Add MITRE ATT&CK Mappings to current SCBs

[ahuynhMITRE]

🗣 Description

Added MITRE's ATT&CK TTP mappings and links to applicable security control baselines (SCBs) policies matching the format seen in GWS' SCBs

💭 Motivation and context

This update to the SCBs is required because it provides additional context into the tactics, techniques, and protocols the policies are attempting to harden against. This will also align the M365 SCBs with the GWS SCBs that currently have the mappings.

Closes #937

🧪 Testing

• check if the formatting is consistent across all of the added TTP mappings
• check if the correct TTP mappings are aligned to each policy. Spreadsheet has been sent to @mitchelbaker-cisa for dissemination.

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• PR targets the correct parent branch (e.g., main or release-name) for merge.
• Changes are limited to a single goal - eschew scope creep!
• Changes are sized such that they do not touch excessive number of files.
• All future TODOs are captured in issues, which are referenced in code comments.
• These code changes follow the ScubaGear content style guide.
• Related issues these changes resolve are linked preferably via closing keywords.
• All relevant type-of-change labels added.
• All relevant project fields are set.
• All relevant repo and/or project documentation updated to reflect these changes.
• Unit tests added/updated to cover PowerShell and Rego changes.
• Functional tests added/updated to cover PowerShell and Rego changes.
• All relevant functional tests passed.
• All automated checks (e.g., linting, static analysis, unit/smoke tests) passed.

✅ Pre-merge checklist

• PR passed smoke test check.

• Feature branch has been rebased against changes from parent branch, as needed

  Use Rebase branch button below or use this reference to rebase from the command line.

• Resolved all merge conflicts on branch

• Notified merge coordinator that PR is ready for merge via comment mention

✅ Post-merge checklist

• Feature branch deleted after merge to clean up repository.
• Verified that all checks pass on parent branch (e.g., main or release-name) after merge.

[mitchelbaker-cisa]

Main formatting considerations:

Bullets should start with the parent technique. If there are sub-techniques then list these as sub bullets for each baseline.

• T1110: Brute Force
  • T1110.001: Password Guessing
  • T1110.002: Password Cracking
  • T1110.003: Password Spraying

The techniques are formatted as [T1566:Phishing]. Let's add a space after the colon for all, [T1566: Phishing].

For consistency with GWS let's be sure to reference the parent technique for any sub-techniques.

[ahuynhMITRE]

thanks @mitchelbaker-cisa updated the mappings to do the following:

• add in reference parent ttp mapping
• format sub ttp mappings as sub bullets to these parent ttps
• added a space after the ":" for each policy

[mitchelbaker-cisa]

Thanks Andrew, looks good!

[ahuynhMITRE]

@nanda-katikaneni good to merge!