[Rule Tuning] Missing MITRE ATT&CK Mappings

[terrancedejesus]

Description

There are quite a handful of detection rules missing MITRE ATT&CK mappings. This skews our ATT&CK coverage maps automatically generated in this repository. These rules should be revisited and mappings added.

Rules, IDs and Missing

Name: Web Application Suspicious Activity: POST Request Declined

ID: a87a4e42-1d82-44bd-b0bf-d9b7f91fb89e
Issue: Missing ATT&CK Mapping

Name: Web Application Suspicious Activity: Unauthorized Method
ID: 75ee75d8-c180-481c-ba88-ee50129a6aef
Issue: Missing ATT&CK Mapping

Name: Web Application Suspicious Activity: No User Agent
ID: 43303fd4-4839-4e48-b2b2-803ab060758d
Issue: Missing ATT&CK Mapping

Name: Web Application Suspicious Activity: sqlmap User Agent
ID: d49cc73f-7a16-4def-89ce-9fc7127d7820
Issue: Missing ATT&CK Mapping

Name: EggShell Backdoor Execution
ID: 41824afb-d68c-4d0e-bfee-474dac1fa56e
Issue: Missing ATT&CK Mapping

Name: Threat Intel Filebeat Module (v8.x) Indicator Match
ID: 699e9fdb-b77c-4c01-995c-1c15019b9c43
Issue: Missing ATT&CK Mapping

Name: Threat Intel Indicator Match
ID: 0c9a14d9-d65d-486f-9b5b-91e4e6b22bd0
Issue: Missing ATT&CK Mapping

Name: AWS IAM User Addition to Group
ID: 333de828-8190-4cf5-8d7c-7575846f6fe0
Issue: Missing ATT&CK Technique

Name: AWS RDS Snapshot Export
ID: 119c8877-8613-416d-a98a-96b6664ee73a
Issue: Missing ATT&CK Technique

Name: AWS RDS Snapshot Restored
ID: bf1073bf-ce26-4607-b405-ba1ed8e9e204
Issue: Missing ATT&CK Technique

Name: AWS EventBridge Rule Disabled or Deleted
ID: 87594192-4539-4bc4-8543-23bc3d5bd2b4
Issue: Missing ATT&CK Technique

Name: Spike in AWS Error Messages
ID: 78d3d8d9-b476-451d-a9e0-7a5addd70670
Issue: Missing ATT&CK Mapping

Name: Rare AWS Error Code
ID: 19de8096-e2b0-4bd8-80c9-34a820813fff
Issue: Missing ATT&CK Mapping

Name: Unusual City For an AWS Command
ID: 809b70d3-e2c3-455e-af1b-2626a5a1a276
Issue: Missing ATT&CK Mapping

Name: Unusual Country For an AWS Command
ID: dca28dee-c999-400f-b640-50a081cc0fd1
Issue: Missing ATT&CK Mapping

Name: Unusual AWS Command for a User
ID: ac706eae-d5ec-4b14-b4fd-e8ba8086f0e1
Issue: Missing ATT&CK Mapping

Name: AWS Security Group Configuration Change Detection
ID: 29052c19-ff3e-42fd-8363-7be14d7c5469
Issue: Missing ATT&CK Technique

Name: AWS RDS Instance Creation
ID: f30f3443-4fbb-4c27-ab89-c3ad49d62315
Issue: Missing ATT&CK Technique

Name: AWS Redshift Cluster Creation
ID: 015cca13-8832-49ac-a01b-a396114809f6
Issue: Missing ATT&CK Technique

Name: AWS Route Table Created
ID: e12c0318-99b1-44f2-830c-3a38a43207ca
Issue: Missing ATT&CK Technique

Name: AWS Route Table Modified or Deleted
ID: e7cd5982-17c8-4959-874c-633acde7d426
Issue: Missing ATT&CK Technique

Name: Azure Automation Runbook Deleted
ID: 8ddab73b-3d15-4e5d-9413-47f05553c1d7
Issue: Missing ATT&CK Mapping

Name: Azure Kubernetes Pods Deleted
ID: 83a1931d-8136-46fc-b7b9-2db4f639e014
Issue: Missing ATT&CK Technique

Name: Azure Virtual Network Device Modified or Deleted
ID: 573f6e7a-7acf-4bcd-ad42-c4969124d3c0
Issue: Missing ATT&CK Technique

Name: Azure Automation Runbook Created or Modified
ID: 16280f1e-57e6-4242-aa21-bb4d16f13b2f
Issue: Missing ATT&CK Mapping

Name: Azure Automation Webhook Created
ID: e9ff9c1c-fe36-4d0d-b3fd-9e0bf4853a62
Issue: Missing ATT&CK Mapping

Name: Azure Kubernetes Rolebindings Created
ID: 1c966416-60c1-436b-bfd0-e002fddbfd89
Issue: Missing ATT&CK Technique

Name: Endpoint Security
ID: 9a1a2dae-0b5f-4c3d-8305-a268d404c306
Issue: Missing ATT&CK Mapping

Name: GCP Storage Bucket Configuration Modification
ID: 97359fd8-757d-4b1d-9af1-ef29e4a8680e
Issue: Missing ATT&CK Mapping

Name: GCP Virtual Private Cloud Network Deletion
ID: c58c3081-2e1d-4497-8491-e73a45d1a6d6
Issue: Missing ATT&CK Mapping

Name: GCP Virtual Private Cloud Route Creation
ID: 9180ffdf-f3d0-4db3-bf66-7a14bcff71b8
Issue: Missing ATT&CK Mapping

Name: GCP Virtual Private Cloud Route Deletion
ID: a17bcc91-297b-459b-b5ce-bc7460d8f82a
Issue: Missing ATT&CK Mapping

Name: GCP Kubernetes Rolebindings Created or Patched
ID: 2f0bae2d-bf20-4465-be86-1311addebaa3
Issue: Missing ATT&CK Technique

Name: Application Added to Google Workspace Domain
ID: 785a404b-75aa-4ffd-8be5-3334a5a544dd
Issue: Missing ATT&CK Mapping

Name: Domain Added to Google Workspace Trusted Domains
ID: cf549724-c577-4fd6-8f9b-d1b8ec519ec0
Issue: Missing ATT&CK Mapping

Name: Google Workspace Admin Role Deletion
ID: 93e63c3e-4154-4fc6-9f86-b411e0987bbf
Issue: Missing ATT&CK Mapping

Name: Google Workspace MFA Enforcement Disabled
ID: cad4500a-abd7-4ef3-b5d3-95524de7cfe1
Issue: Missing ATT&CK Mapping

Name: Google Workspace Password Policy Modified
ID: a99f82f5-8e77-4f8b-b3ce-10c0f6afbc73
Issue: Missing ATT&CK Mapping

Name: MFA Disabled for Google Workspace Organization
ID: e555105c-ba6d-481f-82bb-9b633e7b4827
Issue: Missing ATT&CK Mapping

Name: Microsoft 365 Mass download by a single user
ID: 571ff456-aa7f-4e48-8a88-39698bb5418f
Issue: Missing ATT&CK Technique

Name: Microsoft 365 Exchange DKIM Signing Configuration Disabled
ID: 514121ce-c7b6-474a-8237-68ff71672379
Issue: Missing ATT&CK Mapping

Name: Microsoft 365 Teams Custom Application Interaction Allowed
ID: bbd1a775-8267-41fa-9232-20e5582596ac
Issue: Missing ATT&CK Mapping

Name: Attempt to Deactivate an Okta Network Zone
ID: 8a5c1e5f-ad63-481e-b53a-ef959230f7f1
Issue: Missing ATT&CK Mapping

Name: Attempt to Delete an Okta Network Zone
ID: c749e367-a069-4a73-b1f2-43a3798153ad
Issue: Missing ATT&CK Mapping

Name: Okta User Session Impersonation
ID: cdbebdc1-dc97-43c6-a538-f26a20c0a911
Issue: Missing ATT&CK Technique

Name: Attempt to Deactivate an Okta Application
ID: edb91186-1c7e-4db8-b53e-bfa33a1a0a8a
Issue: Missing ATT&CK Mapping

Name: Attempt to Deactivate an Okta Policy
ID: b719a170-3bdb-4141-b0e3-13e3cf627bfe
Issue: Missing ATT&CK Mapping

Name: Attempt to Deactivate an Okta Policy Rule
ID: cc92c835-da92-45c9-9f29-b4992ad621a0
Issue: Missing ATT&CK Mapping

Name: Attempt to Delete an Okta Application
ID: d48e1c13-4aca-4d1f-a7b1-a9161c0ad86f
Issue: Missing ATT&CK Mapping

Name: Attempt to Delete an Okta Policy
ID: b4bb1440-0fcb-4ed1-87e5-b06d58efc5e9
Issue: Missing ATT&CK Mapping

Name: Attempt to Delete an Okta Policy Rule
ID: d5d86bf5-cf0c-4c06-b688-53fdc072fdfd
Issue: Missing ATT&CK Mapping

Name: Attempt to Modify an Okta Application
ID: c74fd275-ab2c-4d49-8890-e2943fa65c09
Issue: Missing ATT&CK Mapping

Name: Attempt to Modify an Okta Network Zone
ID: e48236ca-b67a-4b4e-840c-fdc7782bc0c3
Issue: Missing ATT&CK Mapping

Name: Attempt to Modify an Okta Policy
ID: 6731fbf2-8f28-49ed-9ab9-9a918ceb5a45
Issue: Missing ATT&CK Mapping

Name: Attempt to Modify an Okta Policy Rule
ID: 000047bb-b27a-47ec-8b62-ef1a5d2c9e19
Issue: Missing ATT&CK Mapping

Name: Modification or Removal of an Okta Application Sign-On Policy
ID: cd16fb10-0261-46e8-9932-a0336278cdbe
Issue: Missing ATT&CK Mapping

Name: Threat Detected by Okta ThreatInsight
ID: 6885d2ae-e008-4762-b98a-e8e1cd3a81e9
Issue: Missing ATT&CK Mapping

Name: Hping Process Activity
ID: 90169566-2260-4824-b8e4-8615c3b4ed52
Issue: Missing ATT&CK Mapping

Name: Potential DNS Tunneling via Iodine
ID: 041d4d41-9589-43e2-ba13-5680af75ebc2
Issue: Missing ATT&CK Mapping

Name: Netcat Network Activity
ID: adb961e0-cb74-42a0-af9e-29fc41f88f5f
Issue: Missing ATT&CK Mapping

Name: Nping Process Activity
ID: 0d69150b-96f8-467c-a86d-a67a3378ce77
Issue: Missing ATT&CK Mapping

Name: Unusual Process Execution - Temp
ID: df959768-b0c9-4d45-988c-5606a2be8e5a
Issue: Missing ATT&CK Mapping

Name: Strace Process Activity
ID: d6450d4e-81c6-46a3-bd94-079886318ed5
Issue: Missing ATT&CK Mapping

Name: Potential Microsoft Office Sandbox Evasion
ID: d22a85c6-d2ad-4cc4-bf7b-54787473669a
Issue: Missing ATT&CK Mapping

Name: Potential Persistence via Atom Init Script Modification
ID: b4449455-f986-4b5a-82ed-e36b129331f7
Issue: Missing ATT&CK Mapping

Name: Unusual Hour for a User to Logon
ID: 745b0119-0560-43ba-860a-7235dd8cee8d
Issue: Missing ATT&CK Mapping

Name: Unusual Source IP for a User to Logon from
ID: d4b73fa0-9d43-465e-b8bf-50230da6718b
Issue: Missing ATT&CK Mapping

Name: Rare User Logon
ID: 138c5dd5-838b-446e-b1ac-c995c7f8108a
Issue: Missing ATT&CK Mapping

Name: Spike in Failed Logon Events
ID: 99dcf974-6587-4f65-9252-d866a3fdfd9c
Issue: Missing ATT&CK Mapping

Name: Spike in Logon Events
ID: d7d5c059-c19a-4a96-8ae3-41496ef3bcf9
Issue: Missing ATT&CK Mapping

Name: Spike in Logon Events from a Source IP
ID: e26aed74-c816-40d3-a810-48d6fbd8b2fd
Issue: Missing ATT&CK Mapping

Name: Spike in Firewall Denies
ID: eaa77d63-9679-4ce3-be25-3ba8b795e5fa
Issue: Missing ATT&CK Mapping

Name: Spike in Network Traffic
ID: b240bfb8-26b7-4e5e-924e-218144a3fa71
Issue: Missing ATT&CK Mapping

Name: Anomalous Linux Compiler Activity
ID: cd66a419-9b3f-4f57-8ff8-ac4cd2d5f530
Issue: Missing ATT&CK Mapping

Name: Unusual Linux Process Calling the Metadata Service
ID: 9d302377-d226-4e12-b54c-1906b5aec4f6
Issue: Missing ATT&CK Mapping

Name: Unusual Linux User Calling the Metadata Service
ID: 1faec04b-d902-4f89-8aff-92cd9043c16f
Issue: Missing ATT&CK Mapping

Name: Unusual Linux Network Activity
ID: 52afbdc5-db15-485e-bc24-f5707f820c4b
Issue: Missing ATT&CK Mapping

Name: Unusual Linux Network Port Activity
ID: 3c7e32e6-6104-46d9-a06e-da0f8b5795a0
Issue: Missing ATT&CK Mapping

Name: Unusual Linux Network Service
ID: 52afbdc5-db15-596e-bc35-f5707f820c4b
Issue: Missing ATT&CK Mapping

Name: Unusual Linux Web Activity
ID: 52afbdc5-db15-485e-bc35-f5707f820c4c
Issue: Missing ATT&CK Mapping

Name: Anomalous Process For a Linux Population
ID: 647fc812-7996-4795-8869-9c4ea595fe88
Issue: Missing ATT&CK Mapping

Name: Unusual Linux Username
ID: b347b919-665f-4aac-b9e8-68369bf2340c
Issue: Missing ATT&CK Mapping

Name: DNS Tunneling
ID: 91f02f01-969f-4167-8f66-07827ac3bdd9
Issue: Missing ATT&CK Mapping

Name: Unusual DNS Activity
ID: 746edc4c-c54c-49c6-97a1-651223819448
Issue: Missing ATT&CK Mapping

Name: Unusual Network Destination Domain Name
ID: 17e68559-b274-4948-ad0b-f8415bb31126
Issue: Missing ATT&CK Mapping

Name: Unusual Web Request
ID: 91f02f01-969f-4167-8f55-07827ac3acc9
Issue: Missing ATT&CK Mapping

Name: Unusual Web User Agent
ID: 91f02f01-969f-4167-8d77-07827ac4cee0
Issue: Missing ATT&CK Mapping

Name: Network Traffic to Rare Destination Country
ID: 35f86980-1fb1-4dff-b311-3be941549c8d
Issue: Missing ATT&CK Mapping

Name: Unusual Process For a Linux Host
ID: 46f804f5-b289-43d6-a881-9387cf594f75
Issue: Missing ATT&CK Mapping

Name: Unusual Process For a Windows Host
ID: 6d448b96-c922-4adb-b51c-b767f1ea5b76
Issue: Missing ATT&CK Mapping

Name: Spike in Network Traffic To a Country
ID: c7db5533-ca2a-41f6-a8b0-ee98abe0f573
Issue: Missing ATT&CK Mapping

Name: Unusual Login Activity
ID: 4330272b-9724-4bc6-a3ca-f1532b81e5c2
Issue: Missing ATT&CK Mapping

Name: Unusual Windows Process Calling the Metadata Service
ID: abae61a8-c560-4dbd-acca-1e1438bff36b
Issue: Missing ATT&CK Mapping

Name: Unusual Windows User Calling the Metadata Service
ID: df197323-72a8-46a9-a08e-3f5b04a4a97a
Issue: Missing ATT&CK Mapping

Name: Unusual Windows Network Activity
ID: ba342eb2-583c-439f-b04d-1fdd7c1417cc
Issue: Missing ATT&CK Mapping

Name: Unusual Windows Path Activity
ID: 445a342e-03fb-42d0-8656-0367eb2dead5
Issue: Missing ATT&CK Mapping

Name: Anomalous Process For a Windows Population
ID: 6e40d56f-5c0e-4ac6-aece-bee96645b172
Issue: Missing ATT&CK Mapping

Name: Anomalous Windows Process Creation
ID: 0b29cab4-dbbd-4a3f-9e8e-1287c7c11ae5
Issue: Missing ATT&CK Mapping

Name: Suspicious Powershell Script
ID: 1781d055-5c66-4adf-9d60-fc0fa58337b6
Issue: Missing ATT&CK Mapping

Name: Unusual Windows Service
ID: 1781d055-5c66-4adf-9c71-fc0fa58338c7
Issue: Missing ATT&CK Mapping

Name: Unusual Windows Username
ID: 1781d055-5c66-4adf-9c59-fc0fa58336a5
Issue: Missing ATT&CK Mapping

Name: Unusual Windows User Privilege Elevation Activity
ID: 1781d055-5c66-4adf-9d82-fc0fa58449c8
Issue: Missing ATT&CK Mapping

Name: Unusual Windows Remote User
ID: 1781d055-5c66-4adf-9e93-fc0fa69550c9
Issue: Missing ATT&CK Mapping

Name: DNS Activity to the Internet
ID: 6ea71ff0-9e95-475b-9506-2580d1ce6154
Issue: Missing ATT&CK Technique

Name: IPSEC NAT Traversal Port Activity
ID: a9cb3641-ff4b-4cdc-a063-b4b8d02a67c7
Issue: Missing ATT&CK Technique

Name: SMTP on Port 26/TCP
ID: d7e62693-aab9-4f66-a21a-3d79ecdd603d
Issue: Missing ATT&CK Technique

Name: RDP (Remote Desktop Protocol) from the Internet
ID: 8c1bdde8-4204-45c0-9e0c-c85ca3902488
Issue: Missing ATT&CK Technique

Name: Telnet Port Activity
ID: 34fde489-94b0-4500-a76f-b8a157cf9269
Issue: Missing ATT&CK Technique

Name: Adversary Behavior - Detected - Elastic Endgame
ID: 77a3c3df-8ec4-4da4-b758-878f551dee69
Issue: Missing ATT&CK Mapping

Name: Credential Dumping - Detected - Elastic Endgame
ID: 571afc56-5ed9-465d-a2a9-045f099f6e7e
Issue: Missing ATT&CK Mapping

Name: Credential Dumping - Prevented - Elastic Endgame
ID: db8c33a8-03cd-4988-9e2c-d0a4863adb13
Issue: Missing ATT&CK Mapping

Name: Credential Manipulation - Detected - Elastic Endgame
ID: c0be5f31-e180-48ed-aa08-96b36899d48f
Issue: Missing ATT&CK Mapping

Name: Credential Manipulation - Prevented - Elastic Endgame
ID: c9e38e64-3f4c-4bf3-ad48-0e61a60ea1fa
Issue: Missing ATT&CK Mapping

Name: Exploit - Detected - Elastic Endgame
ID: 2003cdc8-8d83-4aa5-b132-1f9a8eb48514
Issue: Missing ATT&CK Mapping

Name: Exploit - Prevented - Elastic Endgame
ID: 2863ffeb-bf77-44dd-b7a5-93ef94b72036
Issue: Missing ATT&CK Mapping

Name: Malware - Detected - Elastic Endgame
ID: 0a97b20f-4144-49ea-be32-b540ecc445de
Issue: Missing ATT&CK Mapping

Name: Malware - Prevented - Elastic Endgame
ID: 3b382770-efbb-44f4-beed-f5e0a051b895
Issue: Missing ATT&CK Mapping

Name: Permission Theft - Detected - Elastic Endgame
ID: c3167e1b-f73c-41be-b60b-87f4df707fe3
Issue: Missing ATT&CK Mapping

Name: Permission Theft - Prevented - Elastic Endgame
ID: 453f659e-0429-40b1-bfdb-b6957286e04b
Issue: Missing ATT&CK Mapping

Name: Process Injection - Detected - Elastic Endgame
ID: 80c52164-c82a-402c-9964-852533d58be1
Issue: Missing ATT&CK Mapping

Name: Process Injection - Prevented - Elastic Endgame
ID: 990838aa-a953-4f3e-b3cb-6ddf7584de9e
Issue: Missing ATT&CK Mapping

Name: Ransomware - Detected - Elastic Endgame
ID: 8cb4f625-7743-4dfb-ae1b-ad92be9df7bd
Issue: Missing ATT&CK Mapping

Name: Ransomware - Prevented - Elastic Endgame
ID: e3c5d5cb-41d5-4206-805c-f30561eae3ac
Issue: Missing ATT&CK Mapping

Name: External Alerts
ID: eb079c62-4481-4d6e-9643-3ca499df7aaa
Issue: Missing ATT&CK Mapping

Name: Sensitive Privilege SeEnableDelegationPrivilege assigned to a User
ID: f494c678-3c33-43aa-b169-bb3d5198c41d
Issue: Missing ATT&CK Technique

Name: Whitespace Padding in Process Command Line
ID: e0dacebe-4311-4d50-9387-b17e89c2e7fd
Issue: Missing ATT&CK Technique

Name: Process Execution from an Unusual Directory
ID: ebfe1448-7fac-4d59-acea-181bd89b1f7f
Issue: Missing ATT&CK Mapping

Name: Execution from Unusual Directory - Command Line
ID: cff92c41-2225-4763-b4ce-6f71e5bda5e6
Issue: Missing ATT&CK Mapping

Name: Execution of File Written or Modified by Microsoft Office
ID: 0d8ad79f-9025-45d8-80c1-4f0cd3c5e8e5
Issue: Missing ATT&CK Technique

Name: Execution of File Written or Modified by PDF Reader
ID: 1defdd62-cd8d-426e-a246-81a37751bb2b
Issue: Missing ATT&CK Technique

Name: Network Connection via Registration Utility
ID: fb02b8d3-71ee-4af1-bacd-215d23f17efa
Issue: Missing ATT&CK Technique

Name: Suspicious Execution - Short Program Name
ID: 17c7f6a5-5bc9-4e1f-92bf-13632d24384d
Issue: Missing ATT&CK Mapping

Name: WMI Incoming Lateral Movement
ID: f3475224-b179-4f78-8877-c2bd64c26b88
Issue: Missing ATT&CK Technique

Name: AdminSDHolder Backdoor
ID: 6e9130a5-9be6-48e5-943a-9628bfc74b18
Issue: Missing ATT&CK Technique

Name: AdminSDHolder SDProp Exclusion Added
ID: 61d29caf-6c15-4d1e-9ccb-7ad12ccc0bc7
Issue: Missing ATT&CK Technique

[w0rk3r]

Just a note that not every single rule should have a technique mapped to it, as Mitre att&ck does not cover some stuff

[terrancedejesus]

After further review, the rules that are missing a technique seem to be fine as their tactic covers enough but the detection logic is not focused on a specific adversary technique. Within the PR, the tasks have been limited to only rules that are missing any ATT&CK mapping at all.