Skip to content

T1548.002 (Abuse Elevation Control Mechanism: Bypass UAC) not found via get_techniques() #91

@gracia-villarreal

Description

@gracia-villarreal

Bug Report

Description:
When calling get_techniques(include_subtechniques=True) and filtering by external ID T1548.002,
the technique is not returned despite being present in the official MITRE ATT&CK database.

Steps to Reproduce:

from attackcti import attack_client
c = attack_client()
all_tech = c.get_techniques(include_subtechniques=True)
found = [t for t in all_tech if any(
    r.get('external_id') == 'T1548.002' 
    for r in t.get('external_references', [])
)]
print(f'Found: {len(found)}')  # Returns 0

Expected Behavior:
T1548.002 should be returned as it exists on the official MITRE ATT&CK site:
https://attack.mitre.org/techniques/T1548/002/

Environment:

  • attackcti version: 0.6.4
  • Python version: 3.14
  • Last Modified on MITRE site: April 15, 2026

Additional Context:
Discovered while building an automated detection pipeline that cross-references
Sysmon telemetry with MITRE ATT&CK and D3FEND. The technique was identified by
AI triage but could not be enriched due to this lookup gap.

Observed behavior in context:

  • MITRE ATT&CK official site: T1548.002 exists, last modified April 15, 2026
  • AI triage (Gemini): correctly identified T1548.002 from Sysmon telemetry
  • D3FEND API: returned 35 countermeasures for T1548
  • attackcti get_techniques(): returns 0 results for T1548.002

This suggests the library may not be pulling the most recent ATT&CK content,
or T1548.002 may be missing from the STIX/TAXII data that attackcti queries.

Image

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions