Mappings to MITRE ATT&CK Data Sources/Components

[jwillyamz]

Not sure how you want to integrate, but sharing some notes on potential mappings:

Process Activity = https://attack.mitre.org/datasources/DS0009/ Process Creation = https://attack.mitre.org/datasources/DS0009/#Process%20Creation Process Termination = https://attack.mitre.org/datasources/DS0009/#Process%20Termination Process Access = https://attack.mitre.org/datasources/DS0009/#Process%20Access Image/Library Loaded = https://attack.mitre.org/datasources/DS0011/#Module%20Load Remote Thread Creation = partially https://attack.mitre.org/datasources/DS0009/#OS%20API%20Execution & https://attack.mitre.org/datasources/DS0009/#Process%20Access (? 🤷 ) Process Tampering Activity = https://attack.mitre.org/datasources/DS0009/#Process%20Modification

File Manipulation = https://attack.mitre.org/datasources/DS0022/ File Creation = https://attack.mitre.org/datasources/DS0022/#File%20Creation File Opened = https://attack.mitre.org/datasources/DS0022/#File%20Access File Deletion = https://attack.mitre.org/datasources/DS0022/#File%20Deletion File Modification = https://attack.mitre.org/datasources/DS0022/#File%20Modification File Renaming = https://attack.mitre.org/datasources/DS0022/#File%20Modification

User Account Activity = https://attack.mitre.org/datasources/DS0002/ Local Account Creation = https://attack.mitre.org/datasources/DS0002/#User%20Account%20Creation Local Account Modification = https://attack.mitre.org/datasources/DS0002/#User%20Account%20Modification Local Account Deletion = https://attack.mitre.org/datasources/DS0002/#User%20Account%20Deletion Account Login = https://attack.mitre.org/datasources/DS0002/#User%20Account%20Authentication + https://attack.mitre.org/datasources/DS0028/#Logon%20Session%20Creation Account Logoff = [null]

Network Activity = https://attack.mitre.org/datasources/DS0029/ TCP Connection = https://attack.mitre.org/datasources/DS0029/#Network%20Connection%20Creation UDP Connection = https://attack.mitre.org/datasources/DS0029/#Network%20Connection%20Creation URL = https://attack.mitre.org/datasources/DS0029/#Network%20Traffic%20Content (? 🤷) DNS Query = https://attack.mitre.org/datasources/DS0029/#Network%20Traffic%20Content (? 🤷) File Downloaded =https://attack.mitre.org/datasources/DS0029/#Network%20Traffic%20Content + https://attack.mitre.org/datasources/DS0022/#File%20Creation (? 🤷)

Hash Algorithms = https://attack.mitre.org/datasources/DS0022/#File%20Metadata (? 🤷) MD5 = https://attack.mitre.org/datasources/DS0022/#File%20Metadata (? 🤷) SHA = https://attack.mitre.org/datasources/DS0022/#File%20Metadata (? 🤷) IMPHASH = https://attack.mitre.org/datasources/DS0022/#File%20Metadata (? 🤷)

Registry Activity = https://attack.mitre.org/datasources/DS0024/ Key/Value Creation = https://attack.mitre.org/datasources/DS0024/#Windows%20Registry%20Key%20Creation Key/Value Modification = https://attack.mitre.org/datasources/DS0024/#Windows%20Registry%20Key%20Modification Key/Value Deletion = https://attack.mitre.org/datasources/DS0024/#Windows%20Registry%20Key%20Deletion

Schedule Task Activity = https://attack.mitre.org/datasources/DS0003/ Scheduled Task Creation = https://attack.mitre.org/datasources/DS0003/#Scheduled%20Job%20Creation Scheduled Task Modification = https://attack.mitre.org/datasources/DS0003/#Scheduled%20Job%20Modification Scheduled Task Deletion = https://attack.mitre.org/datasources/DS0003/#Scheduled%20Job%20Modification (? 🤷)

Service Activity = https://attack.mitre.org/datasources/DS0019/ Service Creation = https://attack.mitre.org/datasources/DS0019/#Service%20Creation Service Modification = https://attack.mitre.org/datasources/DS0019/#Service%20Modification Service Deletion = https://attack.mitre.org/datasources/DS0019/#Service%20Modification (? 🤷)

Driver/Module Activity = https://attack.mitre.org/datasources/DS0027/ Driver Loaded = https://attack.mitre.org/datasources/DS0027/#Driver%20Load Driver Modification = https://attack.mitre.org/datasources/DS0022/#File%20Modification (? 🤷) Driver Unloaded = [null]

Device Operations = https://attack.mitre.org/datasources/DS0016/ Virtual Disk Mount = https://attack.mitre.org/datasources/DS0016/#Drive%20Creation USB Device Unmount = https://attack.mitre.org/datasources/DS0016/#Drive%20Creation USB Device Mount = https://attack.mitre.org/datasources/DS0016/#Drive%20Creation

Other Relevant Events Group Policy Modification = https://attack.mitre.org/datasources/DS0026/#Active%20Directory%20Object%20Modification (? 🤷)

Named Pipe Activity = https://attack.mitre.org/datasources/DS0023/ Pipe Creation = https://attack.mitre.org/datasources/DS0023/#Named%20Pipe%20Metadata (? 🤷) Pipe Connection = https://attack.mitre.org/datasources/DS0023/#Named%20Pipe%20Metadata (? 🤷)

EDR SysOps = https://attack.mitre.org/datasources/DS0013/ Agent Start = https://attack.mitre.org/datasources/DS0013/#Host%20Status (? 🤷) Agent Stop = https://attack.mitre.org/datasources/DS0013/#Host%20Status (? 🤷) Agent Install = https://attack.mitre.org/datasources/DS0013/#Host%20Status (? 🤷) Agent Uninstall = https://attack.mitre.org/datasources/DS0013/#Host%20Status (? 🤷) Agent Tampering = https://attack.mitre.org/datasources/DS0013/#Host%20Status (? 🤷) Agent Keep-Alive = https://attack.mitre.org/datasources/DS0013/#Host%20Status (? 🤷) Agent Errors = https://attack.mitre.org/datasources/DS0013/#Host%20Status (? 🤷)

WMI Activity = https://attack.mitre.org/datasources/DS0005/ WmiEventConsumerToFilter = https://attack.mitre.org/datasources/DS0005/#WMI%20Creation WmiEventConsumer = https://attack.mitre.org/datasources/DS0005/#WMI%20Creation WmiEventFilter = https://attack.mitre.org/datasources/DS0005/#WMI%20Creation

BIT JOBS Activity = [null] BIT JOBS Activity = [null]

PowerShell Activity = https://attack.mitre.org/datasources/DS0012/ + https://attack.mitre.org/datasources/DS0017/ Script-Block Activity = https://attack.mitre.org/datasources/DS0012/#Script%20Execution

[jwillyamz]

there's obviously always going to be differences in the level of abstraction, but also maybe some ideas to borrow each direction 👍

[tsale]

Awesome work Jamie, thank you. We'll review and decide how to implement those and display in the main table.

[inodee]

That came in faster than I thought! I am thinking about a visualization... oh wait! Heatmaps?! :P

Thanks @jwillyamz!

[tsale]

Thank you for taking the time to map all the sub-categories, @jwillyamz! Appreciate it 🙏 This is now implemented on the Google Sheet table: https://docs.google.com/spreadsheets/d/1ZMFrD6F6tvPtf_8McC-kWrNBBec_6Si3NW6AoWf3Kbg/edit#gid=1993314609