Possible incorrect mappings for CoinTicker / Umbreon / HiddenWasp and Launch Daemon examples

[TMateusz]

First of all, thank you for your work on ATT&CK and for maintaining this dataset for the community.

I'm a student just getting started in cybersecurity, and ATT&CK has helped me a lot while learning — so I wanted to report a few things I noticed in case they're useful.

Upon reviewing Enterprise software pages and their related technique mappings, I believe there are several inconsistencies between procedure example descriptions, software platforms, and the definitions of the linked techniques.

I also emailed attack@mitre.org with subject [Website Content Error].

Identified Issues

1. CoinTicker (S0369) incorrectly mapped to T1059.003 Windows Command Shell

   • URL: https://attack.mitre.org/software/S0369/
   • Software platforms: macOS
   • Current mapping: T1059.003 Windows Command Shell
   • Procedure text states that CoinTicker “executes a bash script to establish a reverse shell”
   • The same behavior is already mapped to T1059.004 Unix Shell on the same page

   This appears inconsistent: bash reverse-shell execution on macOS aligns with Unix Shell, not Windows Command Shell. The T1059.003 relationship looks like an erroneous or leftover mapping.

2. Additional non-Windows software mapped to T1059.003

   • Umbreon (S0221, Linux)
     https://attack.mitre.org/software/S0221/
     Mapped to T1059.003, while the procedure text describes SSH / reverse shell access.
   • HiddenWasp (S0394, Linux)
     https://attack.mitre.org/software/S0394/
     Mapped to T1059.003, while the procedure text describes scripted execution on a Linux host.

3. Non-macOS software mapped to macOS-only T1543.004 Launch Daemon

   • Technique URL: https://attack.mitre.org/techniques/T1543/004/
   • T1543.004 is defined specifically around macOS Launch Daemons (launchd / plist-based persistence)
   • COATHANGER (S1105; Linux, Network Devices)
     https://attack.mitre.org/software/S1105/
     Procedure text: “create a daemon for timed check-ins…”
   • REPTILE (S1219; Linux)
     https://attack.mitre.org/software/S1219/
     Procedure text: “daemonize a process”

   Generic Unix “daemonize” / create-a-daemon language does not appear to match the macOS-specific Launch Daemon sub-technique.

Suggested Remediation

• S0369: remove relationship to T1059.003; keep T1059.004
• S0221 / S0394: replace T1059.003 with T1059.004 (or remove if already covered elsewhere)
• S1105 / S1219: remove T1543.004; remap only if supporting evidence justifies a platform-appropriate persistence technique (e.g. T1543.002 where applicable)

Happy to provide additional context if useful. Thanks again.