[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules #3165

w0rk3r · 2023-10-09T19:35:04Z

Issues

Resolves #3098

Summary

Improve the Mitre Mappings for the Windows Ruleset

Aegrah · 2023-10-09T19:39:00Z

rules/windows/defense_evasion_suspicious_managedcode_host_process.toml

@@ -30,7 +30,7 @@ sequence by process.entity_id with maxspan=5m
  process.name : ("wscript.exe", "cscript.exe", "mshta.exe", "wmic.exe", "regsvr32.exe", "svchost.exe", "dllhost.exe", "cmstp.exe")]
 [file where host.os.type == "windows" and event.type != "deletion" and
  file.name : ("wscript.exe.log",
-               "cscript.exe",
+               "cscript.exe.log",


My man even doing some tunings along the way

rules/windows/collection_email_powershell_exchange_mailbox.toml

Aegrah

Great work! That MITRE map is going to look amazing!

imays11

Wow, a lot of great work. Most of my comments are for adding an additional tag for the new Tactic for some rules

rules/windows/command_and_control_certreq_postdata.toml

rules/windows/collection_email_powershell_exchange_mailbox.toml

rules/windows/command_and_control_port_forwarding_added_registry.toml

rules/windows/command_and_control_rdp_tunnel_plink.toml

rules/windows/command_and_control_remote_file_copy_scripts.toml

rules_building_block/execution_unsigned_service_executable.toml

rules_building_block/lateral_movement_posh_winrm_activity.toml

rules_building_block/lateral_movement_unusual_process_sql_accounts.toml

rules_building_block/persistence_msoffice_startup_registry.toml

rules_building_block/privilege_escalation_expired_driver_loaded.toml

w0rk3r · 2023-10-11T23:18:05Z

@imays11, can you add those tags to the rules in this branch(mitre_mapping_review)? I don't think this is enforced though, I think we may be fine with the primary tag only

imays11 · 2023-10-13T18:21:56Z

@imays11, can you add those tags to the rules in this branch(mitre_mapping_review)? I don't think this is enforced though, I think we may be fine with the primary tag only

Yea I don't think it's enforced either but a good practice especially if we're taking the time to add new tactics to improve mapping we should keep the tags updated too. I'll add the additional tags!

updated tags and fixed branch conflicts

* [Security Content] Adjust Mitre Att&ck Mappings - Windows Rules * Fix dates * Fix unit test errors * updated tags and fixed branch conflicts updated tags and fixed branch conflicts * description nit * Reverting unintended changes * Update initial_access_suspicious_ms_office_child_process.toml --------- Co-authored-by: imays11 <[email protected]> Removed changes from: - rules/windows/credential_access_dcsync_newterm_subjectuser.toml - rules/windows/credential_access_lsass_openprocess_api.toml - rules/windows/credential_access_suspicious_lsass_access_memdump.toml - rules/windows/defense_evasion_execution_msbuild_started_by_script.toml - rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml - rules/windows/defense_evasion_suspicious_process_access_direct_syscall.toml - rules/windows/defense_evasion_unsigned_dll_loaded_from_suspdir.toml - rules/windows/persistence_driver_newterm_imphash.toml - rules/windows/persistence_service_dll_unsigned.toml - rules_building_block/execution_unsigned_service_executable.toml (selectively cherry picked from commit f584fb6)

* [Security Content] Adjust Mitre Att&ck Mappings - Windows Rules * Fix dates * Fix unit test errors * updated tags and fixed branch conflicts updated tags and fixed branch conflicts * description nit * Reverting unintended changes * Update initial_access_suspicious_ms_office_child_process.toml --------- Co-authored-by: imays11 <[email protected]> Removed changes from: - rules/windows/credential_access_lsass_openprocess_api.toml - rules/windows/credential_access_suspicious_lsass_access_memdump.toml - rules/windows/defense_evasion_execution_msbuild_started_by_script.toml - rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml - rules/windows/defense_evasion_suspicious_process_access_direct_syscall.toml - rules/windows/persistence_driver_newterm_imphash.toml - rules_building_block/execution_unsigned_service_executable.toml (selectively cherry picked from commit f584fb6)

* [Security Content] Adjust Mitre Att&ck Mappings - Windows Rules * Fix dates * Fix unit test errors * updated tags and fixed branch conflicts updated tags and fixed branch conflicts * description nit * Reverting unintended changes * Update initial_access_suspicious_ms_office_child_process.toml --------- Co-authored-by: imays11 <[email protected]> Removed changes from: - rules/windows/credential_access_lsass_openprocess_api.toml - rules/windows/credential_access_suspicious_lsass_access_memdump.toml - rules/windows/defense_evasion_suspicious_process_access_direct_syscall.toml (selectively cherry picked from commit f584fb6)

* [Security Content] Adjust Mitre Att&ck Mappings - Windows Rules * Fix dates * Fix unit test errors * updated tags and fixed branch conflicts updated tags and fixed branch conflicts * description nit * Reverting unintended changes * Update initial_access_suspicious_ms_office_child_process.toml --------- Co-authored-by: imays11 <[email protected]> Removed changes from: - rules/windows/credential_access_suspicious_lsass_access_memdump.toml - rules/windows/defense_evasion_suspicious_process_access_direct_syscall.toml (selectively cherry picked from commit f584fb6)

* [Security Content] Adjust Mitre Att&ck Mappings - Windows Rules * Fix dates * Fix unit test errors * updated tags and fixed branch conflicts updated tags and fixed branch conflicts * description nit * Reverting unintended changes * Update initial_access_suspicious_ms_office_child_process.toml --------- Co-authored-by: imays11 <[email protected]> (cherry picked from commit f584fb6)

w0rk3r added 2 commits October 9, 2023 16:30

[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules

667a631

Merge branch 'main' into mitre_mapping_review

5a37e05

w0rk3r added OS: Windows windows related rules Domain: Endpoint backport: auto Security Content labels Oct 9, 2023

w0rk3r requested review from DefSecSentinel, imays11, Samirbous, Aegrah, shashank-elastic and terrancedejesus October 9, 2023 19:35

w0rk3r self-assigned this Oct 9, 2023

botelastic bot added the bbr Building Block Rules label Oct 9, 2023

Aegrah reviewed Oct 9, 2023

View reviewed changes

rules/windows/collection_email_powershell_exchange_mailbox.toml Outdated Show resolved Hide resolved

w0rk3r added 2 commits October 9, 2023 16:44

Fix dates

068f46e

Fix unit test errors

a509314

w0rk3r requested a review from Aegrah October 9, 2023 20:37

Aegrah approved these changes Oct 9, 2023

View reviewed changes

imays11 reviewed Oct 11, 2023

View reviewed changes

Merge branch 'main' into mitre_mapping_review

24ac32b

terrancedejesus approved these changes Oct 13, 2023

View reviewed changes

imays11 added 3 commits October 13, 2023 20:15

updated tags and fixed branch conflicts

511dfd6

updated tags and fixed branch conflicts

Merge branch 'main' into mitre_mapping_review

f76f195

description nit

0bd4c9a

imays11 approved these changes Oct 14, 2023

View reviewed changes

Merge branch 'main' into mitre_mapping_review

f89280a

w0rk3r added 2 commits October 15, 2023 17:53

Reverting unintended changes

2d037c3

Update initial_access_suspicious_ms_office_child_process.toml

a3bcf84

w0rk3r merged commit f584fb6 into main Oct 15, 2023
11 checks passed

w0rk3r deleted the mitre_mapping_review branch October 15, 2023 21:12

w0rk3r mentioned this pull request Oct 15, 2023

[Meta] Review Detection Rules for Mitre Mapping Coverage Improvements #3098

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules #3165

[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules #3165

w0rk3r commented Oct 9, 2023

Aegrah Oct 9, 2023

Aegrah left a comment

imays11 left a comment •

edited

Loading

w0rk3r commented Oct 11, 2023 •

edited

Loading

imays11 commented Oct 13, 2023

[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules #3165

[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules #3165

Conversation

w0rk3r commented Oct 9, 2023

Issues

Summary

Aegrah Oct 9, 2023

Choose a reason for hiding this comment

Aegrah left a comment

Choose a reason for hiding this comment

imays11 left a comment • edited Loading

Choose a reason for hiding this comment

w0rk3r commented Oct 11, 2023 • edited Loading

imays11 commented Oct 13, 2023

imays11 left a comment •

edited

Loading

w0rk3r commented Oct 11, 2023 •

edited

Loading