attack-mapping

Attack mapping

Ground each technique id in an observable from this finding. The labelled block is the whole answer: write it first and always finish it, then at most two sentences. Keep every observable to a few words. Do not restate technique definitions. This turn may have no tools. If a tool is not callable, skip it and still write the block. Never end the turn on a lookup you announced.

Observables

From raw_data, description, and iocs, note only fields that are present:

• process and command line (process, command_line)
• parent (parent_process)
• network destination and port (dst_ip, dst_domain, dst_host, dst_port)
• auth event (account, source address, failed_attempts, time_window)
• file written
• registry key
• email artefact (sender, subject, link, or attachment)

Tools

Name a tool only when you hold it.

• If you hold get_finding and the turn has an id but not the finding, call it. If the finding is already in the turn, do not call it.
• If you hold get_technique_rollup and it is callable, call it once. environment is seen when that rollup's count for the technique id is greater than zero, and not seen otherwise.
• If you do not hold get_technique_rollup, or it is not callable, environment is not checked. Never guess a count.

Status

Take mitre_techniques in listed order. An empty or missing list means there is nothing to confirm. For each id already on the finding:

• confirmed when an observable shows that technique's behaviour. An id already listed is never added.
• wrong-sub-technique when the behaviour is that family but the observable pins a different sub-technique.
• unsupported when no observable shows it.

Then add an id that is not on the list only when an observable shows the behaviour. Prefer the sub-technique when the observable pins it; use the parent only when it does not. An added id's status is added. Apply a pin only when this finding has its observables. Do not emit a technique from a pin that did not match, and do not add a second technique for the same fact.