Internal MISP references

UUID 1f4ef9c4-e3f3-5981-a4c9-9aed559323d0 which can be used as unique global reference for Discussion Forums in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0106
kill_chain ['tactics:Select Channels and Affordances']

Anonymous Message Boards

Examples include the Chans

Internal MISP references

UUID 12fb075d-f148-5eab-ae24-94799f055750 which can be used as unique global reference for Anonymous Message Boards in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0106.001
kill_chain ['tactics:Select Channels and Affordances']

Bookmarking and Content Curation

Platforms for searching, sharing, and curating content and media. Examples include Pinterest, Flipboard, etc.

Internal MISP references

UUID cc4df2aa-7a91-53a3-816f-c1d9340801ea which can be used as unique global reference for Bookmarking and Content Curation in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0107
kill_chain ['tactics:Select Channels and Affordances']

Blogging and Publishing Networks

Examples include WordPress, Blogger, Weebly, Tumblr, Medium, etc.

Internal MISP references

UUID 274821cc-3f7a-5785-8712-0f46a5e2903b which can be used as unique global reference for Blogging and Publishing Networks in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0108
kill_chain ['tactics:Select Channels and Affordances']

Consumer Review Networks

Platforms for finding, reviewing, and sharing information about brands, products, services, restaurants, travel destinations, etc. Examples include Yelp, TripAdvisor, etc.

Internal MISP references

UUID 64d83292-f532-5aca-b76e-69e4741d4a6e which can be used as unique global reference for Consumer Review Networks in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0109
kill_chain ['tactics:Select Channels and Affordances']

Formal Diplomatic Channels

Leveraging formal, traditional, diplomatic channels to communicate with foreign governments (written documents, meetings, summits, diplomatic visits, etc). This type of diplomacy is conducted by diplomats of one nation with diplomats and other officials of another nation or international organisation.

Internal MISP references

UUID 46aedae0-4850-5af6-8db4-ad5665ecd2a4 which can be used as unique global reference for Formal Diplomatic Channels in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0110
kill_chain ['tactics:Select Channels and Affordances']

Traditional Media

Examples include TV, Newspaper, Radio, etc.

Internal MISP references

UUID 5cb9a5f0-e6a6-57e8-9cc4-262c807281fa which can be used as unique global reference for Traditional Media in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0111
kill_chain ['tactics:Select Channels and Affordances']

TV

TV

Internal MISP references

UUID 7c5bb87d-d038-5a46-9069-6cb8d01a19e7 which can be used as unique global reference for TV in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0111.001
kill_chain ['tactics:Select Channels and Affordances']

Newspaper

Newspaper

Internal MISP references

UUID 21fa5ba1-9782-5cad-8903-7abb955ed9b1 which can be used as unique global reference for Newspaper in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0111.002
kill_chain ['tactics:Select Channels and Affordances']

Radio

Radio

Internal MISP references

UUID 6d83b061-da10-5693-837c-960285176c0b which can be used as unique global reference for Radio in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0111.003
kill_chain ['tactics:Select Channels and Affordances']

Email

Delivering content and narratives via email. This can include using list management or high-value individually targeted messaging.

Internal MISP references

UUID 32ec2894-3a89-5b14-be34-77289f1106ca which can be used as unique global reference for Email in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0112
kill_chain ['tactics:Select Channels and Affordances']

Employ Commercial Analytic Firms

Commercial analytic firms collect data on target audience activities and evaluate the data to detect trends, such as content receiving high click-rates. An influence operation may employ commercial analytic firms to facilitate external collection on its target audience, complicating attribution efforts and better tailoring the content to audience preferences.

Internal MISP references

UUID d6a72ed4-28f9-5736-b8a6-459679026513 which can be used as unique global reference for Employ Commercial Analytic Firms in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0113
kill_chain ['tactics:Conduct Pump Priming']

Deliver Ads

Delivering content via any form of paid media or advertising.

Internal MISP references

UUID 51639828-5e65-5f32-9858-7020166d26dd which can be used as unique global reference for Deliver Ads in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0114
kill_chain ['tactics:Deliver Content']

Social Media

Social Media

Internal MISP references

UUID 9c655aa6-1474-5ab9-8eff-519df00fe41b which can be used as unique global reference for Social Media in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0114.001
kill_chain ['tactics:Deliver Content']

Post Content

Delivering content by posting via owned media (assets that the operator controls).

Internal MISP references

UUID e41d7f0f-d913-5973-b8a3-385b39e78ebd which can be used as unique global reference for Post Content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0115
kill_chain ['tactics:Deliver Content']

Share Memes

Memes are one of the most important single artefact types in all of computational propaganda. Memes in this framework denotes the narrow image-based definition. But that naming is no accident, as these items have most of the important properties of Dawkins' original conception as a self-replicating unit of culture. Memes pull together reference and commentary; image and narrative; emotion and message. Memes are a powerful tool and the heart of modern influence campaigns.

Internal MISP references

UUID 986815f4-a31d-57bd-8782-9039044af3af which can be used as unique global reference for Share Memes in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0115.001
kill_chain ['tactics:Deliver Content']

Post Violative Content to Provoke Takedown and Backlash

Post Violative Content to Provoke Takedown and Backlash.

Internal MISP references

UUID 70a3dd8d-c492-5b80-a77c-21f05a72a8c4 which can be used as unique global reference for Post Violative Content to Provoke Takedown and Backlash in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0115.002
kill_chain ['tactics:Deliver Content']

One-Way Direct Posting

Direct posting refers to a method of posting content via a one-way messaging service, where the recipient cannot directly respond to the poster’s messaging. An influence operation may post directly to promote operation narratives to the target audience without allowing opportunities for fact-checking or disagreement, creating a false sense of support for the narrative.

Internal MISP references

UUID 344ef4f6-8020-5493-871e-b7015d53bfae which can be used as unique global reference for One-Way Direct Posting in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0115.003
kill_chain ['tactics:Deliver Content']

Comment or Reply on Content

Delivering content by replying or commenting via owned media (assets that the operator controls).

Internal MISP references

UUID df724dcc-0d26-5c3b-aec1-b3c82f509f07 which can be used as unique global reference for Comment or Reply on Content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0116
kill_chain ['tactics:Deliver Content']

Post Inauthentic Social Media Comment

Use government-paid social media commenters, astroturfers, chat bots (programmed to reply to specific key words/hashtags) influence online conversations, product reviews, web-site comment forums.

Internal MISP references

UUID c5d17eaa-9f30-5b38-a54a-ddc853981e53 which can be used as unique global reference for Post Inauthentic Social Media Comment in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0116.001
kill_chain ['tactics:Deliver Content']

Attract Traditional Media

Deliver content by attracting the attention of traditional media (earned media).

Internal MISP references

UUID 40c341c1-873c-5cbe-bac6-eaeed322d74e which can be used as unique global reference for Attract Traditional Media in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0117
kill_chain ['tactics:Deliver Content']

Amplify Existing Narrative

An influence operation may amplify existing narratives that align with its narratives to support operation objectives.

Internal MISP references

UUID 69fe11a4-89b8-5c78-8872-7f7bc7a870f1 which can be used as unique global reference for Amplify Existing Narrative in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0118
kill_chain ['tactics:Maximise Exposure']

Cross-Posting

Cross-posting refers to posting the same message to multiple internet discussions, social media platforms or accounts, or news groups at one time. An influence operation may post content online in multiple communities and platforms to increase the chances of content exposure to the target audience.

Internal MISP references

UUID 324248a7-3a0c-5689-8f0e-770d6d6f2dd7 which can be used as unique global reference for Cross-Posting in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0119
kill_chain ['tactics:Maximise Exposure']

Post across Groups

An influence operation may post content across groups to spread narratives and content to new communities within the target audiences or to new target audiences.

Internal MISP references

UUID d6cb6d4e-f75a-50af-b629-bea934659403 which can be used as unique global reference for Post across Groups in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0119.001
kill_chain ['tactics:Maximise Exposure']

Post across Platform

An influence operation may post content across platforms to spread narratives and content to new communities within the target audiences or to new target audiences. Posting across platforms can also remove opposition and context, helping the narrative spread with less opposition on the cross-posted platform.

Internal MISP references

UUID 7dfb83d1-507f-517e-912f-6deefee4ce3f which can be used as unique global reference for Post across Platform in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0119.002
kill_chain ['tactics:Maximise Exposure']

Post across Disciplines

Post Across Disciplines

Internal MISP references

UUID 32ad368e-ac64-59bb-921a-80fdff8eed09 which can be used as unique global reference for Post across Disciplines in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0119.003
kill_chain ['tactics:Maximise Exposure']

Incentivize Sharing

Incentivizing content sharing refers to actions that encourage users to share content themselves, reducing the need for the operation itself to post and promote its own content.

Internal MISP references

UUID e8a91999-4d28-5d96-a427-d67c23a9c661 which can be used as unique global reference for Incentivize Sharing in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0120
kill_chain ['tactics:Maximise Exposure']

Use Affiliate Marketing Programmes

Use Affiliate Marketing Programmes

Internal MISP references

UUID cd41b90c-5c59-5c1f-9824-515e9394d546 which can be used as unique global reference for Use Affiliate Marketing Programmes in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0120.001
kill_chain ['tactics:Maximise Exposure']

Use Contests and Prizes

Use Contests and Prizes

Internal MISP references

UUID 7fcb8b90-f534-5a4e-8321-d1610916eaa0 which can be used as unique global reference for Use Contests and Prizes in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0120.002
kill_chain ['tactics:Maximise Exposure']

Manipulate Platform Algorithm

Manipulating a platform algorithm refers to conducting activity on a platform in a way that intentionally targets its underlying algorithm. After analysing a platform’s algorithm (see: Select Platforms), an influence operation may use a platform in a way that increases its content exposure, avoids content removal, or otherwise benefits the operation’s strategy. For example, an influence operation may use bots to amplify its posts so that the platform’s algorithm recognises engagement with operation content and further promotes the content on user timelines.

Internal MISP references

UUID 0f36a79a-aa9a-5792-9a5e-5587fd626ee3 which can be used as unique global reference for Manipulate Platform Algorithm in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0121
kill_chain ['tactics:Maximise Exposure']

Bypass Content Blocking

Bypassing content blocking refers to actions taken to circumvent network security measures that prevent users from accessing certain servers, resources, or other online spheres. An influence operation may bypass content blocking to proliferate its content on restricted areas of the internet. Common strategies for bypassing content blocking include: - Altering IP addresses to avoid IP filtering - Using a Virtual Private Network (VPN) to avoid IP filtering - Using a Content Delivery Network (CDN) to avoid IP filtering - Enabling encryption to bypass packet inspection blocking - Manipulating text to avoid filtering by keywords - Posting content on multiple platforms to avoid platform-specific removals - Using local facilities or modified DNS servers to avoid DNS filtering

Internal MISP references

UUID df60a404-a336-5fe0-8194-4c7605b0504c which can be used as unique global reference for Bypass Content Blocking in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0121.001
kill_chain ['tactics:Maximise Exposure']

Direct Users to Alternative Platforms

Direct users to alternative platforms refers to encouraging users to move from the platform on which they initially viewed operation content and engage with content on alternate information channels, including separate social media channels and inauthentic websites. An operation may drive users to alternative platforms to diversify its information channels and ensure the target audience knows where to access operation content if the initial platform suspends, flags, or otherwise removes original operation assets and content.

Internal MISP references

UUID 18930995-fc3c-530b-8e6c-ae8fef68a4df which can be used as unique global reference for Direct Users to Alternative Platforms in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0122
kill_chain ['tactics:Maximise Exposure']

Control Information Environment through Offensive Cyberspace Operations

Controlling the information environment through offensive cyberspace operations uses cyber tools and techniques to alter the trajectory of content in the information space to either prioritise operation messaging or block opposition messaging.

Internal MISP references

UUID 8264209e-287a-535e-b502-a0c59483a667 which can be used as unique global reference for Control Information Environment through Offensive Cyberspace Operations in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0123
kill_chain ['tactics:Drive Online Harms']

Delete Opposing Content

Deleting opposing content refers to the removal of content that conflicts with operational narratives from selected platforms. An influence operation may delete opposing content to censor contradictory information from the target audience, allowing operation narratives to take priority in the information space.

Internal MISP references

UUID e65250eb-08b4-5bc5-b3b5-d0f426470755 which can be used as unique global reference for Delete Opposing Content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0123.001
kill_chain ['tactics:Drive Online Harms']

Block Content

Content blocking refers to actions taken to restrict internet access or render certain areas of the internet inaccessible. An influence operation may restrict content based on both network and content attributes.

Internal MISP references

UUID 8afe697e-f8f5-5b71-81e3-1d81d89b754b which can be used as unique global reference for Block Content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0123.002
kill_chain ['tactics:Drive Online Harms']

Destroy Information Generation Capabilities

Destroying information generation capabilities refers to actions taken to limit, degrade, or otherwise incapacitate an actor’s ability to generate conflicting information. An influence operation may destroy an actor’s information generation capabilities by physically dismantling the information infrastructure, disconnecting resources needed for information generation, or redirecting information generation personnel. An operation may destroy an adversary’s information generation capabilities to limit conflicting content exposure to the target audience and crowd the information space with its own narratives.

Internal MISP references

UUID 55d0c38e-4e38-56c9-b864-962c976b2a62 which can be used as unique global reference for Destroy Information Generation Capabilities in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0123.003
kill_chain ['tactics:Drive Online Harms']

Conduct Server Redirect

A server redirect, also known as a URL redirect, occurs when a server automatically forwards a user from one URL to another using server-side or client-side scripting languages. An influence operation may conduct a server redirect to divert target audience members from one website to another without their knowledge. The redirected website may pose as a legitimate source, host malware, or otherwise aid operation objectives.

Internal MISP references

UUID 27fe7183-604f-5b93-a55f-0e9b6a10dd8c which can be used as unique global reference for Conduct Server Redirect in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0123.004
kill_chain ['tactics:Drive Online Harms']

Suppress Opposition

Operators can suppress the opposition by exploiting platform content moderation tools and processes like reporting non-violative content to platforms for takedown and goading opposition actors into taking actions that result in platform action or target audience disapproval.

Internal MISP references

UUID 57788034-088b-5c4d-b0b3-25dcea8f2973 which can be used as unique global reference for Suppress Opposition in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0124
kill_chain ['tactics:Drive Online Harms']

Report Non-Violative Opposing Content

Reporting opposing content refers to notifying and providing an instance of a violation of a platform’s guidelines and policies for conduct on the platform. In addition to simply reporting the content, an operation may leverage copyright regulations to trick social media and web platforms into removing opposing content by manipulating the content to appear in violation of copyright laws. Reporting opposing content facilitates the suppression of contradictory information and allows operation narratives to take priority in the information space.

Internal MISP references

UUID de589f8f-a86c-5cc4-bd1b-fb522555b718 which can be used as unique global reference for Report Non-Violative Opposing Content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0124.001
kill_chain ['tactics:Drive Online Harms']

Goad People into Harmful Action (Stop Hitting Yourself)

Goad people into actions that violate terms of service or will lead to having their content or accounts taken down.

Internal MISP references

UUID 5ebcb2f6-22b0-5c8a-9b40-d764b736210f which can be used as unique global reference for Goad People into Harmful Action (Stop Hitting Yourself) in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0124.002
kill_chain ['tactics:Drive Online Harms']

Exploit Platform TOS/Content Moderation

Exploit Platform TOS/Content Moderation

Internal MISP references

UUID 393644ea-39c6-59c4-976f-7c2088167f14 which can be used as unique global reference for Exploit Platform TOS/Content Moderation in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0124.003
kill_chain ['tactics:Drive Online Harms']

Platform Filtering

Platform filtering refers to the decontextualization of information as claims cross platforms (from Joan Donovan https://www.hks.harvard.edu/publications/disinformation-design-use-evidence-collages-and-platform-filtering-media-manipulation)

Internal MISP references

UUID c56168d8-5f79-57d4-8cf2-a3575bd7e598 which can be used as unique global reference for Platform Filtering in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0125
kill_chain ['tactics:Drive Online Harms']

Encourage Attendance at Events

Operation encourages attendance at existing real world event.

Internal MISP references

UUID cf67a0f0-ae79-59bb-afe2-1eda9f99e8e4 which can be used as unique global reference for Encourage Attendance at Events in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0126
kill_chain ['tactics:Drive Offline Activity']

Call to Action to Attend

Call to action to attend an event

Internal MISP references

UUID e52a27b8-48f8-527d-9859-84b198d61864 which can be used as unique global reference for Call to Action to Attend in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0126.001
kill_chain ['tactics:Drive Offline Activity']

Facilitate Logistics or Support for Attendance

Facilitate logistics or support for travel, food, housing, etc.

Internal MISP references

UUID 829b1f45-d835-53c8-94e5-4ff3c87fc39c which can be used as unique global reference for Facilitate Logistics or Support for Attendance in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0126.002
kill_chain ['tactics:Drive Offline Activity']

Physical Violence

Physical violence refers to the use of force to injure, abuse, damage, or destroy. An influence operation may conduct or encourage physical violence to discourage opponents from promoting conflicting content or draw attention to operation narratives using shock value.

Internal MISP references

UUID db32bcd3-a2ee-58ac-bc71-33f1af810a98 which can be used as unique global reference for Physical Violence in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0127
kill_chain ['tactics:Drive Offline Activity']

Conduct Physical Violence

An influence operation may directly Conduct Physical Violence to achieve campaign goals.

Internal MISP references

UUID 4c7437f5-1759-527a-b7e1-53de1a65abb2 which can be used as unique global reference for Conduct Physical Violence in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0127.001
kill_chain ['tactics:Drive Offline Activity']

Encourage Physical Violence

An influence operation may Encourage others to engage in Physical Violence to achieve campaign goals.

Internal MISP references

UUID 7dc74bbe-4d75-55f7-951c-bdd766e2efa6 which can be used as unique global reference for Encourage Physical Violence in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0127.002
kill_chain ['tactics:Drive Offline Activity']

Conceal Information Assets

Conceal the identity or provenance of campaign information assets such as accounts, channels, pages etc. to avoid takedown and attribution.

Internal MISP references

UUID e9efb6c7-93bf-5bce-a6c7-f01bb8d8a3f8 which can be used as unique global reference for Conceal Information Assets in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0128
kill_chain ['tactics:Persist in the Information Environment']

Use Pseudonyms

An operation may use pseudonyms, or fake names, to mask the identity of operational accounts, channels, pages etc., publish anonymous content, or otherwise use falsified personas to conceal the identity of the operation. An operation may coordinate pseudonyms across multiple platforms, for example, by writing an article under a pseudonym and then posting a link to the article on social media on an account, channel, or page with the same falsified name.

Internal MISP references

UUID 4e7db4e0-23e4-5931-bf81-2c60081bb44f which can be used as unique global reference for Use Pseudonyms in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0128.001
kill_chain ['tactics:Persist in the Information Environment']

Conceal Network Identity

Concealing network identity aims to hide the existence an influence operation’s network completely. Unlike concealing sponsorship, concealing network identity denies the existence of any sort of organisation.

Internal MISP references

UUID caa69e11-fc2b-580d-a6cb-a9bf28308b71 which can be used as unique global reference for Conceal Network Identity in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0128.002
kill_chain ['tactics:Persist in the Information Environment']

Distance Reputable Individuals from Operation

Distancing reputable individuals from the operation occurs when enlisted individuals, such as celebrities or subject matter experts, actively disengage themselves from operation activities and messaging. Individuals may distance themselves from the operation by deleting old posts or statements, unfollowing operation information assets, or otherwise detaching themselves from the operation’s timeline. An influence operation may want reputable individuals to distance themselves from the operation to reduce operation exposure, particularly if the operation aims to remove all evidence.

Internal MISP references

UUID ef1633ed-1970-54e9-9fcc-60693beb0500 which can be used as unique global reference for Distance Reputable Individuals from Operation in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0128.003
kill_chain ['tactics:Persist in the Information Environment']

Launder Information Assets

Laundering occurs when an influence operation acquires control of previously legitimate information assets such as accounts, channels, pages etc. from third parties through sale or exchange and often in contravention of terms of use. Influence operations use laundered assets to reach target audience members from within an existing information community and to complicate attribution.

Internal MISP references

UUID 8f9b7ca8-e697-520e-a477-f0ba0509bfcd which can be used as unique global reference for Launder Information Assets in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0128.004
kill_chain ['tactics:Persist in the Information Environment']

Change Names of Information Assets

Changing names or brand names of information assets such as accounts, channels, pages etc. An operation may change the names or brand names of its assets throughout an operation to avoid detection or alter the names of newly acquired or repurposed assets to fit operational narratives.

Internal MISP references

UUID 234c3805-31b1-585b-8c39-94c35315860d which can be used as unique global reference for Change Names of Information Assets in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0128.005
kill_chain ['tactics:Persist in the Information Environment']

Conceal Operational Activity

Conceal the campaign's operational activity to avoid takedown and attribution.

Internal MISP references

UUID 7c57a7c5-28eb-550d-bdf5-12be2396acb7 which can be used as unique global reference for Conceal Operational Activity in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0129
kill_chain ['tactics:Persist in the Information Environment']

Generate Content Unrelated to Narrative

An influence operation may mix its own operation content with legitimate news or external unrelated content to disguise operational objectives, narratives, or existence. For example, an operation may generate "lifestyle" or "cuisine" content alongside regular operation content.

Internal MISP references

UUID b7751384-967b-5260-89c8-0301868810f5 which can be used as unique global reference for Generate Content Unrelated to Narrative in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0129.002
kill_chain ['tactics:Persist in the Information Environment']

Break Association with Content

Breaking association with content occurs when an influence operation actively separates itself from its own content. An influence operation may break association with content by unfollowing, unliking, or unsharing its content, removing attribution from its content, or otherwise taking actions that distance the operation from its messaging. An influence operation may break association with its content to complicate attribution or regain credibility for a new operation.

Internal MISP references

UUID 3cf39d60-3b40-5739-b7e7-c6cd3474a9ee which can be used as unique global reference for Break Association with Content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0129.003
kill_chain ['tactics:Persist in the Information Environment']

Delete URLs

URL deletion occurs when an influence operation completely removes its website registration, rendering the URL inaccessible. An influence operation may delete its URLs to complicate attribution or remove online documentation that the operation ever occurred.

Internal MISP references

UUID 4f4ae59d-332d-52d5-8c18-cfd6bfc9da97 which can be used as unique global reference for Delete URLs in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0129.004
kill_chain ['tactics:Persist in the Information Environment']

Coordinate on Encrypted/Closed Networks

Coordinate on encrypted/ closed networks

Internal MISP references

UUID 6f546799-5edd-5356-a976-a1df70f5ca32 which can be used as unique global reference for Coordinate on Encrypted/Closed Networks in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0129.005
kill_chain ['tactics:Persist in the Information Environment']

Deny Involvement

Without "smoking gun" proof (and even with proof), incident creator can or will deny involvement. This technique also leverages the attacker advantages outlined in "Demand insurmountable proof", specifically the asymmetric disadvantage for truth-tellers in a "firehose of misinformation" environment.

Internal MISP references

UUID 1646a166-55f0-54c8-a5cc-9e0ca4779974 which can be used as unique global reference for Deny Involvement in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0129.006
kill_chain ['tactics:Persist in the Information Environment']

Delete Accounts/Account Activity

Deleting accounts and account activity occurs when an influence operation removes its online social media assets, including social media accounts, posts, likes, comments, and other online artefacts. An influence operation may delete its accounts and account activity to complicate attribution or remove online documentation that the operation ever occurred.

Internal MISP references

UUID abf940cd-1f31-5ca7-a2ef-2714c54a3c2a which can be used as unique global reference for Delete Accounts/Account Activity in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0129.007
kill_chain ['tactics:Persist in the Information Environment']

Redirect URLs

An influence operation may redirect its falsified or typosquatted URLs to legitimate websites to increase the operation's appearance of legitimacy, complicate attribution, and avoid detection.

Internal MISP references

UUID 4c7aca7d-c1d2-5262-b374-d28675ddd402 which can be used as unique global reference for Redirect URLs in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0129.008
kill_chain ['tactics:Persist in the Information Environment']

Remove Post Origins

Removing post origins refers to the elimination of evidence that indicates the initial source of operation content, often to complicate attribution. An influence operation may remove post origins by deleting watermarks, renaming files, or removing embedded links in its content.

Internal MISP references

UUID 1192d06d-4766-599f-987f-f6eb292f1b5c which can be used as unique global reference for Remove Post Origins in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0129.009
kill_chain ['tactics:Persist in the Information Environment']

Misattribute Activity

Misattributed activity refers to incorrectly attributed operation activity. For example, a state sponsored influence operation may conduct operation activity in a way that mimics another state so that external entities misattribute activity to the incorrect state. An operation may misattribute their activities to complicate attribution, avoid detection, or frame an adversary for negative behaviour.

Internal MISP references

UUID 5b9fee14-a5d4-56e3-a8b1-7031ef414e78 which can be used as unique global reference for Misattribute Activity in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0129.010
kill_chain ['tactics:Persist in the Information Environment']

Conceal Infrastructure

Conceal the campaign's infrastructure to avoid takedown and attribution.

Internal MISP references

UUID e19140c7-5296-574a-8350-5b1d5be04630 which can be used as unique global reference for Conceal Infrastructure in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0130
kill_chain ['tactics:Persist in the Information Environment']

Conceal Sponsorship

Concealing sponsorship aims to mislead or obscure the identity of the hidden sponsor behind an operation rather than entity publicly running the operation. Operations that conceal sponsorship may maintain visible falsified groups, news outlets, non-profits, or other organisations, but seek to mislead or obscure the identity sponsoring, funding, or otherwise supporting these entities. Influence operations may use a variety of techniques to mask the location of their social media accounts to complicate attribution and conceal evidence of foreign interference. Operation accounts may set their location to a false place, often the location of the operation’s target audience, and post in the region’s language

Internal MISP references

UUID bd222921-2ce7-5198-aebe-794cbc81b5db which can be used as unique global reference for Conceal Sponsorship in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0130.001
kill_chain ['tactics:Persist in the Information Environment']

Utilise Bulletproof Hosting

Hosting refers to services through which storage and computing resources are provided to an individual or organisation for the accommodation and maintenance of one or more websites and related services. Services may include web hosting, file sharing, and email distribution. Bulletproof hosting refers to services provided by an entity, such as a domain hosting or web hosting firm, that allows its customer considerable leniency in use of the service. An influence operation may utilise bulletproof hosting to maintain continuity of service for suspicious, illegal, or disruptive operation activities that stricter hosting services would limit, report, or suspend.

Internal MISP references

UUID 64cfd678-c279-59af-89ef-fce2be1f6b26 which can be used as unique global reference for Utilise Bulletproof Hosting in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0130.002
kill_chain ['tactics:Persist in the Information Environment']

Use Shell Organisations

Use Shell Organisations to conceal sponsorship.

Internal MISP references

UUID e33a8453-d3c1-53a7-9568-8fb65ffe8a47 which can be used as unique global reference for Use Shell Organisations in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0130.003
kill_chain ['tactics:Persist in the Information Environment']

Use Cryptocurrency

Use Cryptocurrency to conceal sponsorship. Examples include Bitcoin, Monero, and Etherium.

Internal MISP references

UUID 6d422b33-be0a-5d5e-8556-f6db54f506d9 which can be used as unique global reference for Use Cryptocurrency in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0130.004
kill_chain ['tactics:Persist in the Information Environment']

Obfuscate Payment

Obfuscate Payment

Internal MISP references

UUID 97c3035f-9c01-51a9-8f00-0b28b12d89bd which can be used as unique global reference for Obfuscate Payment in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0130.005
kill_chain ['tactics:Persist in the Information Environment']

Exploit TOS/Content Moderation

Exploiting weaknesses in platforms' terms of service and content moderation policies to avoid takedowns and platform actions.

Internal MISP references

UUID 636c3c7c-c98a-50dd-9b98-607d163a3a94 which can be used as unique global reference for Exploit TOS/Content Moderation in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0131
kill_chain ['tactics:Persist in the Information Environment']

Legacy Web Content

Make incident content visible for a long time, e.g. by exploiting platform terms of service, or placing it where it's hard to remove or unlikely to be removed.

Internal MISP references

UUID 7897332f-fb75-509f-8cf5-005da7bd14cf which can be used as unique global reference for Legacy Web Content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0131.001
kill_chain ['tactics:Persist in the Information Environment']

Post Borderline Content

Post Borderline Content

Internal MISP references

UUID 98cdfd25-6d66-5dfe-8303-a97d2f6d44dd which can be used as unique global reference for Post Borderline Content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0131.002
kill_chain ['tactics:Persist in the Information Environment']

Measure Performance

A metric used to determine the accomplishment of actions. “Are the actions being executed as planned?”

Internal MISP references

UUID 68f1e82e-f3ae-5975-aec8-a396c204ed39 which can be used as unique global reference for Measure Performance in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0132
kill_chain ['tactics:Assess Effectiveness']

People Focused

Measure the performance individuals in achieving campaign goals

Internal MISP references

UUID 7e712446-36ee-584f-a832-c98f8fa6d912 which can be used as unique global reference for People Focused in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0132.001
kill_chain ['tactics:Assess Effectiveness']

Content Focused

Measure the performance of campaign content

Internal MISP references

UUID 145dc4d2-ab1f-5128-a7bf-d7d835b0a8fa which can be used as unique global reference for Content Focused in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0132.002
kill_chain ['tactics:Assess Effectiveness']

View Focused

View Focused

Internal MISP references

UUID 79368272-a235-5d84-aeb3-70d337dcfffb which can be used as unique global reference for View Focused in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0132.003
kill_chain ['tactics:Assess Effectiveness']

Measure Effectiveness

A metric used to measure a current system state. “Are we on track to achieve the intended new system state within the planned timescale?”

Internal MISP references

UUID 26789434-54f0-5a93-a769-4810af285679 which can be used as unique global reference for Measure Effectiveness in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0133
kill_chain ['tactics:Assess Effectiveness']

Behaviour Changes

Monitor and evaluate behaviour changes from misinformation incidents.

Internal MISP references

UUID 3cf4d2ba-2ba4-58c0-915d-c9781f4b4979 which can be used as unique global reference for Behaviour Changes in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0133.001
kill_chain ['tactics:Assess Effectiveness']

Content

Measure current system state with respect to the effectiveness of campaign content.

Internal MISP references

UUID 90ed2d0b-1260-50ed-8a3d-8a71fbda4c8e which can be used as unique global reference for Content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0133.002
kill_chain ['tactics:Assess Effectiveness']

Awareness

Measure current system state with respect to the effectiveness of influencing awareness.

Internal MISP references

UUID 2a5f3d2c-9b1e-5aa5-a817-f9af6adf454d which can be used as unique global reference for Awareness in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0133.003
kill_chain ['tactics:Assess Effectiveness']

Knowledge

Measure current system state with respect to the effectiveness of influencing knowledge.

Internal MISP references

UUID df8b6793-cb28-5445-bbdb-c72bf5ff73fa which can be used as unique global reference for Knowledge in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0133.004
kill_chain ['tactics:Assess Effectiveness']

Action/Attitude

Measure current system state with respect to the effectiveness of influencing action/attitude.

Internal MISP references

UUID f9ae2f58-1c32-5e54-9bfd-27b3618a60e6 which can be used as unique global reference for Action/Attitude in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0133.005
kill_chain ['tactics:Assess Effectiveness']

Measure Effectiveness Indicators (or KPIs)

Ensuring that Key Performance Indicators are identified and tracked, so that the performance and effectiveness of campaigns, and elements of campaigns, can be measured, during and after their execution.

Internal MISP references

UUID e13d8a29-e9ef-5bf5-bcbc-372edc418d5d which can be used as unique global reference for Measure Effectiveness Indicators (or KPIs) in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0134
kill_chain ['tactics:Assess Effectiveness']

Message Reach

Monitor and evaluate message reach in misinformation incidents.

Internal MISP references

UUID 22e518b6-db32-50db-bf96-5a19b6604b8c which can be used as unique global reference for Message Reach in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0134.001
kill_chain ['tactics:Assess Effectiveness']

Social Media Engagement

Monitor and evaluate social media engagement in misinformation incidents.

Internal MISP references

UUID e9ff0ba4-19ba-5ae7-9fd4-49ac50a8a7b2 which can be used as unique global reference for Social Media Engagement in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0134.002
kill_chain ['tactics:Assess Effectiveness']

Undermine

Weaken, debilitate, or subvert a target or their actions. An influence operation may be designed to disparage an opponent; sabotage an opponent’s systems or processes; compromise an opponent’s relationships or support system; impair an opponent’s capability; or thwart an opponent’s initiative.

Internal MISP references

UUID 0141e703-9b91-55b5-b262-506eb215f6e8 which can be used as unique global reference for Undermine in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0135
kill_chain ['tactics:Plan Objectives']

Smear

Denigrate, disparage, or discredit an opponent. This is a common tactical objective in political campaigns with a larger strategic goal. It differs from efforts to harm a target through defamation. If there is no ulterior motive and the sole aim is to cause harm to the target, then choose sub-technique “Defame” of technique “Cause Harm” instead.

Internal MISP references

UUID a1a4b880-fd5a-5f6e-a649-3caf0e1395fc which can be used as unique global reference for Smear in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0135.001
kill_chain ['tactics:Plan Objectives']

Thwart

Prevent the successful outcome of a policy, operation, or initiative. Actors conduct influence operations to stymie or foil proposals, plans, or courses of action which are not in their interest.

Internal MISP references

UUID 13212ee6-9714-5a65-a1e2-6fa5e30b5f73 which can be used as unique global reference for Thwart in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0135.002
kill_chain ['tactics:Plan Objectives']

Subvert

Sabotage, destroy, or damage a system, process, or relationship. The classic example is the Soviet strategy of “active measures” involving deniable covert activities such as political influence, the use of front organisations, the orchestration of domestic unrest, and the spread of disinformation.

Internal MISP references

UUID 0b45e223-773a-533f-83f0-fbc928fe8e77 which can be used as unique global reference for Subvert in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0135.003
kill_chain ['tactics:Plan Objectives']

Polarise

To cause a target audience to divide into two completely opposing groups. This is a special case of subversion. To divide and conquer is an age-old approach to subverting and overcoming an enemy.

Internal MISP references

UUID 674d2dbc-d75f-5c3e-964a-e4fd3010dd4f which can be used as unique global reference for Polarise in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0135.004
kill_chain ['tactics:Plan Objectives']

Cultivate Support

Grow or maintain the base of support for the actor, ally, or action. This includes hard core recruitment, managing alliances, and generating or maintaining sympathy among a wider audience, including reputation management and public relations. Sub-techniques assume support for actor (self) unless otherwise specified.

Internal MISP references

UUID 92f8589a-028b-5504-8b71-bb847c45155b which can be used as unique global reference for Cultivate Support in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0136
kill_chain ['tactics:Plan Objectives']

Defend Reputaton

Preserve a positive perception in the public’s mind following an accusation or adverse event. When accused of a wrongful act, an actor may engage in denial, counter accusations, whataboutism, or conspiracy theories to distract public attention and attempt to maintain a positive image.

Internal MISP references

UUID 0846475e-2669-52e3-b1a0-9da43455379e which can be used as unique global reference for Defend Reputaton in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0136.001
kill_chain ['tactics:Plan Objectives']

Justify Action

To convince others to exonerate you of a perceived wrongdoing. When an actor finds it untenable to deny doing something, they may attempt to exonerate themselves with disinformation which claims the action was reasonable. This is a special case of “Defend Reputation”.

Internal MISP references

UUID eb9eddd7-ec69-57cf-9858-7699328de606 which can be used as unique global reference for Justify Action in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0136.002
kill_chain ['tactics:Plan Objectives']

Energise Supporters

Raise the morale of those who support the organisation or group. Invigorate constituents with zeal for the mission or activity. Terrorist groups, political movements, and cults may indoctrinate their supporters with ideologies that are based on warped versions of religion or cause harm to others.

Internal MISP references

UUID 367a49af-493d-5f32-af61-94ac25f12ef4 which can be used as unique global reference for Energise Supporters in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0136.003
kill_chain ['tactics:Plan Objectives']

Boost Reputation

Elevate the estimation of the actor in the public’s mind. Improve their image or standing. Public relations professionals use persuasive overt communications to achieve this goal; manipulators use covert disinformation.

Internal MISP references

UUID 53f0923a-2e3d-5d42-b520-1218f962dc68 which can be used as unique global reference for Boost Reputation in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0136.004
kill_chain ['tactics:Plan Objectives']

Cultvate Support for Initiative

Elevate or fortify the public backing for a policy, operation, or idea. Domestic and foreign actors can use artificial means to fabricate or amplify public support for a proposal or action.

Internal MISP references

UUID 7da024d9-24d2-595a-becb-4a792e885b80 which can be used as unique global reference for Cultvate Support for Initiative in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0136.005
kill_chain ['tactics:Plan Objectives']

Cultivate Support for Ally

Elevate or fortify the public backing for a partner. Governments may interfere in other countries’ elections by covertly favouring a party or candidate aligned with their interests. They may also mount an influence operation to bolster the reputation of an ally under attack.

Internal MISP references

UUID 06bed5fe-853f-57ce-a6de-4174b6ab58d2 which can be used as unique global reference for Cultivate Support for Ally in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0136.006
kill_chain ['tactics:Plan Objectives']

Recruit Members

Motivate followers to join or subscribe as members of the team. Organisations may mount recruitment drives that use propaganda to entice sympathisers to sign up.

Internal MISP references

UUID 78cd1801-a560-5417-abf2-dc5c617950e2 which can be used as unique global reference for Recruit Members in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0136.007
kill_chain ['tactics:Plan Objectives']

Increase Prestige

Improve personal standing within a community. Gain fame, approbation, or notoriety. Conspiracy theorists, those with special access, and ideologues can gain prominence in a community by propagating disinformation, leaking confidential documents, or spreading hate.

Internal MISP references

UUID 7f0f4d69-8634-52b4-aad8-61d8445acdb7 which can be used as unique global reference for Increase Prestige in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0136.008
kill_chain ['tactics:Plan Objectives']

Make Money

Profit from disinformation, conspiracy theories, or online harm. In some cases, the sole objective is financial gain, in other cases the objective is both financial and political. Making money may also be a way to sustain a political campaign.

Internal MISP references

UUID a9da70ec-419b-5fee-a66e-b55f0d5f483b which can be used as unique global reference for Make Money in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0137
kill_chain ['tactics:Plan Objectives']

Generate Ad Revenue

Earn income from digital advertisements published alongside inauthentic content. Conspiratorial, false, or provocative content drives internet traffic. Content owners earn money from impressions of, or clicks on, or conversions of ads published on their websites, social media profiles, or streaming services, or ads published when their content appears in search engine results. Fraudsters simulate impressions, clicks, and conversions, or they spin up inauthentic sites or social media profiles just to generate ad revenue. Conspiracy theorists and political operators generate ad revenue as a byproduct of their operation or as a means of sustaining their campaign.

Internal MISP references

UUID a25ebac4-85ff-5106-926b-b3c9ca1dfc86 which can be used as unique global reference for Generate Ad Revenue in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0137.001
kill_chain ['tactics:Plan Objectives']

Scam

Defraud a target or trick a target into doing something that benefits the attacker. A typical scam is where a fraudster convinces a target to pay for something without the intention of ever delivering anything in return. Alternatively, the fraudster may promise benefits which never materialise, such as a fake cure. Criminals often exploit a fear or crisis or generate a sense of urgency. They may use deepfakes to impersonate authority figures or individuals in distress.

Internal MISP references

UUID ef11bcd5-f638-55cb-a6e7-599fbbecdc80 which can be used as unique global reference for Scam in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0137.002
kill_chain ['tactics:Plan Objectives']

Raise Funds

Solicit donations for a cause. Popular conspiracy theorists can attract financial contributions from their followers. Fighting back against the establishment is a popular crowdfunding narrative.

Internal MISP references

UUID 8c512fc6-92a0-5d2f-8b9b-d5e21283f365 which can be used as unique global reference for Raise Funds in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0137.003
kill_chain ['tactics:Plan Objectives']

Sell Items under False Pretences

Offer products for sale under false pretences. Campaigns may hijack or create causes built on disinformation to sell promotional merchandise. Or charlatans may amplify victims’ unfounded fears to sell them items of questionable utility such as supplements or survival gear.

Internal MISP references

UUID b502d30b-0ad0-5abe-bba6-04298b660e26 which can be used as unique global reference for Sell Items under False Pretences in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0137.004
kill_chain ['tactics:Plan Objectives']

Extort

Coerce money or favours from a target by threatening to expose or corrupt information. Ransomware criminals typically demand money. Intelligence agencies demand national secrets. Sexual predators demand favours. The leverage may be critical, sensitive, or embarrassing information.

Internal MISP references

UUID d174f433-fcf2-5ad7-be1c-098b373849c1 which can be used as unique global reference for Extort in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0137.005
kill_chain ['tactics:Plan Objectives']

Manipulate Stocks

Artificially inflate or deflate the price of stocks or other financial instruments and then trade on these to make profit. The most common securities fraud schemes are called “pump and dump” and “poop and scoop”.

Internal MISP references

UUID bc85e12f-6663-567c-a422-180252963838 which can be used as unique global reference for Manipulate Stocks in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0137.006
kill_chain ['tactics:Plan Objectives']

Motivate to Act

Persuade, impel, or provoke the target to behave in a specific manner favourable to the attacker. Some common behaviours are joining, subscribing, voting, buying, demonstrating, fighting, retreating, resigning, boycotting.

Internal MISP references

UUID b0b363b2-8dc8-5be1-86f3-6da1b08427ae which can be used as unique global reference for Motivate to Act in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0138
kill_chain ['tactics:Plan Objectives']

Encourage

Inspire, animate, or exhort a target to act. An actor can use propaganda, disinformation, or conspiracy theories to stimulate a target to act in its interest.

Internal MISP references

UUID 7e4979e2-a6ce-5c9c-a153-2c0cdcefee24 which can be used as unique global reference for Encourage in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0138.001
kill_chain ['tactics:Plan Objectives']

Provoke

Instigate, incite, or arouse a target to act. Social media manipulators exploit moral outrage to propel targets to spread hate, take to the streets to protest, or engage in acts of violence.

Internal MISP references

UUID ce2c3d20-781c-5f85-a329-633bfd0b735d which can be used as unique global reference for Provoke in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0138.002
kill_chain ['tactics:Plan Objectives']

Compel

Force target to take an action or to stop taking an action it has already started. Actors can use the threat of reputational damage alongside military or economic threats to compel a target.

Internal MISP references

UUID df4308e1-d324-57dc-b2e5-63dd8c4f884b which can be used as unique global reference for Compel in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0138.003
kill_chain ['tactics:Plan Objectives']

Dissuade from Acting

Discourage, deter, or inhibit the target from actions which would be unfavourable to the attacker. The actor may want the target to refrain from voting, buying, fighting, or supplying.

Internal MISP references

UUID 854d0c3d-ea59-5e49-bc38-bee72958a0fb which can be used as unique global reference for Dissuade from Acting in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0139
kill_chain ['tactics:Plan Objectives']

Discourage

To make a target disinclined or reluctant to act. Manipulators use disinformation to cause targets to question the utility, legality, or morality of taking an action.

Internal MISP references

UUID 841f2f99-397b-5834-87a0-69e1d62cc68f which can be used as unique global reference for Discourage in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0139.001
kill_chain ['tactics:Plan Objectives']

Silence

Intimidate or incentivise target into remaining silent or prevent target from speaking out. A threat actor may cow a target into silence as a special case of deterrence. Or they may buy the target’s silence. Or they may repress or restrict the target’s speech.

Internal MISP references

UUID 403d3951-1a59-5c34-b0da-08f6781b9562 which can be used as unique global reference for Silence in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0139.002
kill_chain ['tactics:Plan Objectives']

Deter

Prevent target from taking an action for fear of the consequences. Deterrence occurs in the mind of the target, who fears they will be worse off if they take an action than if they don’t. When making threats, aggressors may bluff, feign irrationality, or engage in brinksmanship.

Internal MISP references

UUID 29b445b6-6d90-5b67-af56-3d78a0cd1343 which can be used as unique global reference for Deter in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0139.003
kill_chain ['tactics:Plan Objectives']

Cause Harm

Persecute, malign, or inflict pain upon a target. The objective of a campaign may be to cause fear or emotional distress in a target. In some cases, harm is instrumental to achieving a primary objective, as in coercion, repression, or intimidation. In other cases, harm may be inflicted for the satisfaction of the perpetrator, as in revenge or sadistic cruelty.

Internal MISP references

UUID 0f9fbfeb-5b2f-5aa1-91fa-133841b458c7 which can be used as unique global reference for Cause Harm in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0140
kill_chain ['tactics:Plan Objectives']

Defame

Attempt to damage the target’s personal reputation by impugning their character. This can range from subtle attempts to misrepresent or insinuate, to obvious attempts to denigrate or disparage, to blatant attempts to malign or vilify. Slander applies to oral expression. Libel applies to written or pictorial material. Defamation is often carried out by online trolls. The sole aim here is to cause harm to the target. If the threat actor uses defamation as a means of undermining the target, then choose sub-technique “Smear” of technique “Undermine” instead.

Internal MISP references

UUID 79dd50a8-0b49-59f1-a820-1c76656cd836 which can be used as unique global reference for Defame in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0140.001
kill_chain ['tactics:Plan Objectives']

Intimidate

Coerce, bully, or frighten the target. An influence operation may use intimidation to compel the target to act against their will. Or the goal may be to frighten or even terrify the target into silence or submission. In some cases, the goal is simply to make the victim suffer.

Internal MISP references

UUID 3d2bdd06-fdcc-5c08-b71e-6aec4315cc2b which can be used as unique global reference for Intimidate in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0140.002
kill_chain ['tactics:Plan Objectives']

Spread Hate

Publish and/or propagate demeaning, derisive, or humiliating content targeting an individual or group of individuals with the intent to cause emotional, psychological, or physical distress. Hate speech can cause harm directly or incite others to harm the target. It often aims to stigmatise the target by singling out immutable characteristics such as colour, race, religion, national or ethnic origin, gender, gender identity, sexual orientation, age, disease, or mental or physical disability. Thus, promoting hatred online may involve racism, antisemitism, Islamophobia, xenophobia, sexism, misogyny, homophobia, transphobia, ageism, ableism, or any combination thereof. Motivations for hate speech range from group preservation to ideological superiority to the unbridled infliction of suffering.

Internal MISP references

UUID 823c3b54-8eac-5772-8e1c-b7fd55bbe518 which can be used as unique global reference for Spread Hate in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0140.003
kill_chain ['tactics:Plan Objectives']