IRCA (Iron Cactus)

The 90th Cyberspace Operations Squadron (90th COS) develops software that provides capabilities to a number of organizations across the DOD, in both classified and unclassified environments. We have taken advantage of the open-source opportunities offered by our unclassified development to make a couple of our products available to the public. Iron Cactus (IRCA) is one such open-source product that was born out of the need to effectively map and visualize defensive recommendations and insights to adversary TTPs in an automated means.

IRCA develops Potential Indicators of Compromise (PIOCs) and leverages the MITRE ATT&CK Navigator, MITRE DeTTECT, and MITRE D3FEND to create a visual that easily communicates pertinent information. IRCA also provides the capability to create threat group layers on ATT&CK Navigator, upload layers via .json, .yml, and .yaml files, download and remove layers, combine layers, and adjust PIOC configuration for specific coverage.