Question: How to handle non-mappable types of event?

rabobank-cdc / DeTTECT

Detect Tactics, Techniques & Combat Threats

GNU General Public License v3.0

2.05k stars 333 forks source link

Question: How to handle non-mappable types of event? #98

Closed Hackcidental closed 1 year ago

Hackcidental commented 1 year ago

Hi,

Thank you for this framework, my team and I are studying it, and we think it's a really great tool.

We're facing some issues where we have some types of events that we cannot map to the categories that are presents in the framework. How do you usually deal with those? Do you have some kind of guidance/mapping guide?

Two examples from the Windows Environment:

An account failed to log on
A Kerberos service ticket was granted

Thanks!

rubinatorz commented 1 year ago

HI @Hackcidental

A great resource on mapping event ID's from your logs to ATT&CK data sources/components is OSSEM: https://github.com/OTRF/OSSEM-DM/blob/main/use-cases/mitre_attack/attack_events_mapping.csv

In OSSEM "An account failed to log on" is mapped to User Account Authentication data component.

"A Kerberos service ticket was granted" is not in OSSEM (yet). But I think the best mapping currently is Active Directory Credential Request.

Regards, Ruben

Hackcidental commented 1 year ago

Hi @rubinatorz,

Thank you for the great tip, we will look into the OSSEM mapping.

Best regards, Matteo