Skip to content

Commit 3ff447d

Browse files
iZonexiZonex
committed
OAK v0.1.0-draft — initial public release
OnChain Attack Knowledge: an open, vendor-neutral taxonomy of adversary tactics and techniques observed against on-chain assets. Independently authored, not affiliated with MITRE Corporation or the ATT&CK framework. v0.1 contents: - 14 Tactics (T1-T8 operator-behaviour kill chain + T9-T14 realization tracks) - 62 Techniques with description, indicators, detection signals, examples, mitigations, citations - 40 Mitigations across detection / architecture / operational / venue / wallet-UX / financial-recovery classes - 40 Software entries (drainer kits, DPRK families, ransomware binaries, commodity infostealers, crypto-specific tooling) - 18 Threat Actors with explicit attribution-strength labels - 12 Data Sources axis - 142 worked examples spanning 2011-2025 - 964 citations (academic / federal-court / regulatory / industry-forensic), full URL audit complete - 416 machine-readable relationships in tools/oak.json (schema v2) - STIX 2.1 export at tools/oak-stix.json (601 SDOs/SROs) - Vite + React static site at onchainattack.org - CC-BY-SA 4.0 content / MIT tooling Pre-launch: DNS configuration on onchainattack.org, peer-review outreach via PEER-REVIEW.md, and defensive trademark registration of OAK.
0 parents  commit 3ff447d

382 files changed

Lines changed: 38707 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
blank_issues_enabled: true
2+
contact_links:
3+
- name: Sensitive disclosure (off-list)
4+
url: https://github.com/onchainattack/oak/blob/main/SECURITY.md
5+
about: |
6+
For non-public incident information, threat-actor intelligence, or
7+
vulnerabilities in OAK itself, contact maintainers off-list per
8+
SECURITY.md. Do not file a public issue.
9+
- name: Code of Conduct issues
10+
url: https://github.com/onchainattack/oak/blob/main/CODE_OF_CONDUCT.md
11+
about: |
12+
Reports go to the maintainer mailbox listed in CODE_OF_CONDUCT.md and
13+
are handled in confidence.

‎.github/ISSUE_TEMPLATE/coverage-update.md‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
name: Coverage update
3+
about: Update Reference-implementation coverage for an existing Technique
4+
title: "[Coverage] <implementation> covers <OAK-Tn.NNN>"
5+
labels: ["coverage"]
6+
assignees: []
7+
---
8+
9+
<!--
10+
Use this template to propose a Reference-implementation row for an existing
11+
Technique, or to update an existing row's coverage status. Vendors are
12+
encouraged to self-attest using this template; the v0.1 matrix is
13+
single-implementation and will expand with each accepted PR.
14+
-->
15+
16+
## Reference implementation
17+
18+
<!-- Name of the tool / dataset / vendor. Include link. -->
19+
20+
## Technique
21+
22+
<!-- OAK-Tn.NNN identifier. -->
23+
24+
## Coverage status (proposed)
25+
26+
- [ ] **full** — calibrated thresholds + tests against known-positive incidents
27+
- [ ] **partial** — covers under restricted conditions; gaps documented below
28+
- [ ] **gap** — Technique named but production-grade detection not yet implemented
29+
30+
## How the implementation covers it
31+
32+
<!-- 1–2 paragraphs: data sources, methodology, calibration approach. -->
33+
34+
## Public verifiability
35+
36+
<!-- Link to docs, source, or a write-up that lets reviewers independently verify the claim. Self-attestation without verifiability is downgraded to "self-attested" in the matrix. -->
37+
38+
## Affects COVERAGE.md?
39+
40+
- [ ] Yes — `COVERAGE.md` will be updated in the corresponding PR.
41+
- [ ] No — this is a new sub-row; no aggregate change.
42+
43+
## Conflict-of-interest disclosure
44+
45+
<!-- If you are a maintainer or employee of the implementing vendor, say so here. Doesn't disqualify the submission; we just record it. -->

‎.github/ISSUE_TEMPLATE/new-example.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
name: New real-world example
3+
about: Propose a public, verifiable incident for the examples corpus
4+
title: "[Example] <token / protocol> — <chain> — <YYYY-MM-DD>"
5+
labels: ["example"]
6+
assignees: []
7+
---
8+
9+
<!--
10+
Real-world examples cite public, verifiable incidents only. Do not link to
11+
live attacker infrastructure; link forensic write-ups, post-mortems, or
12+
public on-chain artefacts.
13+
-->
14+
15+
## Incident summary
16+
17+
<!-- 2–4 sentences. What happened, on which chain, when. -->
18+
19+
## OAK Techniques observed
20+
21+
<!-- One or more OAK-Tn.NNN identifiers. Briefly justify each. -->
22+
23+
## Public references
24+
25+
<!-- Forensic write-up, post-mortem, OFAC notice, on-chain transaction links. -->
26+
27+
## Loss (if public)
28+
29+
<!-- USD value at the time, with source. Omit if not publicly disclosed. -->
30+
31+
## Anything sensitive?
32+
33+
- [ ] All sources cited above are public.
34+
- [ ] No live attacker infrastructure is linked.
35+
- [ ] If non-public information is involved, it has been disclosed off-list per `SECURITY.md` and is not included in this issue.

‎.github/ISSUE_TEMPLATE/new-technique-proposal.md‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
---
2+
name: New Technique proposal
3+
about: Propose a new OAK Technique before drafting the page
4+
title: "[Technique] <short Technique name>"
5+
labels: ["proposal", "technique"]
6+
assignees: []
7+
---
8+
9+
<!--
10+
Per CONTRIBUTING.md §"Submission flow", open this issue first. Maintainers
11+
will comment on scope, ID assignment, or de-duplication before you spend
12+
effort drafting the full Technique page.
13+
-->
14+
15+
## Proposed Technique name
16+
17+
<!-- Short, defender-language name. Avoid offensive verbs ("how to ...") in the title. -->
18+
19+
## Proposed parent Tactic(s)
20+
21+
<!-- One or more of OAK-T1 .. OAK-T8. List T6 as a parent if Defense Evasion is a meaningful aspect. -->
22+
23+
## Why this is a distinct Technique
24+
25+
<!-- 1–2 paragraphs. What does this cover that is not already covered by an existing Technique? -->
26+
27+
## Observed indicators (preview)
28+
29+
<!-- Bullet list of what defenders see when this Technique is used. Sources/citations welcome. -->
30+
31+
## Real-world examples (preview)
32+
33+
<!-- At least one public, verifiable incident. Forensic write-ups, post-mortems, OFAC notices, on-chain links. -->
34+
35+
## Reference implementations known to cover this
36+
37+
<!-- Vendors, open-source detectors, or academic detectors. "None known" is also fine — that's a gap worth documenting. -->
38+
39+
## Citations (preview)
40+
41+
<!-- DOI / arXiv ID / published-report URL. -->
42+
43+
## Maturity self-rating
44+
45+
- [ ] **stable** — well-characterised in academia or industry; multiple public examples
46+
- [ ] **observed** — characterised; at least one public example
47+
- [ ] **emerging** — observed but methodology / calibration is open

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
<!--
2+
Thanks for contributing to OAK. Fill in the sections below; delete any that don't apply.
3+
See CONTRIBUTING.md for the full process and CODE_OF_CONDUCT.md for the contribution norms.
4+
-->
5+
6+
## What this PR does
7+
8+
<!-- One or two sentences. -->
9+
10+
## Type
11+
12+
- [ ] New Technique (`techniques/Tn.NNN-*.md`)
13+
- [ ] Tactic refinement (`tactics/Tn-*.md`)
14+
- [ ] Technique improvement (description, detection signals, mitigations, citations)
15+
- [ ] Reference-implementation mapping (added or updated row in a Technique's "Reference implementations" section)
16+
- [ ] Real-world example (`examples/*.md`)
17+
- [ ] Citation (`citations.bib`)
18+
- [ ] Tooling (`tools/`, `.github/`)
19+
- [ ] Documentation (README, CONTRIBUTING, COVERAGE, etc.)
20+
21+
## Linked issue
22+
23+
<!-- If this is a new Technique or non-trivial change, link the proposal issue (per CONTRIBUTING §"Submission flow"). -->
24+
25+
Closes #
26+
27+
## Checklist
28+
29+
- [ ] `npx markdownlint-cli2 "**/*.md"` passes locally.
30+
- [ ] `python tools/check_citations.py` passes locally (every cited `[key]` resolves to a `citations.bib` entry).
31+
- [ ] All citations in the changed pages point to public, verifiable sources.
32+
- [ ] No links to live attacker infrastructure (forensic write-ups and post-mortems only).
33+
- [ ] If this changes coverage status (full / partial / gap), `COVERAGE.md` is updated accordingly.
34+
- [ ] Commits are signed-off (`git commit -s`) per the DCO.
35+
36+
## Coverage impact (if applicable)
37+
38+
<!--
39+
If this PR moves a Technique between full / partial / gap, summarise:
40+
- Which Technique
41+
- From → to
42+
- Why (calibration, new detector, retired detector)
43+
- Whether COVERAGE.md is updated in this PR
44+
-->
45+
46+
## Notes for reviewers
47+
48+
<!-- Anything reviewers should pay particular attention to — non-obvious calibration, contested example, edge cases. -->

‎.github/workflows/citation-format.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: citation-format
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- "citations.bib"
7+
- "tools/check_citations.py"
8+
- ".github/workflows/citation-format.yml"
9+
push:
10+
branches: [main]
11+
paths:
12+
- "citations.bib"
13+
14+
permissions:
15+
contents: read
16+
17+
jobs:
18+
citation-format:
19+
runs-on: ubuntu-latest
20+
steps:
21+
- uses: actions/checkout@v4
22+
23+
- name: Set up Python
24+
uses: actions/setup-python@v5
25+
with:
26+
python-version: "3.12"
27+
28+
- name: Install bibtexparser
29+
run: python -m pip install --upgrade pip bibtexparser
30+
31+
- name: Validate citations.bib
32+
run: |
33+
if [ -f tools/check_citations.py ]; then
34+
python tools/check_citations.py citations.bib
35+
else
36+
python - <<'PY'
37+
import sys
38+
import bibtexparser
39+
with open("citations.bib", "r", encoding="utf-8") as f:
40+
db = bibtexparser.load(f)
41+
# Stub validation: file parses, every entry has a key.
42+
missing = [e for e in db.entries if not e.get("ID")]
43+
if missing:
44+
print(f"Entries missing ID: {len(missing)}", file=sys.stderr)
45+
sys.exit(1)
46+
print(f"OK: {len(db.entries)} entries parsed.")
47+
PY
48+
fi

‎.github/workflows/deploy-pages.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: deploy-pages
2+
3+
on:
4+
push:
5+
branches: [main]
6+
workflow_dispatch:
7+
8+
permissions:
9+
contents: read
10+
pages: write
11+
id-token: write
12+
13+
concurrency:
14+
group: pages
15+
cancel-in-progress: false
16+
17+
jobs:
18+
build:
19+
runs-on: ubuntu-latest
20+
steps:
21+
- uses: actions/checkout@v4
22+
23+
- name: Set up Node
24+
uses: actions/setup-node@v4
25+
with:
26+
node-version: "22"
27+
28+
- name: Install dependencies
29+
run: npm install --no-package-lock
30+
31+
- name: Build static site
32+
run: npm run build
33+
34+
- name: Add custom domain
35+
if: ${{ vars.PAGES_CNAME != '' }}
36+
run: echo "${{ vars.PAGES_CNAME }}" > dist/CNAME
37+
38+
- name: Configure Pages
39+
uses: actions/configure-pages@v5
40+
41+
- name: Upload artifact
42+
uses: actions/upload-pages-artifact@v3
43+
with:
44+
path: dist
45+
46+
deploy:
47+
environment:
48+
name: github-pages
49+
url: ${{ steps.deployment.outputs.page_url }}
50+
runs-on: ubuntu-latest
51+
needs: build
52+
steps:
53+
- name: Deploy to GitHub Pages
54+
id: deployment
55+
uses: actions/deploy-pages@v4

‎.github/workflows/link-check.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: link-check
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- "**/*.md"
7+
- ".github/workflows/link-check.yml"
8+
schedule:
9+
# Weekly check of all links — catches link rot in cited sources.
10+
- cron: "0 6 * * 1"
11+
12+
permissions:
13+
contents: read
14+
issues: write
15+
16+
jobs:
17+
links:
18+
runs-on: ubuntu-latest
19+
steps:
20+
- uses: actions/checkout@v4
21+
22+
- name: Restore lychee cache
23+
uses: actions/cache@v4
24+
with:
25+
path: .lycheecache
26+
key: cache-lychee-${{ github.sha }}
27+
restore-keys: cache-lychee-
28+
29+
- name: Check links
30+
uses: lycheeverse/lychee-action@v2
31+
with:
32+
args: >-
33+
--cache
34+
--max-cache-age 1d
35+
--no-progress
36+
--accept 200,206,429
37+
'./**/*.md'
38+
fail: true

‎.github/workflows/markdown-lint.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: markdown-lint
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- "**/*.md"
7+
- ".markdownlint.json"
8+
- ".github/workflows/markdown-lint.yml"
9+
push:
10+
branches: [main]
11+
paths:
12+
- "**/*.md"
13+
14+
permissions:
15+
contents: read
16+
17+
jobs:
18+
lint:
19+
runs-on: ubuntu-latest
20+
steps:
21+
- uses: actions/checkout@v4
22+
23+
- name: Run markdownlint
24+
uses: DavidAnson/markdownlint-cli2-action@v16
25+
with:
26+
globs: |
27+
**/*.md
28+
!node_modules

0 commit comments

Comments
 (0)