Mappings to MITRE ATT&CK Data Sources/Components

[jwillyamz]

Not sure how you want to integrate, but sharing some notes on potential mappings:

Process Activity = https://attack.mitre.org/datasources/DS0009/
Process Creation = https://attack.mitre.org/datasources/DS0009/#Process%20Creation
Process Termination = https://attack.mitre.org/datasources/DS0009/#Process%20Termination
Process Access = https://attack.mitre.org/datasources/DS0009/#Process%20Access
Image/Library Loaded = https://attack.mitre.org/datasources/DS0011/#Module%20Load
Remote Thread Creation = partially https://attack.mitre.org/datasources/DS0009/#OS%20API%20Execution & https://attack.mitre.org/datasources/DS0009/#Process%20Access (? 🤷 )
Process Tampering Activity = https://attack.mitre.org/datasources/DS0009/#Process%20Modification

File Manipulation = https://attack.mitre.org/datasources/DS0022/
File Creation = https://attack.mitre.org/datasources/DS0022/#File%20Creation
File Opened = https://attack.mitre.org/datasources/DS0022/#File%20Access
File Deletion = https://attack.mitre.org/datasources/DS0022/#File%20Deletion
File Modification = https://attack.mitre.org/datasources/DS0022/#File%20Modification
File Renaming = https://attack.mitre.org/datasources/DS0022/#File%20Modification

User Account Activity = https://attack.mitre.org/datasources/DS0002/
Local Account Creation = https://attack.mitre.org/datasources/DS0002/#User%20Account%20Creation
Local Account Modification = https://attack.mitre.org/datasources/DS0002/#User%20Account%20Modification
Local Account Deletion = https://attack.mitre.org/datasources/DS0002/#User%20Account%20Deletion
Account Login = https://attack.mitre.org/datasources/DS0002/#User%20Account%20Authentication + https://attack.mitre.org/datasources/DS0028/#Logon%20Session%20Creation
Account Logoff = [null]

Network Activity = https://attack.mitre.org/datasources/DS0029/
TCP Connection = https://attack.mitre.org/datasources/DS0029/#Network%20Connection%20Creation
UDP Connection = https://attack.mitre.org/datasources/DS0029/#Network%20Connection%20Creation
URL = https://attack.mitre.org/datasources/DS0029/#Network%20Traffic%20Content (? 🤷)
DNS Query = https://attack.mitre.org/datasources/DS0029/#Network%20Traffic%20Content (? 🤷)
File Downloaded =https://attack.mitre.org/datasources/DS0029/#Network%20Traffic%20Content + https://attack.mitre.org/datasources/DS0022/#File%20Creation (? 🤷)

Hash Algorithms = https://attack.mitre.org/datasources/DS0022/#File%20Metadata (? 🤷)
MD5 = https://attack.mitre.org/datasources/DS0022/#File%20Metadata (? 🤷)
SHA = https://attack.mitre.org/datasources/DS0022/#File%20Metadata (? 🤷)
IMPHASH = https://attack.mitre.org/datasources/DS0022/#File%20Metadata (? 🤷)

Registry Activity = https://attack.mitre.org/datasources/DS0024/
Key/Value Creation = https://attack.mitre.org/datasources/DS0024/#Windows%20Registry%20Key%20Creation
Key/Value Modification = https://attack.mitre.org/datasources/DS0024/#Windows%20Registry%20Key%20Modification
Key/Value Deletion = https://attack.mitre.org/datasources/DS0024/#Windows%20Registry%20Key%20Deletion

Schedule Task Activity = https://attack.mitre.org/datasources/DS0003/
Scheduled Task Creation = https://attack.mitre.org/datasources/DS0003/#Scheduled%20Job%20Creation
Scheduled Task Modification = https://attack.mitre.org/datasources/DS0003/#Scheduled%20Job%20Modification
Scheduled Task Deletion = https://attack.mitre.org/datasources/DS0003/#Scheduled%20Job%20Modification (? 🤷)

Service Activity = https://attack.mitre.org/datasources/DS0019/
Service Creation = https://attack.mitre.org/datasources/DS0019/#Service%20Creation
Service Modification = https://attack.mitre.org/datasources/DS0019/#Service%20Modification
Service Deletion = https://attack.mitre.org/datasources/DS0019/#Service%20Modification (? 🤷)

Driver/Module Activity = https://attack.mitre.org/datasources/DS0027/
Driver Loaded = https://attack.mitre.org/datasources/DS0027/#Driver%20Load
Driver Modification = https://attack.mitre.org/datasources/DS0022/#File%20Modification (? 🤷)
Driver Unloaded = [null]

Device Operations = https://attack.mitre.org/datasources/DS0016/
Virtual Disk Mount = https://attack.mitre.org/datasources/DS0016/#Drive%20Creation
USB Device Unmount = https://attack.mitre.org/datasources/DS0016/#Drive%20Creation
USB Device Mount = https://attack.mitre.org/datasources/DS0016/#Drive%20Creation

Other Relevant Events
Group Policy Modification = https://attack.mitre.org/datasources/DS0026/#Active%20Directory%20Object%20Modification (? 🤷)

Named Pipe Activity = https://attack.mitre.org/datasources/DS0023/
Pipe Creation = https://attack.mitre.org/datasources/DS0023/#Named%20Pipe%20Metadata (? 🤷)
Pipe Connection = https://attack.mitre.org/datasources/DS0023/#Named%20Pipe%20Metadata (? 🤷)

EDR SysOps = https://attack.mitre.org/datasources/DS0013/
Agent Start = https://attack.mitre.org/datasources/DS0013/#Host%20Status (? 🤷)
Agent Stop = https://attack.mitre.org/datasources/DS0013/#Host%20Status (? 🤷)
Agent Install = https://attack.mitre.org/datasources/DS0013/#Host%20Status (? 🤷)
Agent Uninstall = https://attack.mitre.org/datasources/DS0013/#Host%20Status (? 🤷)
Agent Tampering = https://attack.mitre.org/datasources/DS0013/#Host%20Status (? 🤷)
Agent Keep-Alive = https://attack.mitre.org/datasources/DS0013/#Host%20Status (? 🤷)
Agent Errors = https://attack.mitre.org/datasources/DS0013/#Host%20Status (? 🤷)

WMI Activity = https://attack.mitre.org/datasources/DS0005/
WmiEventConsumerToFilter = https://attack.mitre.org/datasources/DS0005/#WMI%20Creation
WmiEventConsumer = https://attack.mitre.org/datasources/DS0005/#WMI%20Creation
WmiEventFilter = https://attack.mitre.org/datasources/DS0005/#WMI%20Creation

BIT JOBS Activity = [null]
BIT JOBS Activity = [null]

PowerShell Activity = https://attack.mitre.org/datasources/DS0012/ + https://attack.mitre.org/datasources/DS0017/
Script-Block Activity = https://attack.mitre.org/datasources/DS0012/#Script%20Execution

[jwillyamz]

there's obviously always going to be differences in the level of abstraction, but also maybe some ideas to borrow each direction 👍

[tsale]

Awesome work Jamie, thank you. We'll review and decide how to implement those and display in the main table.

[inodee]

That came in faster than I thought! I am thinking about a visualization... oh wait! Heatmaps?! :P

Thanks @jwillyamz!

[tsale]

Thank you for taking the time to map all the sub-categories, @jwillyamz! Appreciate it 🙏 This is now implemented on the Google Sheet table: https://docs.google.com/spreadsheets/d/1ZMFrD6F6tvPtf_8McC-kWrNBBec_6Si3NW6AoWf3Kbg/edit#gid=1993314609