nx_attack_taxonomy.nx source
↩ module page · 165 lines · 7315 B
1// nx_attack_taxonomy.nx -- MITRE ATT&CK + CWE sealed-enum reference.
2//
3// license_tier: INDEPENDENT_REDERIVE
4// genealogy_id: international-research-sources/mitre/attack_cwe
5//
6// MITRE ATT&CK Enterprise Tactics + CWE Top 5 weakness IDs encoded
7// as substrate sealed enums. The taxonomy itself is fact (the
8// names + numeric IDs published by MITRE); we never copy ATT&CK
9// prose / descriptions / technique catalogs into substrate code.
10//
11// This file is the foundation for two future Layer-3 grader
12// perspectives:
13// 1. nx_attack_grader -- scans substrate source for code patterns
14// indicative of ATT&CK techniques + maps to
15// tactics; emits "tactic-coverage" verdict
16// per file (a defensive-review signal).
17// 2. nx_cwe_grader -- scans for substrate code patterns
18// indicative of CWE Top 25 weaknesses;
19// emits per-CWE LOSE with named_improvement.
20//
21// Both consume the sealed enums declared here so the taxonomy lives
22// in one place.
23//
24// Licensing note: MITRE ATT&CK is published under CC-BY 4.0
25// (attribution-required, banned from substrate code per the wall).
26// We INDEPENDENT_REDERIVE the taxonomy by re-encoding the NUMERIC IDS
27// (uncopyrightable facts) and re-paraphrasing names in our own
28// language; no prose, no descriptions, no technique catalog text
29// crosses into this file.
30//
31// Reference (research only -- do NOT include in substrate output):
32// https://attack.mitre.org/ (CC-BY 4.0)
33// https://cwe.mitre.org/ (free public catalog)
34
35// nx_safety_envelope:
36// intended_use: AUTO_APPLIED -- primitive-specific tuning queued
37// sil_target: SIL1
38// evidence: [bulk_applied_2026-05-16, see-file-comment-for-detail]
39// verdict: NOT_YET_EVALUATED
40
41import "nx_syscalls.nx"
42import "nx_runtime.nx"
43import "nx_types.nx"
44import "nx_tier.nx"
45
46// ---- ATT&CK Enterprise Tactics (14) --------------------------------
47//
48// Ordered by MITRE's "kill-chain" sequence: reconnaissance through
49// impact. Numeric values are substrate-internal (0..13), distinct
50// from MITRE's TA0001-TA0043 IDs (which we expose via the
51// nx_attack_tactic_mitre_id helper below).
52
53const NX_ATTACK_TA_RECON: nx_int = 0
54const NX_ATTACK_TA_RESOURCE_DEV: nx_int = 1
55const NX_ATTACK_TA_INITIAL_ACCESS: nx_int = 2
56const NX_ATTACK_TA_EXECUTION: nx_int = 3
57const NX_ATTACK_TA_PERSISTENCE: nx_int = 4
58const NX_ATTACK_TA_PRIV_ESC: nx_int = 5
59const NX_ATTACK_TA_DEFENSE_EVASION: nx_int = 6
60const NX_ATTACK_TA_CRED_ACCESS: nx_int = 7
61const NX_ATTACK_TA_DISCOVERY: nx_int = 8
62const NX_ATTACK_TA_LATERAL: nx_int = 9
63const NX_ATTACK_TA_COLLECTION: nx_int = 10
64const NX_ATTACK_TA_C2: nx_int = 11
65const NX_ATTACK_TA_EXFIL: nx_int = 12
66const NX_ATTACK_TA_IMPACT: nx_int = 13
67const NX_ATTACK_TA_N: nx_int = 14
68
69func nx_attack_tactic_is_valid(t: nx_int) -> nx_int {
70 if t < 0 { return 0 }
71 if t >= NX_ATTACK_TA_N { return 0 }
72 return 1
73}
74
75// Substrate-internal name (paraphrased, not copied from MITRE).
76func nx_attack_tactic_name(t: nx_int) -> *u8 {
77 if t == NX_ATTACK_TA_RECON { return "reconnaissance" as *u8 }
78 if t == NX_ATTACK_TA_RESOURCE_DEV { return "resource-development" as *u8 }
79 if t == NX_ATTACK_TA_INITIAL_ACCESS { return "initial-access" as *u8 }
80 if t == NX_ATTACK_TA_EXECUTION { return "execution" as *u8 }
81 if t == NX_ATTACK_TA_PERSISTENCE { return "persistence" as *u8 }
82 if t == NX_ATTACK_TA_PRIV_ESC { return "privilege-escalation" as *u8 }
83 if t == NX_ATTACK_TA_DEFENSE_EVASION { return "defense-evasion" as *u8 }
84 if t == NX_ATTACK_TA_CRED_ACCESS { return "credential-access" as *u8 }
85 if t == NX_ATTACK_TA_DISCOVERY { return "discovery" as *u8 }
86 if t == NX_ATTACK_TA_LATERAL { return "lateral-movement" as *u8 }
87 if t == NX_ATTACK_TA_COLLECTION { return "collection" as *u8 }
88 if t == NX_ATTACK_TA_C2 { return "command-and-control" as *u8 }
89 if t == NX_ATTACK_TA_EXFIL { return "exfiltration" as *u8 }
90 if t == NX_ATTACK_TA_IMPACT { return "impact" as *u8 }
91 return "unknown" as *u8
92}
93
94// MITRE-assigned ID (uncopyrightable numeric fact).
95func nx_attack_tactic_mitre_id(t: nx_int) -> nx_int {
96 if t == NX_ATTACK_TA_RECON { return 43 } // TA0043
97 if t == NX_ATTACK_TA_RESOURCE_DEV { return 42 } // TA0042
98 if t == NX_ATTACK_TA_INITIAL_ACCESS { return 1 } // TA0001
99 if t == NX_ATTACK_TA_EXECUTION { return 2 } // TA0002
100 if t == NX_ATTACK_TA_PERSISTENCE { return 3 } // TA0003
101 if t == NX_ATTACK_TA_PRIV_ESC { return 4 } // TA0004
102 if t == NX_ATTACK_TA_DEFENSE_EVASION { return 5 } // TA0005
103 if t == NX_ATTACK_TA_CRED_ACCESS { return 6 } // TA0006
104 if t == NX_ATTACK_TA_DISCOVERY { return 7 } // TA0007
105 if t == NX_ATTACK_TA_LATERAL { return 8 } // TA0008
106 if t == NX_ATTACK_TA_COLLECTION { return 9 } // TA0009
107 if t == NX_ATTACK_TA_C2 { return 11 } // TA0011
108 if t == NX_ATTACK_TA_EXFIL { return 10 } // TA0010
109 if t == NX_ATTACK_TA_IMPACT { return 40 } // TA0040
110 return -1
111}
112
113// ---- CWE Top 5 (memory-safety + injection) -------------------------
114//
115// First cut: substrate-relevant weakness IDs. Extended Top 25
116// queued. Numeric IDs are uncopyrightable facts published by MITRE.
117
118const NX_CWE_BUFFER_OVERFLOW: nx_int = 0 // CWE-119
119const NX_CWE_OOB_READ: nx_int = 1 // CWE-125
120const NX_CWE_OOB_WRITE: nx_int = 2 // CWE-787
121const NX_CWE_USE_AFTER_FREE: nx_int = 3 // CWE-416
122const NX_CWE_NULL_DEREF: nx_int = 4 // CWE-476
123const NX_CWE_N: nx_int = 5
124
125func nx_cwe_is_valid(c: nx_int) -> nx_int {
126 if c < 0 { return 0 }
127 if c >= NX_CWE_N { return 0 }
128 return 1
129}
130
131func nx_cwe_mitre_id(c: nx_int) -> nx_int {
132 if c == NX_CWE_BUFFER_OVERFLOW { return 119 }
133 if c == NX_CWE_OOB_READ { return 125 }
134 if c == NX_CWE_OOB_WRITE { return 787 }
135 if c == NX_CWE_USE_AFTER_FREE { return 416 }
136 if c == NX_CWE_NULL_DEREF { return 476 }
137 return -1
138}
139
140func nx_cwe_name(c: nx_int) -> *u8 {
141 if c == NX_CWE_BUFFER_OVERFLOW { return "buffer-overflow" as *u8 }
142 if c == NX_CWE_OOB_READ { return "out-of-bounds-read" as *u8 }
143 if c == NX_CWE_OOB_WRITE { return "out-of-bounds-write" as *u8 }
144 if c == NX_CWE_USE_AFTER_FREE { return "use-after-free" as *u8 }
145 if c == NX_CWE_NULL_DEREF { return "null-pointer-dereference" as *u8 }
146 return "unknown" as *u8
147}
148
149// ---- Substrate-internal severity bands (parallel to nx_quality_grade)
150//
151// Allows a future scanner to emit per-CWE verdict using the same
152// sealed enum the rest of the grader stack consumes.
153
154const NX_ATTACK_SEV_INFO: nx_int = 0
155const NX_ATTACK_SEV_LOW: nx_int = 1
156const NX_ATTACK_SEV_MEDIUM: nx_int = 2
157const NX_ATTACK_SEV_HIGH: nx_int = 3
158const NX_ATTACK_SEV_CRITICAL: nx_int = 4
159const NX_ATTACK_SEV_N: nx_int = 5
160
161func nx_attack_sev_is_valid(s: nx_int) -> nx_int {
162 if s < 0 { return 0 }
163 if s >= NX_ATTACK_SEV_N { return 0 }
164 return 1
165}