[Rule Tuning] Missing MITRE ATT&CK Mappings #2073

terrancedejesus · 2022-07-05T21:00:05Z

Issues

[Rule Tuning] Missing MITRE ATT&CK Mappings #1987

Summary

A few mitre att&ck mappings are missing from several detection rules and should be added. We should go through these and attempt to find a proper mapping and if not detail why and skip.

Web Application Suspicious Activity: POST Request Declined
Web Application Suspicious Activity: Unauthorized Method
Web Application Suspicious Activity: No User Agent
Web Application Suspicious Activity: sqlmap User Agent
EggShell Backdoor Execution
Threat Intel Filebeat Module (v8.x) Indicator Match
Threat Intel Indicator Match
AWS IAM User Addition to Group
AWS RDS Snapshot Export
AWS RDS Snapshot Restored
AWS EventBridge Rule Disabled or Deleted
Spike in AWS Error Messages
Rare AWS Error Code
Unusual City For an AWS Command
Unusual Country For an AWS Command
Unusual AWS Command for a User
AWS Security Group Configuration Change Detection
AWS RDS Instance Creation
AWS Redshift Cluster Creation
AWS Route Table Created
AWS Route Table Modified or Deleted
Azure Automation Runbook Deleted
Azure Kubernetes Pods Deleted
Azure Virtual Network Device Modified or Deleted
Endpoint Security
GCP Storage Bucket Configuration Modification
GCP Virtual Private Cloud Network Deletion
GCP Virtual Private Cloud Route Creation
GCP Virtual Private Cloud Route Deletion
Application Added to Google Workspace Domain
Domain Added to Google Workspace Trusted Domains
Google Workspace Admin Role Deletion
Google Workspace MFA Enforcement Disabled
Google Workspace Password Policy Modified
MFA Disabled for Google Workspace Organization
Microsoft 365 Exchange DKIM Signing Configuration Disabled
Microsoft 365 Teams Custom Application Interaction Allowed
Attempt to Deactivate an Okta Network Zone
Attempt to Delete an Okta Network Zone
Attempt to Deactivate an Okta Application
Attempt to Deactivate an Okta Policy
Attempt to Deactivate an Okta Policy Rule
Attempt to Delete an Okta Application
Attempt to Delete an Okta Policy
Attempt to Delete an Okta Policy Rule
Attempt to Modify an Okta Application
Attempt to Modify an Okta Network Zone
Attempt to Modify an Okta Policy
Attempt to Modify an Okta Policy Rule
Modification or Removal of an Okta Application Sign-On Policy
Threat Detected by Okta ThreatInsight
Potential DNS Tunneling via Iodine
Netcat Network Activity
Nping Process Activity
Unusual Process Execution - Temp
Potential Microsoft Office Sandbox Evasion
Potential Persistence via Atom Init Script Modification
Unusual Hour for a User to Logon
Unusual Source IP for a User to Logon from
Rare User Logon
Spike in Failed Logon Events
Spike in Logon Events
Spike in Logon Events from a Source IP
Spike in Firewall Denies
Spike in Network Traffic
Anomalous Linux Compiler Activity
Unusual Linux Process Calling the Metadata Service
Unusual Linux User Calling the Metadata Service
Unusual Linux Network Activity
Unusual Linux Network Port Activity
Anomalous Process For a Linux Population
Unusual Linux Username
DNS Tunneling
Unusual DNS Activity
Unusual Network Destination Domain Name
Unusual Web Request
Unusual Web User Agent
Network Traffic to Rare Destination Country
Unusual Process For a Linux Host
Unusual Process For a Windows Host
Spike in Network Traffic To a Country
Unusual Login Activity
Unusual Windows Process Calling the Metadata Service
Unusual Windows User Calling the Metadata Service
Unusual Windows Network Activity
Unusual Windows Path Activity
Anomalous Process For a Windows Population
Anomalous Windows Process Creation
Suspicious Powershell Script
Unusual Windows Service
Unusual Windows Username
Unusual Windows User Privilege Elevation Activity
Unusual Windows Remote User
Adversary Behavior - Detected - Elastic Endgame
Credential Dumping - Detected - Elastic Endgame
Credential Dumping - Prevented - Elastic Endgame
Credential Manipulation - Detected - Elastic Endgame
Credential Manipulation - Prevented - Elastic Endgame
Exploit - Detected - Elastic Endgame
Exploit - Prevented - Elastic Endgame
Malware - Detected - Elastic Endgame
Malware - Prevented - Elastic Endgame
Permission Theft - Detected - Elastic Endgame
Permission Theft - Prevented - Elastic Endgame
Process Injection - Detected - Elastic Endgame
Process Injection - Prevented - Elastic Endgame
Ransomware - Detected - Elastic Endgame
Ransomware - Prevented - Elastic Endgame
External Alerts
Process Execution from an Unusual Directory
Execution from Unusual Directory - Command Line
Suspicious Execution - Short Program Name

Contributor checklist

Have you signed the contributor license agreement?
Have you followed the contributor guidelines?

terrancedejesus · 2022-07-05T21:10:52Z

Reasoning

AWS RDS Snapshot Export - Includes tactic, Exfiltration, but does not map properly to any specific technique under Exfiltration. Included Exfiltration tag and left current mappings.
AWS RDS Snapshot Restored - Includes tactic, Exfiltration, but does not map properly to any specific technique under Exfiltration. Included Exfiltration tag and left current mappings.
Spike in AWS Error Messages - ML job looking for an unusually large amount of errors from AWS Cloudtrail. This does not directly map to any specific adversary tactic or technique.
Unusual City For an AWS Command - Detects an AWS command executed from an unexpected city via geolocation. Not directly tied to an adversary tactic or technique.
Unusual Country For an AWS Command - Detects an AWS command executed from an unexpected country via geolocation. Not directly tied to an adversary tactic or technique.
Unusual AWS Command for a User- Detects an AWS command executed by a privileged user who does not usually execute that command. Not directly tied to an adversary tactic or technique without additional context.
endgame malware detected - Detects presence of malware without additional context as to what it being detected therefore we can not properly map a tactic or technique to it.
endgame malware prevented - Prevented malware but does not include additional context as to how that malware was detected therefore we can not properly map a tactic or technique to it.
endgame ransomware detected - Detects presence of ransomware without additional context as to what it being detected therefore we can not properly map a tactic or technique to it.
endgame ransomware prevented - Prevented ransomware but does not include additional context as to how that ransomware was detected therefore we can not properly map a tactic or technique to it.
endgame adversary behavior detected - Detects the presence of a specific adversary but does not provide additional context about the techniques observed to properly map to mitre.
external alerts - a rollup of external alerts for endgame users. No specific context about techniques since this is more of a catch all and therefore can not be properly mapped to mitre.
Unusual Network Destination Domain Name - This is too generic to determine even what a specific tactic may be.
Threat Intel Filebeat Module (v8.x) Indicator Match - Matches on user-managed IoC. No current way to determine what a potential tactic or technique is.
Threat Intel Indicator Match - Matches on user-managed IoC. No current way to determine what a potential tactic or technique is.
Unusual Windows Network Activity - Currently no indication of what specific tactic this would relate to as network activity could map to multiple tactics and techniques.
Spike in Network Traffic To a Country - A spike in network traffic to a specific country may be an anomaly but does not map directly to any specific tactic.
Network Traffic to Rare Destination Country - Network traffic to a host or server in an unusual destination country is specific to the client environment and does not map to any specific tactic.
Attempt to Modify an Okta Application - This is too generic to determine the adversaries goal with modification of the application and depending on reasoning could map to multiple tactics and techniques.
Threat Detected by Okta ThreatInsight - ThreatInsight IoC matching for requests to Okta. Currently no way to determine tactic or technique being used by adversary as this is based on reputation.
Spike in Firewall Denies - Too generic to determine what tactic or technique and adversary would be attempting to accomplish and therefore could map to multiple tactics and techniques.
Spike in Network Traffic - Too generic to determine what tactic or technique and adversary would be attempting to accomplish and therefore could map to multiple tactics and techniques.
Unusual Linux Network Activity - Too generic to determine tactic or technique. Attempts to find process that usually does not generate network activity. With specifics on why this process is generating traffic or what protocols are being used, we can not map a tactic or technique.
Unusual Linux Network Port Activity - Too generic to determine tactic or technique. We would need to know what specific port and direction to at least determine a tactic.
Web Application Suspicious Activity: POST Request Declined - Too generic to determine tactic or technique. Identifies 403 response codes from a request which indicate a decline from the server.
Web Application Suspicious Activity: Unauthorized Method - Too generic to determine what tactic to use. This would fall under Discovery if it specified traffic was ingress. It could also indicate Data Exfiltration or Command and Control is egress an depending on the method used.
Web Application Suspicious Activity: No User Agent - Too generic to determine a tactic or technique.
Web Application Suspicious Activity: sqlmap User Agent - Too generic to determine a tactic. Although this specifies a popular penetration testing tool, it does not indicate what it is being used for which could map across multiple tactics.

rules/integrations/aws/exfiltration_rds_snapshot_restored.toml

rules/integrations/aws/persistence_redshift_instance_creation.toml

rules/integrations/azure/impact_azure_automation_runbook_deleted.toml

I've added Mitre references for the 4 GCP rules missing. Changed 3 of the rules from "Impact" to "Defense Evasion" based on the technique used and it's matched tactic.

Updated Endgame rule names for those with Mitre tactics to match the tactics.

…toml Co-authored-by: Jonhnathan <[email protected]>

Co-authored-by: Jonhnathan <[email protected]>

rules/integrations/azure/defense_evasion_azure_automation_runbook_deleted.toml

Samirbous

nice work!, added few suggestion, in addition to that some rule fille names need to be renamed to pass the test (e.g. tag persistence but rule file name starts with linux_something.toml)

rules/integrations/google_workspace/google_workspace_policy_modified.toml

rules/integrations/google_workspace/mfa_disabled_for_google_workspace_organization.toml

rules/integrations/o365/microsoft_365_exchange_dkim_signing_config_disabled.toml

rules/integrations/o365/microsoft_365_teams_custom_app_interaction_allowed.toml

rules/integrations/okta/attempt_to_deactivate_okta_network_zone.toml

rules/promotions/privilege_escalation_endgame_permission_theft_detected.toml

rules/promotions/privilege_escalation_endgame_permission_theft_prevented.toml

rules/windows/execution_from_unusual_directory.toml

rules/windows/execution_from_unusual_path_cmdline.toml

rules/windows/execution_suspicious_short_program_name.toml

imays11

Looks good!

rules/integrations/o365/persistence_microsoft_365_teams_custom_app_interaction_allowed.toml

rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy.toml

Mikaayenson

This LGTM. Great work on updating the mappings. As you mentioned here:

We are accepting that rules on older branches will fail with this new attack mapping and will have to address them separately.

One minor thing: a few rules look like the need \n added.

terrancedejesus · 2022-07-21T17:29:41Z

@Samirbous I have addressed your comments. Thanks for the feedback! Once you approve, I will merge this one in and address the manual backport issues with two specific rules.

spong · 2022-07-21T17:36:11Z

@spong Do you have to update mappings on your end?

Yeah, we'll need to on the Kibana side as well thanks for the ping! I'm currently on leave, @banderror can you take care of this please? Here's a PR where we've done it in the past -- just need to update one file and run a script: elastic/kibana#89876

banderror · 2022-07-22T12:24:59Z

@spong Of course, will do it on Monday!

Btw @spong is on leave till November, so please ping me instead or our area in #security-detection-rules-area (@elastic/security-detections-response-rules).

* initial commit with eggshell mitre mapping added * adding updated rules * [Rule Tuning] MITRE for GCP rules I've added Mitre references for the 4 GCP rules missing. Changed 3 of the rules from "Impact" to "Defense Evasion" based on the technique used and it's matched tactic. * [Rule Tuning] Endgame Rule name updates for Mitre Updated Endgame rule names for those with Mitre tactics to match the tactics. * Update rules/integrations/aws/persistence_redshift_instance_creation.toml Co-authored-by: Jonhnathan <[email protected]> * Update rules/integrations/aws/exfiltration_rds_snapshot_restored.toml Co-authored-by: Jonhnathan <[email protected]> * adding 10 updated rules for google_workspace, ml and o365 * adding 22 rule updates for mitre att&ck mappings * adding 24 rule updates related mainly to ML rules * adding 3 rules related to detection via ML * adding adjustments * adding adjustments with solutions to recent pytest errors * removed tabs from tags * adjusted mappings and added techniques * adjusted endgame rule mappings per review * adjusted names to match different tactics * added execution and defense evasion tag * adjustments to address errors from merging with main * added newlines to rules missing them at the end of the file Co-authored-by: imays11 <[email protected]> Co-authored-by: Jonhnathan <[email protected]> Removed changes from: - rules/integrations/google_workspace/application_added_to_google_workspace_domain.toml - rules/integrations/google_workspace/domain_added_to_google_workspace_trusted_domains.toml - rules/integrations/google_workspace/google_workspace_admin_role_deletion.toml - rules/integrations/google_workspace/google_workspace_mfa_enforcement_disabled.toml - rules/integrations/google_workspace/google_workspace_policy_modified.toml - rules/integrations/google_workspace/mfa_disabled_for_google_workspace_organization.toml - rules/ml/ml_linux_anomalous_compiler_activity.toml - rules/ml/ml_linux_anomalous_metadata_process.toml - rules/ml/ml_linux_anomalous_metadata_user.toml - rules/ml/ml_linux_anomalous_process_all_hosts.toml - rules/ml/ml_linux_anomalous_sudo_activity.toml - rules/ml/ml_linux_anomalous_user_name.toml - rules/ml/ml_linux_system_information_discovery.toml - rules/ml/ml_linux_system_network_configuration_discovery.toml - rules/ml/ml_linux_system_network_connection_discovery.toml - rules/ml/ml_linux_system_process_discovery.toml - rules/ml/ml_linux_system_user_discovery.toml - rules/ml/ml_rare_process_by_host_linux.toml - rules/ml/ml_rare_process_by_host_windows.toml - rules/ml/ml_suspicious_login_activity.toml - rules/ml/ml_windows_anomalous_metadata_process.toml - rules/ml/ml_windows_anomalous_metadata_user.toml - rules/ml/ml_windows_anomalous_path_activity.toml - rules/ml/ml_windows_anomalous_process_all_hosts.toml - rules/ml/ml_windows_anomalous_process_creation.toml - rules/ml/ml_windows_anomalous_script.toml - rules/ml/ml_windows_anomalous_service.toml - rules/ml/ml_windows_anomalous_user_name.toml - rules/ml/ml_windows_rare_user_runas_event.toml - rules/ml/ml_windows_rare_user_type10_remote_login.toml - rules/windows/defense_evasion_execution_lolbas_wuauclt.toml (selectively cherry picked from commit e8c39d1)

* initial commit with eggshell mitre mapping added * adding updated rules * [Rule Tuning] MITRE for GCP rules I've added Mitre references for the 4 GCP rules missing. Changed 3 of the rules from "Impact" to "Defense Evasion" based on the technique used and it's matched tactic. * [Rule Tuning] Endgame Rule name updates for Mitre Updated Endgame rule names for those with Mitre tactics to match the tactics. * Update rules/integrations/aws/persistence_redshift_instance_creation.toml Co-authored-by: Jonhnathan <[email protected]> * Update rules/integrations/aws/exfiltration_rds_snapshot_restored.toml Co-authored-by: Jonhnathan <[email protected]> * adding 10 updated rules for google_workspace, ml and o365 * adding 22 rule updates for mitre att&ck mappings * adding 24 rule updates related mainly to ML rules * adding 3 rules related to detection via ML * adding adjustments * adding adjustments with solutions to recent pytest errors * removed tabs from tags * adjusted mappings and added techniques * adjusted endgame rule mappings per review * adjusted names to match different tactics * added execution and defense evasion tag * adjustments to address errors from merging with main * added newlines to rules missing them at the end of the file Co-authored-by: imays11 <[email protected]> Co-authored-by: Jonhnathan <[email protected]> Removed changes from: - rules/ml/ml_linux_anomalous_compiler_activity.toml - rules/ml/ml_linux_anomalous_metadata_process.toml - rules/ml/ml_linux_anomalous_metadata_user.toml - rules/ml/ml_linux_anomalous_process_all_hosts.toml - rules/ml/ml_linux_anomalous_sudo_activity.toml - rules/ml/ml_linux_anomalous_user_name.toml - rules/ml/ml_linux_system_information_discovery.toml - rules/ml/ml_linux_system_network_configuration_discovery.toml - rules/ml/ml_linux_system_network_connection_discovery.toml - rules/ml/ml_linux_system_process_discovery.toml - rules/ml/ml_linux_system_user_discovery.toml - rules/ml/ml_rare_process_by_host_linux.toml - rules/ml/ml_rare_process_by_host_windows.toml - rules/ml/ml_suspicious_login_activity.toml - rules/ml/ml_windows_anomalous_metadata_process.toml - rules/ml/ml_windows_anomalous_metadata_user.toml - rules/ml/ml_windows_anomalous_path_activity.toml - rules/ml/ml_windows_anomalous_process_all_hosts.toml - rules/ml/ml_windows_anomalous_process_creation.toml - rules/ml/ml_windows_anomalous_script.toml - rules/ml/ml_windows_anomalous_service.toml - rules/ml/ml_windows_anomalous_user_name.toml - rules/ml/ml_windows_rare_user_runas_event.toml - rules/ml/ml_windows_rare_user_type10_remote_login.toml - rules/windows/defense_evasion_execution_lolbas_wuauclt.toml (selectively cherry picked from commit e8c39d1)

* initial commit with eggshell mitre mapping added * adding updated rules * [Rule Tuning] MITRE for GCP rules I've added Mitre references for the 4 GCP rules missing. Changed 3 of the rules from "Impact" to "Defense Evasion" based on the technique used and it's matched tactic. * [Rule Tuning] Endgame Rule name updates for Mitre Updated Endgame rule names for those with Mitre tactics to match the tactics. * Update rules/integrations/aws/persistence_redshift_instance_creation.toml Co-authored-by: Jonhnathan <[email protected]> * Update rules/integrations/aws/exfiltration_rds_snapshot_restored.toml Co-authored-by: Jonhnathan <[email protected]> * adding 10 updated rules for google_workspace, ml and o365 * adding 22 rule updates for mitre att&ck mappings * adding 24 rule updates related mainly to ML rules * adding 3 rules related to detection via ML * adding adjustments * adding adjustments with solutions to recent pytest errors * removed tabs from tags * adjusted mappings and added techniques * adjusted endgame rule mappings per review * adjusted names to match different tactics * added execution and defense evasion tag * adjustments to address errors from merging with main * added newlines to rules missing them at the end of the file Co-authored-by: imays11 <[email protected]> Co-authored-by: Jonhnathan <[email protected]> Removed changes from: - rules/ml/ml_linux_anomalous_compiler_activity.toml - rules/ml/ml_linux_anomalous_metadata_process.toml - rules/ml/ml_linux_anomalous_metadata_user.toml - rules/ml/ml_linux_anomalous_process_all_hosts.toml - rules/ml/ml_linux_anomalous_sudo_activity.toml - rules/ml/ml_linux_anomalous_user_name.toml - rules/ml/ml_linux_system_information_discovery.toml - rules/ml/ml_linux_system_network_configuration_discovery.toml - rules/ml/ml_linux_system_network_connection_discovery.toml - rules/ml/ml_linux_system_process_discovery.toml - rules/ml/ml_linux_system_user_discovery.toml - rules/ml/ml_rare_process_by_host_linux.toml - rules/ml/ml_rare_process_by_host_windows.toml - rules/ml/ml_suspicious_login_activity.toml - rules/ml/ml_windows_anomalous_metadata_process.toml - rules/ml/ml_windows_anomalous_metadata_user.toml - rules/ml/ml_windows_anomalous_path_activity.toml - rules/ml/ml_windows_anomalous_process_all_hosts.toml - rules/ml/ml_windows_anomalous_process_creation.toml - rules/ml/ml_windows_anomalous_script.toml - rules/ml/ml_windows_anomalous_service.toml - rules/ml/ml_windows_anomalous_user_name.toml - rules/ml/ml_windows_rare_user_runas_event.toml - rules/ml/ml_windows_rare_user_type10_remote_login.toml (selectively cherry picked from commit e8c39d1)

* initial commit with eggshell mitre mapping added * adding updated rules * [Rule Tuning] MITRE for GCP rules I've added Mitre references for the 4 GCP rules missing. Changed 3 of the rules from "Impact" to "Defense Evasion" based on the technique used and it's matched tactic. * [Rule Tuning] Endgame Rule name updates for Mitre Updated Endgame rule names for those with Mitre tactics to match the tactics. * Update rules/integrations/aws/persistence_redshift_instance_creation.toml Co-authored-by: Jonhnathan <[email protected]> * Update rules/integrations/aws/exfiltration_rds_snapshot_restored.toml Co-authored-by: Jonhnathan <[email protected]> * adding 10 updated rules for google_workspace, ml and o365 * adding 22 rule updates for mitre att&ck mappings * adding 24 rule updates related mainly to ML rules * adding 3 rules related to detection via ML * adding adjustments * adding adjustments with solutions to recent pytest errors * removed tabs from tags * adjusted mappings and added techniques * adjusted endgame rule mappings per review * adjusted names to match different tactics * added execution and defense evasion tag * adjustments to address errors from merging with main * added newlines to rules missing them at the end of the file Co-authored-by: imays11 <[email protected]> Co-authored-by: Jonhnathan <[email protected]> (cherry picked from commit e8c39d1)

* initial commit with eggshell mitre mapping added * adding updated rules * [Rule Tuning] MITRE for GCP rules I've added Mitre references for the 4 GCP rules missing. Changed 3 of the rules from "Impact" to "Defense Evasion" based on the technique used and it's matched tactic. * [Rule Tuning] Endgame Rule name updates for Mitre Updated Endgame rule names for those with Mitre tactics to match the tactics. * Update rules/integrations/aws/persistence_redshift_instance_creation.toml Co-authored-by: Jonhnathan <[email protected]> * Update rules/integrations/aws/exfiltration_rds_snapshot_restored.toml Co-authored-by: Jonhnathan <[email protected]> * adding 10 updated rules for google_workspace, ml and o365 * adding 22 rule updates for mitre att&ck mappings * adding 24 rule updates related mainly to ML rules * adding 3 rules related to detection via ML * adding adjustments * adding adjustments with solutions to recent pytest errors * removed tabs from tags * adjusted mappings and added techniques * adjusted endgame rule mappings per review * adjusted names to match different tactics * added execution and defense evasion tag * adjustments to address errors from merging with main * added newlines to rules missing them at the end of the file Co-authored-by: imays11 <[email protected]> Co-authored-by: Jonhnathan <[email protected]>

banderror · 2022-07-25T21:34:41Z

@terrancedejesus @Mikaayenson I don't know if you'd like to review the PR, but here it is:
elastic/kibana#137122

terrancedejesus · 2022-07-25T22:08:03Z

@terrancedejesus @Mikaayenson I don't know if you'd like to review the PR, but here it is:

elastic/kibana#137122

Hey there! Thanks for linking the PR. I don't think we need to review it at the moment as we already merged our changes. As a side note we are using tag 11.3 from ATT&CK so as long as those align we should be good!

banderror · 2022-07-26T10:40:19Z

Oh, that's actually good to know @terrancedejesus, because we used to pull the MITRE content from their master branch. I updated the script to pull from a specific version and made sure we use v11.3 in 8.4.0: elastic/kibana@1bda53f. Thank you!

#137122) **Related to:** elastic/detection-rules#2073 (comment), #89876 ## Summary Here we regenerate the MITRE ATT&CK model in the code based on the official MITRE content: - we update to the version `ATT&CK-v11.3` (see elastic/detection-rules#2073 (comment)) - this corresponds to the `https://raw.githubusercontent.com/mitre/cti/ATT&CK-v11.3/enterprise-attack/enterprise-attack.json` content Also, this PR fixes the model regeneration script (check the comment below).

initial commit with eggshell mitre mapping added

14ae38e

terrancedejesus added Security Content v8.4.0 labels Jul 5, 2022

terrancedejesus self-assigned this Jul 5, 2022

terrancedejesus linked an issue Jul 5, 2022 that may be closed by this pull request

[Rule Tuning] Missing MITRE ATT&CK Mappings #1987

Closed

adding updated rules

46e86a2

w0rk3r reviewed Jul 6, 2022

View reviewed changes

imays11 self-assigned this Jul 12, 2022

imays11 and others added 9 commits July 13, 2022 17:10

[Rule Tuning] MITRE for GCP rules

1c750f9

I've added Mitre references for the 4 GCP rules missing. Changed 3 of the rules from "Impact" to "Defense Evasion" based on the technique used and it's matched tactic.

[Rule Tuning] Endgame Rule name updates for Mitre

c26c57c

Updated Endgame rule names for those with Mitre tactics to match the tactics.

Update rules/integrations/aws/persistence_redshift_instance_creation.…

a4aa076

…toml Co-authored-by: Jonhnathan <[email protected]>

Update rules/integrations/aws/exfiltration_rds_snapshot_restored.toml

d4b03b5

Co-authored-by: Jonhnathan <[email protected]>

Merge branch 'main' into 1987-rule-tuning-missing-mitre-attck-mappings

4655b62

adding 10 updated rules for google_workspace, ml and o365

c96bca5

adding 22 rule updates for mitre att&ck mappings

78a2f00

adding 24 rule updates related mainly to ML rules

a752e7e

adding 3 rules related to detection via ML

421c57b

w0rk3r mentioned this pull request Jul 18, 2022

Add MITRE Details for missing rules #2115

Closed

Samirbous reviewed Jul 19, 2022

View reviewed changes

rules/integrations/azure/defense_evasion_azure_automation_runbook_deleted.toml Show resolved Hide resolved

Samirbous requested changes Jul 19, 2022

View reviewed changes

terrancedejesus added 2 commits July 20, 2022 15:36

adding adjustments

755b49e

adding adjustments with solutions to recent pytest errors

c196249

terrancedejesus mentioned this pull request Jul 20, 2022

[FR] Capability to Pull New ATT&CK Version and Update Existing Rule Threat Maps #2130

Closed

terrancedejesus added 3 commits July 20, 2022 16:13

Merge branch 'main' into 1987-rule-tuning-missing-mitre-attck-mappings

1f93f81

removed tabs from tags

a942998

adjusted mappings and added techniques

571c51b

terrancedejesus marked this pull request as ready for review July 21, 2022 14:14

terrancedejesus requested review from brokensound77 and Mikaayenson as code owners July 21, 2022 14:14

imays11 approved these changes Jul 21, 2022

View reviewed changes

Mikaayenson reviewed Jul 21, 2022

View reviewed changes

rules/integrations/o365/persistence_microsoft_365_teams_custom_app_interaction_allowed.toml Outdated Show resolved Hide resolved

Mikaayenson reviewed Jul 21, 2022

View reviewed changes

rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy.toml Outdated Show resolved Hide resolved

Mikaayenson approved these changes Jul 21, 2022

View reviewed changes

added newlines to rules missing them at the end of the file

f87e936

Samirbous approved these changes Jul 22, 2022

View reviewed changes

terrancedejesus and others added 2 commits July 22, 2022 14:26

addressing file conflicts

23ee564

Merge branch 'main' into 1987-rule-tuning-missing-mitre-attck-mappings

6677924

terrancedejesus merged commit e8c39d1 into main Jul 22, 2022

terrancedejesus deleted the 1987-rule-tuning-missing-mitre-attck-mappings branch July 22, 2022 18:30

banderror mentioned this pull request Jul 25, 2022

[Security Solution][Detections] Update the MITRE ATT&CK model to v11.3 elastic/kibana#137122

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Rule Tuning] Missing MITRE ATT&CK Mappings #2073

[Rule Tuning] Missing MITRE ATT&CK Mappings #2073

terrancedejesus commented Jul 5, 2022 •

edited

Loading

terrancedejesus commented Jul 5, 2022 •

edited

Loading

Samirbous left a comment

imays11 left a comment

Mikaayenson left a comment •

edited

Loading

terrancedejesus commented Jul 21, 2022

spong commented Jul 21, 2022

banderror commented Jul 22, 2022

banderror commented Jul 25, 2022

terrancedejesus commented Jul 25, 2022

banderror commented Jul 26, 2022 •

edited

Loading

[Rule Tuning] Missing MITRE ATT&CK Mappings #2073

[Rule Tuning] Missing MITRE ATT&CK Mappings #2073

Conversation

terrancedejesus commented Jul 5, 2022 • edited Loading

Issues

Summary

Contributor checklist

terrancedejesus commented Jul 5, 2022 • edited Loading

Reasoning

Samirbous left a comment

Choose a reason for hiding this comment

imays11 left a comment

Choose a reason for hiding this comment

Mikaayenson left a comment • edited Loading

Choose a reason for hiding this comment

terrancedejesus commented Jul 21, 2022

spong commented Jul 21, 2022

banderror commented Jul 22, 2022

banderror commented Jul 25, 2022

terrancedejesus commented Jul 25, 2022

banderror commented Jul 26, 2022 • edited Loading

terrancedejesus commented Jul 5, 2022 •

edited

Loading

terrancedejesus commented Jul 5, 2022 •

edited

Loading

Mikaayenson left a comment •

edited

Loading

banderror commented Jul 26, 2022 •

edited

Loading