Software, Groups, and Campaigns
The Software, Groups, and Campaigns domain tests whether you can distinguish three linked but different ATT&CK object types. ATT&CK uses Software (S####) for tools and malware, Groups (G####) for intrusion sets, and Campaigns (C####) for a set of intrusion activity with a common objective over a period. A group page aggregates aliases, associated campaigns, software, techniques, and references. A software page describes a tool or malware family and lists the techniques observed in its use. A campaign page links activity that may involve one or more groups and one or more software families. These relationships are many-to-many and evidence-based.
Core rules
- A group is not a malware family and not necessarily a single organization.
- Shared software does not prove shared identity; commodity tools are reused widely.
- Campaigns are scoped by activity and time, not by a permanent actor label.
- Aliases differ across vendors; use the ATT&CK group ID and note aliases carefully.
Worked example
A malware sample is observed in two intrusions. One report attributes it to a named group; another only describes the campaign. The analyst should record the software (S####), the campaign (C####), and the group (G####) only where the source supports the link. The technique list on the software page shows what the tool can do; the group page shows what that actor has been observed doing. Neither proves that every technique in the list occurred in this intrusion.
Traps
The biggest trap is inferring attribution from a technique or tool overlap. Another is treating a campaign as a synonym for a group. Vendor aliases can create duplicate actor tracking. Finally, do not assume a software page's technique list is exhaustive or that a group always uses all listed software.