/**
 * Cyber-Assistant — Pack de référentiel : MITRE ATT&CK Enterprise v19 — Scénarios composites (v19 (avril 2026))
 * GÉNÉRÉ depuis BROUILLON-PACKS-L4-2026-08-04.md (validation PO du 04/08 —
 * délégation de confiance). Données GÉNÉRIQUES, aucune donnée client.
 * Lecture seule — cf. modules/threat-catalog.js et l'étude §4.
 */
(function () {
  'use strict';
  window._csiThreatCatalogs = window._csiThreatCatalogs || {};
  window._csiThreatCatalogs["mitre-attack-v19"] =
  {
    "meta": {
      "id": "mitre-attack-v19",
      "name": "MITRE ATT&CK Enterprise v19 — Scénarios composites",
      "nameEn": "MITRE ATT&CK Enterprise v19 — Composite Attack Scenarios",
      "nameNl": "MITRE ATT&CK Enterprise v19 — Samengestelde aanvalsscenario's",
      "version": "v19 (avril 2026)",
      "publishedAt": "2026-04",
      "sourceDocument": "MITRE ATT&CK® Enterprise Matrix v19 — tactiques (TA) et techniques (T)",
      "organization": "The MITRE Corporation",
      "kind": "adversary",
      "natureKind": "Scénarios d'attaque composites (TTP adverses)",
      "natureKindEn": "Composite attack scenarios (adversary TTPs)",
      "natureKindNl": "Samengestelde aanvalsscenario's (TTP's van aanvallers)",
      "licence": "MITRE ATT&CK® — utilisation commerciale autorisée sous réserve de la mention de permission reproduite dans le disclaimer (ATT&CK Terms of Use)",
      "disclaimer": "© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. — Les 14 scénarios composites sont des compositions rédigées par Cyber-Assistant, étiquetées avec les identifiants officiels de tactiques (TA) et de techniques (T) d’ATT&CK Enterprise v19 ; ils ne sont ni produits ni endossés par MITRE. ATT&CK® est une marque de The MITRE Corporation.",
      "disclaimerEn": "© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. — The 14 composite scenarios are compositions authored by Cyber-Assistant, labeled with official ATT&CK Enterprise v19 tactic (TA) and technique (T) identifiers; they are neither produced nor endorsed by MITRE. ATT&CK® is a registered trademark of The MITRE Corporation."
    },
    "threats": [
      {
        "id": "MITRE_01_T",
        "ref": "TA0001 Initial Access → TA0002 Execution → TA0112 Defense Impairment → TA0040 Impact · T1566 Phishing · T1685 Disable or Modify Tools · T1486 Data Encrypted for Impact",
        "label": "Chaîne rançongiciel",
        "labelEn": "Ransomware Chain",
        "labelNl": "Ransomwareketen",
        "adversarial": true,
        "domainHints": [
          "INFRA",
          "BCP",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 5
        }
      },
      {
        "id": "MITRE_02_T",
        "ref": "TA0001 Initial Access → TA0003 Persistence → TA0008 Lateral Movement · T1190 Exploit Public-Facing Application · T1505.003 Web Shell · T1021 Remote Services",
        "label": "Intrusion applicative exposée",
        "labelEn": "Exposed Application Intrusion",
        "labelNl": "Inbraak via blootgestelde applicatie",
        "adversarial": true,
        "domainHints": [
          "VULN",
          "INFRA",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 4
        }
      },
      {
        "id": "MITRE_03_T",
        "ref": "TA0006 Credential Access → TA0001 Initial Access → TA0009 Collection · T1110.004 Credential Stuffing · T1078 Valid Accounts · T1114 Email Collection",
        "label": "Détournement de comptes",
        "labelEn": "Account Takeover",
        "labelNl": "Accountovername",
        "adversarial": true,
        "domainHints": [
          "IAM",
          "NETCRYPTO",
          "LOG"
        ],
        "defaults": {
          "likelihood": 4,
          "impact": 3
        }
      },
      {
        "id": "MITRE_04_T",
        "ref": "TA0043 Reconnaissance → TA0042 Resource Development → TA0001 Initial Access · T1598 Phishing for Information · T1583 Acquire Infrastructure · T1566.002 Spearphishing Link",
        "label": "Attaque ciblée préparée",
        "labelEn": "Prepared Targeted Attack",
        "labelNl": "Voorbereide gerichte aanval",
        "adversarial": true,
        "domainHints": [
          "IAM",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 3
        }
      },
      {
        "id": "MITRE_05_T",
        "ref": "TA0001 Initial Access → TA0002 Execution → TA0011 Command and Control · T1195.002 Compromise Software Supply Chain · T1059 Command and Scripting Interpreter · T1071 Application Layer Protocol",
        "label": "Chaîne logicielle piégée",
        "labelEn": "Trojanized Supply Chain",
        "labelNl": "Gemanipuleerde softwareketen",
        "adversarial": true,
        "domainHints": [
          "SDLC",
          "VULN",
          "LOG"
        ],
        "defaults": {
          "likelihood": 2,
          "impact": 4
        }
      },
      {
        "id": "MITRE_06_T",
        "ref": "TA0004 Privilege Escalation → TA0006 Credential Access → TA0008 Lateral Movement · T1068 Exploitation for Privilege Escalation · T1003 OS Credential Dumping · T1550 Use Alternate Authentication Material",
        "label": "Prise de contrôle domaine",
        "labelEn": "Domain Takeover",
        "labelNl": "Overname van het domein",
        "adversarial": true,
        "domainHints": [
          "IAM",
          "VULN",
          "LOG"
        ],
        "defaults": {
          "likelihood": 2,
          "impact": 5
        }
      },
      {
        "id": "MITRE_07_T",
        "ref": "TA0003 Persistence → TA0005 Stealth → TA0007 Discovery → TA0010 Exfiltration · T1547 Boot or Logon Autostart Execution · T1027 Obfuscated Files or Information · T1041 Exfiltration Over C2 Channel",
        "label": "Espionnage discret durable",
        "labelEn": "Stealthy Long-term Espionage",
        "labelNl": "Heimelijke langdurige spionage",
        "adversarial": true,
        "domainHints": [
          "LOG",
          "NETCRYPTO",
          "DATA"
        ],
        "defaults": {
          "likelihood": 2,
          "impact": 4
        }
      },
      {
        "id": "MITRE_08_T",
        "ref": "TA0009 Collection → TA0010 Exfiltration · T1005 Data from Local System · T1530 Data from Cloud Storage · T1567 Exfiltration Over Web Service",
        "label": "Exfiltration par initié",
        "labelEn": "Insider Exfiltration",
        "labelNl": "Exfiltratie door insider",
        "adversarial": true,
        "domainHints": [
          "DATA",
          "LOG",
          "IAM"
        ],
        "defaults": {
          "likelihood": 2,
          "impact": 4
        }
      },
      {
        "id": "MITRE_09_T",
        "ref": "TA0112 Defense Impairment → TA0040 Impact · T1685 Disable or Modify Tools · T1485 Data Destruction · T1490 Inhibit System Recovery",
        "label": "Sabotage destructeur",
        "labelEn": "Destructive Sabotage",
        "labelNl": "Destructieve sabotage",
        "adversarial": true,
        "domainHints": [
          "LOG",
          "INFRA",
          "BCP"
        ],
        "defaults": {
          "likelihood": 1,
          "impact": 5
        }
      },
      {
        "id": "MITRE_10_T",
        "ref": "TA0006 Credential Access → TA0001 Initial Access → TA0008 Lateral Movement · T1110 Brute Force · T1133 External Remote Services · T1021.001 Remote Desktop Protocol",
        "label": "Intrusion accès distant",
        "labelEn": "Remote Access Intrusion",
        "labelNl": "Inbraak via externe toegang",
        "adversarial": true,
        "domainHints": [
          "IAM",
          "NETCRYPTO",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 4
        }
      },
      {
        "id": "MITRE_11_T",
        "ref": "TA0043 Reconnaissance → TA0009 Collection → TA0010 Exfiltration · T1595 Active Scanning · T1530 Data from Cloud Storage",
        "label": "Pillage stockage cloud",
        "labelEn": "Cloud Storage Looting",
        "labelNl": "Plundering van cloudopslag",
        "adversarial": true,
        "domainHints": [
          "INFRA",
          "DATA",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 4
        }
      },
      {
        "id": "MITRE_12_T",
        "ref": "TA0042 Resource Development → TA0040 Impact · T1583.005 Botnet · T1498 Network Denial of Service · T1499 Endpoint Denial of Service",
        "label": "DDoS avec extorsion",
        "labelEn": "Ransom DDoS",
        "labelNl": "DDoS met afpersing",
        "adversarial": true,
        "domainHints": [
          "NETCRYPTO",
          "BCP"
        ],
        "defaults": {
          "likelihood": 2,
          "impact": 3
        }
      },
      {
        "id": "MITRE_13_T",
        "ref": "TA0001 Initial Access → TA0009 Collection → TA0040 Impact · T1566 Phishing · T1114 Email Collection · T1657 Financial Theft",
        "label": "Fraude au virement",
        "labelEn": "Wire Transfer Fraud",
        "labelNl": "Overschrijvingsfraude",
        "adversarial": true,
        "domainHints": [
          "IAM",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 4
        }
      },
      {
        "id": "MITRE_14_T",
        "ref": "TA0011 Command and Control → TA0010 Exfiltration · T1071.001 Web Protocols · T1572 Protocol Tunneling · T1041 Exfiltration Over C2 Channel",
        "label": "Canal de commande furtif",
        "labelEn": "Covert Command Channel",
        "labelNl": "Verborgen commandokanaal",
        "adversarial": true,
        "domainHints": [
          "NETCRYPTO",
          "LOG"
        ],
        "defaults": {
          "likelihood": 2,
          "impact": 3
        }
      }
    ],
    "scenarios": [
      {
        "id": "MITRE_01",
        "threatId": "MITRE_01_T",
        "ref": "TA0001 Initial Access → TA0002 Execution → TA0112 Defense Impairment → TA0040 Impact · T1566 Phishing · T1685 Disable or Modify Tools · T1486 Data Encrypted for Impact",
        "label": "Hameçonnage initial, exécution de la charge, défenses désactivées puis chiffrement massif avec rançon",
        "labelEn": "Initial phishing, payload execution, defenses disabled, then mass encryption with ransom demand",
        "labelNl": "Initiële phishing, uitvoering van de payload, uitgeschakelde verdediging en massale versleuteling met losgeld",
        "domainHints": [
          "INFRA",
          "BCP",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 5
        }
      },
      {
        "id": "MITRE_02",
        "threatId": "MITRE_02_T",
        "ref": "TA0001 Initial Access → TA0003 Persistence → TA0008 Lateral Movement · T1190 Exploit Public-Facing Application · T1505.003 Web Shell · T1021 Remote Services",
        "label": "Application exposée exploitée, webshell persistant déposé puis progression vers les serveurs internes",
        "labelEn": "Exposed application exploited, persistent webshell planted, then progression towards internal servers",
        "labelNl": "Blootgestelde applicatie uitgebuit, persistente webshell geplaatst en daarna doorgedrongen naar interne servers",
        "domainHints": [
          "VULN",
          "INFRA",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 4
        }
      },
      {
        "id": "MITRE_03",
        "threatId": "MITRE_03_T",
        "ref": "TA0006 Credential Access → TA0001 Initial Access → TA0009 Collection · T1110.004 Credential Stuffing · T1078 Valid Accounts · T1114 Email Collection",
        "label": "Bourrage d'identifiants sur la messagerie cloud puis pillage des boîtes aux lettres compromises",
        "labelEn": "Credential stuffing against cloud email, then looting of the compromised mailboxes",
        "labelNl": "Credential stuffing op de cloudmailbox, gevolgd door plundering van de gecompromitteerde postbussen",
        "domainHints": [
          "IAM",
          "NETCRYPTO",
          "LOG"
        ],
        "defaults": {
          "likelihood": 4,
          "impact": 3
        }
      },
      {
        "id": "MITRE_04",
        "threatId": "MITRE_04_T",
        "ref": "TA0043 Reconnaissance → TA0042 Resource Development → TA0001 Initial Access · T1598 Phishing for Information · T1583 Acquire Infrastructure · T1566.002 Spearphishing Link",
        "label": "Reconnaissance publique de l'organisation, infrastructure d'attaque dédiée puis hameçonnage ciblé sur mesure",
        "labelEn": "Public reconnaissance of the organization, dedicated attack infrastructure, then tailor-made spear phishing",
        "labelNl": "Publieke verkenning van de organisatie, toegewijde aanvalsinfrastructuur en vervolgens phishing op maat",
        "domainHints": [
          "IAM",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 3
        }
      },
      {
        "id": "MITRE_05",
        "threatId": "MITRE_05_T",
        "ref": "TA0001 Initial Access → TA0002 Execution → TA0011 Command and Control · T1195.002 Compromise Software Supply Chain · T1059 Command and Scripting Interpreter · T1071 Application Layer Protocol",
        "label": "Mise à jour logicielle piégée déployée en interne, code exécuté et canal de commande établi",
        "labelEn": "Booby-trapped software update deployed internally, code executed and command channel established",
        "labelNl": "Geprepareerde software-update intern uitgerold, code uitgevoerd en commandokanaal opgezet",
        "domainHints": [
          "SDLC",
          "VULN",
          "LOG"
        ],
        "defaults": {
          "likelihood": 2,
          "impact": 4
        }
      },
      {
        "id": "MITRE_06",
        "threatId": "MITRE_06_T",
        "ref": "TA0004 Privilege Escalation → TA0006 Credential Access → TA0008 Lateral Movement · T1068 Exploitation for Privilege Escalation · T1003 OS Credential Dumping · T1550 Use Alternate Authentication Material",
        "label": "Élévation de privilèges sur un poste, secrets d'authentification extraits puis annuaire d'entreprise contrôlé",
        "labelEn": "Privilege escalation on a workstation, authentication secrets dumped, then corporate directory controlled",
        "labelNl": "Escalatie van bevoegdheden op een werkstation, authenticatiegeheimen buitgemaakt en bedrijfsdirectory overgenomen",
        "domainHints": [
          "IAM",
          "VULN",
          "LOG"
        ],
        "defaults": {
          "likelihood": 2,
          "impact": 5
        }
      },
      {
        "id": "MITRE_07",
        "threatId": "MITRE_07_T",
        "ref": "TA0003 Persistence → TA0005 Stealth → TA0007 Discovery → TA0010 Exfiltration · T1547 Boot or Logon Autostart Execution · T1027 Obfuscated Files or Information · T1041 Exfiltration Over C2 Channel",
        "label": "Implant furtif durablement installé, réseau cartographié en silence et documents exfiltrés lentement",
        "labelEn": "Stealthy implant durably installed, network silently mapped and documents slowly exfiltrated",
        "labelNl": "Heimelijk implantaat duurzaam geïnstalleerd, netwerk geruisloos in kaart gebracht en documenten traag geëxfiltreerd",
        "domainHints": [
          "LOG",
          "NETCRYPTO",
          "DATA"
        ],
        "defaults": {
          "likelihood": 2,
          "impact": 4
        }
      },
      {
        "id": "MITRE_08",
        "threatId": "MITRE_08_T",
        "ref": "TA0009 Collection → TA0010 Exfiltration · T1005 Data from Local System · T1530 Data from Cloud Storage · T1567 Exfiltration Over Web Service",
        "label": "Un compte interne légitime collecte massivement des données puis les transfère vers un cloud personnel",
        "labelEn": "A legitimate internal account massively collects data, then transfers it to a personal cloud",
        "labelNl": "Een legitiem intern account verzamelt massaal gegevens en draagt ze over naar een persoonlijke cloud",
        "domainHints": [
          "DATA",
          "LOG",
          "IAM"
        ],
        "defaults": {
          "likelihood": 2,
          "impact": 4
        }
      },
      {
        "id": "MITRE_09",
        "threatId": "MITRE_09_T",
        "ref": "TA0112 Defense Impairment → TA0040 Impact · T1685 Disable or Modify Tools · T1485 Data Destruction · T1490 Inhibit System Recovery",
        "label": "Outils de sécurité et journaux désactivés puis systèmes et données détruits irréversiblement",
        "labelEn": "Security tooling and logs disabled, then systems and data irreversibly destroyed",
        "labelNl": "Beveiligingstools en logbestanden uitgeschakeld, waarna systemen en gegevens onherroepelijk worden vernietigd",
        "domainHints": [
          "LOG",
          "INFRA",
          "BCP"
        ],
        "defaults": {
          "likelihood": 1,
          "impact": 5
        }
      },
      {
        "id": "MITRE_10",
        "threatId": "MITRE_10_T",
        "ref": "TA0006 Credential Access → TA0001 Initial Access → TA0008 Lateral Movement · T1110 Brute Force · T1133 External Remote Services · T1021.001 Remote Desktop Protocol",
        "label": "Accès VPN ou RDP mal protégé forcé, puis déplacement latéral de serveur en serveur",
        "labelEn": "Poorly protected VPN or RDP access forced, then lateral movement from server to server",
        "labelNl": "Slecht beveiligde VPN- of RDP-toegang geforceerd, daarna laterale verplaatsing van server naar server",
        "domainHints": [
          "IAM",
          "NETCRYPTO",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 4
        }
      },
      {
        "id": "MITRE_11",
        "threatId": "MITRE_11_T",
        "ref": "TA0043 Reconnaissance → TA0009 Collection → TA0010 Exfiltration · T1595 Active Scanning · T1530 Data from Cloud Storage",
        "label": "Stockage cloud mal configuré repéré par scan, contenu massivement copié vers l'extérieur",
        "labelEn": "Misconfigured cloud storage found by scanning, contents massively copied outward",
        "labelNl": "Verkeerd geconfigureerde cloudopslag gevonden via scans, inhoud massaal naar buiten gekopieerd",
        "domainHints": [
          "INFRA",
          "DATA",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 4
        }
      },
      {
        "id": "MITRE_12",
        "threatId": "MITRE_12_T",
        "ref": "TA0042 Resource Development → TA0040 Impact · T1583.005 Botnet · T1498 Network Denial of Service · T1499 Endpoint Denial of Service",
        "label": "Botnet loué saturant les services exposés, rançon exigée pour cesser l'attaque",
        "labelEn": "Rented botnet flooding exposed services, ransom demanded to stop the attack",
        "labelNl": "Gehuurd botnet overbelast de blootgestelde diensten, losgeld geëist om de aanval te stoppen",
        "domainHints": [
          "NETCRYPTO",
          "BCP"
        ],
        "defaults": {
          "likelihood": 2,
          "impact": 3
        }
      },
      {
        "id": "MITRE_13",
        "threatId": "MITRE_13_T",
        "ref": "TA0001 Initial Access → TA0009 Collection → TA0040 Impact · T1566 Phishing · T1114 Email Collection · T1657 Financial Theft",
        "label": "Boîte de direction compromise, échanges de facturation surveillés puis paiements détournés vers l’attaquant",
        "labelEn": "Executive mailbox compromised, invoicing exchanges monitored, then payments diverted to the attacker",
        "labelNl": "Gecompromitteerde directiemailbox, factuurverkeer bespied en betalingen omgeleid naar de aanvaller",
        "domainHints": [
          "IAM",
          "LOG"
        ],
        "defaults": {
          "likelihood": 3,
          "impact": 4
        }
      },
      {
        "id": "MITRE_14",
        "threatId": "MITRE_14_T",
        "ref": "TA0011 Command and Control → TA0010 Exfiltration · T1071.001 Web Protocols · T1572 Protocol Tunneling · T1041 Exfiltration Over C2 Channel",
        "label": "Communications de contrôle dissimulées dans des flux légitimes pour piloter l'intrusion et exfiltrer",
        "labelEn": "Control communications hidden inside legitimate traffic to drive the intrusion and exfiltrate",
        "labelNl": "Besturingscommunicatie verborgen in legitiem verkeer om de inbraak aan te sturen en te exfiltreren",
        "domainHints": [
          "NETCRYPTO",
          "LOG"
        ],
        "defaults": {
          "likelihood": 2,
          "impact": 3
        }
      }
    ]
  };
})();
