Add MITRE ATT&CK Adversarial Tactics, Techniques & Common Knowledge

[elhoim]

https://attack.mitre.org/wiki/Main_Page

[adulau]

Indeed, that's foreseen. Here is the plan:

• The adversary list is updated in the adversary groups, galaxies and threat actor tools, galaxies- we try to keep it up-to-date. Verification and cross-checked is more than welcome.
• The techniques would need to be added in a taxonomy. MITRE answered us that they plan to release a machine-readable version of the wiki. But we might start the taxonomy by copy-pasting the wiki.
• In the attacker techniques taxonomy, we plan to reference the adversary-groups and tools too. Format is under discussion.

[elhoim]

Ok, I will start with the techniques taxonomy then.

[adulau]

This is moving into a galaxy.

[adulau]

@Delta-Sierra is working on a new version.

[borgendorf]

Just in case you haven't seen it, the MITRE ATT&CK Techniques for Mobile, Pre-Attack, and Enterprise are out as JSON files at https://github.com/mitre/cti

We currently use the files to create an RDF representation of the concepts for our DarkLight product and they are nicely structured.

[adulau]

These are available in the MISP galaxies and available by default in MISP.