Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules #3165

Merged
merged 11 commits into from
Oct 15, 2023
Merged

[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules #3165

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
667a631
[Security Content] Adjust Mitre Att&ck Mappings - Windows Rules
w0rk3r Oct 9, 2023
5a37e05
Merge branch 'main' into mitre_mapping_review
w0rk3r Oct 9, 2023
068f46e
Fix dates
w0rk3r Oct 9, 2023
a509314
Fix unit test errors
w0rk3r Oct 9, 2023
24ac32b
Merge branch 'main' into mitre_mapping_review
imays11 Oct 13, 2023
511dfd6
updated tags and fixed branch conflicts
imays11 Oct 14, 2023
f76f195
Merge branch 'main' into mitre_mapping_review
imays11 Oct 14, 2023
0bd4c9a
description nit
imays11 Oct 14, 2023
f89280a
Merge branch 'main' into mitre_mapping_review
imays11 Oct 15, 2023
2d037c3
Reverting unintended changes
w0rk3r Oct 15, 2023
a3bcf84
Update initial_access_suspicious_ms_office_child_process.toml
w0rk3r Oct 15, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 19 additions & 1 deletion rules/windows/collection_email_powershell_exchange_mailbox.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
updated_date = "2023/09/10"
w0rk3r marked this conversation as resolved.
Show resolved Hide resolved

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -104,3 +104,21 @@ id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[rule.threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"



[rule.threat.tactic]
id = "TA0002"
name = "Execution"
imays11 marked this conversation as resolved.
Show resolved Hide resolved
reference = "https://attack.mitre.org/tactics/TA0002/"

7 changes: 6 additions & 1 deletion rules/windows/collection_mailbox_export_winlog.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ integration = ["windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/07/05"
updated_date = "2023/09/10"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -77,6 +77,11 @@ event.category:process and host.os.type:windows and

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1005"
name = "Data from Local System"
reference = "https://attack.mitre.org/techniques/T1005/"

[[rule.threat.technique]]
id = "T1114"
name = "Email Collection"
Expand Down
7 changes: 6 additions & 1 deletion rules/windows/collection_posh_audio_capture.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ integration = ["windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/07/17"
updated_date = "2023/09/10"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -117,6 +117,11 @@ name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"


[[rule.threat.technique]]
id = "T1106"
name = "Native API"
reference = "https://attack.mitre.org/techniques/T1106/"


[rule.threat.tactic]
id = "TA0002"
Expand Down
7 changes: 6 additions & 1 deletion rules/windows/collection_posh_keylogger.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ integration = ["windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/08/21"
updated_date = "2023/09/10"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -128,6 +128,11 @@ name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"


[[rule.threat.technique]]
id = "T1106"
name = "Native API"
reference = "https://attack.mitre.org/techniques/T1106/"


[rule.threat.tactic]
id = "TA0002"
Expand Down
7 changes: 6 additions & 1 deletion rules/windows/collection_winrar_encryption.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
updated_date = "2023/09/10"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -90,6 +90,11 @@ id = "T1560.001"
name = "Archive via Utility"
reference = "https://attack.mitre.org/techniques/T1560/001/"

[[rule.threat.technique]]
id = "T1005"
name = "Data from Local System"
reference = "https://attack.mitre.org/techniques/T1005/"



[rule.threat.tactic]
Expand Down
19 changes: 16 additions & 3 deletions rules/windows/command_and_control_certreq_postdata.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,18 +4,18 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
updated_date = "2023/09/10"

[rule]
author = ["Elastic"]
description = """
Identifies Certreq making an HTTP Post request. Adversaries could abuse Certreq to exfiltrate data to a remote URL.
Identifies Certreq making an HTTP Post request. Adversaries could abuse Certreq to download files or upload data to a remote URL.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Exfiltration via Certreq"
name = "Potential File Transfer via Certreq"
references = ["https://lolbas-project.github.io/lolbas/Binaries/Certreq/"]
risk_score = 47
rule_id = "79f0a1f7-ed6b-471c-8eb1-23abd6470b1c"
Expand Down Expand Up @@ -56,3 +56,16 @@ reference = "https://attack.mitre.org/techniques/T1218/"
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1567"
name = "Exfiltration Over Web Service"
reference = "https://attack.mitre.org/techniques/T1567/"

[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
imays11 marked this conversation as resolved.
Show resolved Hide resolved
reference = "https://attack.mitre.org/tactics/TA0010/"

11 changes: 10 additions & 1 deletion rules/windows/command_and_control_common_webservices.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
updated_date = "2023/09/10"

[transform]
[[transform.osquery]]
Expand Down Expand Up @@ -180,6 +180,15 @@ id = "T1102"
name = "Web Service"
reference = "https://attack.mitre.org/techniques/T1102/"

[[rule.threat.technique]]
id = "T1568"
name = "Dynamic Resolution"
reference = "https://attack.mitre.org/techniques/T1568/"

[[rule.threat.technique.subtechnique]]
id = "T1568.002"
name = "Domain Generation Algorithms"
reference = "https://attack.mitre.org/techniques/T1568/002/"

[rule.threat.tactic]
id = "TA0011"
Expand Down
7 changes: 5 additions & 2 deletions rules/windows/command_and_control_dns_tunneling_nslookup.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
updated_date = "2023/09/10"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -82,7 +82,10 @@ id = "T1071.004"
name = "DNS"
reference = "https://attack.mitre.org/techniques/T1071/004/"


[[rule.threat.technique]]
id = "T1572"
name = "Protocol Tunneling"
reference = "https://attack.mitre.org/techniques/T1572/"

[rule.threat.tactic]
id = "TA0011"
Expand Down
14 changes: 13 additions & 1 deletion rules/windows/command_and_control_port_forwarding_added_registry.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
updated_date = "2023/09/10"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -102,3 +102,15 @@ id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
imays11 marked this conversation as resolved.
Show resolved Hide resolved
reference = "https://attack.mitre.org/tactics/TA0005/"

19 changes: 18 additions & 1 deletion rules/windows/command_and_control_rdp_tunnel_plink.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
updated_date = "2023/09/10"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -93,3 +93,20 @@ id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"
[[rule.threat.technique.subtechnique]]
id = "T1021.004"
name = "SSH"
reference = "https://attack.mitre.org/techniques/T1021/004/"



[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
imays11 marked this conversation as resolved.
Show resolved Hide resolved
reference = "https://attack.mitre.org/tactics/TA0008/"
20 changes: 19 additions & 1 deletion rules/windows/command_and_control_remote_file_copy_scripts.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2020/11/29"
integration = ["endpoint", "windows"]
maturity = "production"
updated_date = "2023/06/22"
updated_date = "2023/09/10"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"

Expand Down Expand Up @@ -121,3 +121,21 @@ id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[rule.threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"



[rule.threat.tactic]
id = "TA0002"
name = "Execution"
imays11 marked this conversation as resolved.
Show resolved Hide resolved
reference = "https://attack.mitre.org/tactics/TA0002/"

20 changes: 19 additions & 1 deletion rules/windows/credential_access_cmdline_dump_tool.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
updated_date = "2023/09/10"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -130,3 +130,21 @@ id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[rule.threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
imays11 marked this conversation as resolved.
Show resolved Hide resolved
reference = "https://attack.mitre.org/tactics/TA0005/"

7 changes: 6 additions & 1 deletion rules/windows/credential_access_copy_ntds_sam_volshadowcp_cmdline.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
updated_date = "2023/09/10"

[rule]
author = ["Elastic", "Austin Songer"]
Expand Down Expand Up @@ -57,6 +57,11 @@ id = "T1003.002"
name = "Security Account Manager"
reference = "https://attack.mitre.org/techniques/T1003/002/"

[[rule.threat.technique.subtechnique]]
id = "T1003.003"
name = "NTDS"
reference = "https://attack.mitre.org/techniques/T1003/003/"



[rule.threat.tactic]
Expand Down
34 changes: 33 additions & 1 deletion rules/windows/credential_access_credential_dumping_msbuild.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2020/03/25"
integration = ["endpoint", "windows"]
maturity = "production"
updated_date = "2023/06/22"
updated_date = "2023/09/10"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"

Expand Down Expand Up @@ -118,9 +118,41 @@ id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"

[[rule.threat.technique.subtechnique]]
id = "T1003.002"
name = "Security Account Manager"
reference = "https://attack.mitre.org/techniques/T1003/002/"


[[rule.threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[rule.threat.technique.subtechnique]]
id = "T1555.004"
name = "Windows Credential Manager"
reference = "https://attack.mitre.org/techniques/T1555/004/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1127"
name = "Trusted Developer Utilities Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1127/"
[[rule.threat.technique.subtechnique]]
id = "T1127.001"
name = "MSBuild"
reference = "https://attack.mitre.org/techniques/T1127/001/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
imays11 marked this conversation as resolved.
Show resolved Hide resolved
reference = "https://attack.mitre.org/tactics/TA0005/"

Loading
Loading