ATT&CK™-Tools

Utilities for MITRE™ ATT&CK™

This repository contains the following:

• ATT&CK™ Data Model: a relational data model for ATT&CK™.
• ATT&CK™ View: an adversary emulation planning tool.

Content

• Release Notes
• Overview
• The ATT&CK™ Data Model
• Accessing ATT&CK™ Data with SQL
• Additional Resources
• License

Release Notes

• There are 32 and 64-bit builds (32.zip and 64.zip)
• attack_view_db.sqlite is a SQLite database for ATT&CK™
• attack_view_db_structure and attack_view_db_data are SQL scripts used to build the SQLite database
• enterprise-attack.xml is an XML version of MITRE™ ATT&CK™ JSON

Overview

ATT&CK™ View is a planning tool that help defenders in designing an adversary emulation plans based on MITRE™ ATT&CK™ framework in a structured approach. As a demonstration, ATT&CK™ View comes bundled with a full adversary emulation plan for APT3 developed by MITRE™ (SOURCE : https://attack.mitre.org/wiki/Adversary_Emulation_Plans).

The ATT&CK™ Data Model

There are many use cases for ATT&CK™ framework, many of which depend on existing tools being ATT&CK™-enabled, to make this process easier, the database in this repository can help in getting up to speed with integrating existing tools with ATT&CK™, build your own tooling or fuse ATT&CK™ with other existing frameworks.

The database is based on SQLite for simplicity and portability, however, it is better to think of terms of a data model instead of the underlying technology used in implementation, this is very important, as it enables exploring other useful models and applications and then narrow down to technology.

The following is a conceptual model that can be implemented using any database technology (The attack_view_db_structure.sql is a good starting point).

Accessing ATT&CK™ Data with SQL

To have a better understanding about the database structure, following is a list of sample SQL queries used to read ATT&CK™. To run the following SQL queries, you will need a SQLite management tool, there are many free and paid tools available supporting Windows, macOS and Linux (https://www.sqlite.org/cvstrac/wiki?p=ManagementTools)

Some output truncated for brevity

Get the list of ATT&CK™ techniques

SQL

SELECT name FROM sdos_object WHERE type IS "attack-pattern";

OUTPUT

Get the list of ATT&CK™ techniques names with their STIX 2.0 identifier

SQL

SELECT id, name FROM sdos_object WHERE type IS "attack-pattern";

OUTPUT

The id field is a unique key that will be used frequently in many SQL queries

The external references are stored in external_references table, since one ATT&CK™ technique can have one or more references, the link between the two tables is the technique identifier (check previous query), I will list multiple ways to access the external references

Get the list of ATT&CK™ techniques with external names

SQL

SELECT name, external_id
FROM sdos_object INNER JOIN external_references ON 
     sdos_object.id = external_references.fk_object_id
WHERE 
  sdos_object.type IS "attack-pattern"
  AND 
  external_references.source_name IS "mitre-attack";

OUTPUT

List all ATT&CK™ techniques associated with "Windows" platform

SQL

SELECT name, external_id
FROM sdos_object INNER JOIN external_references ON
     sdos_object.id = external_references.fk_object_id
WHERE 
  sdos_object.type IS "attack-pattern" AND 
  x_mitre_platforms_windows IS "true" AND 
  external_references.source_name IS "mitre-attack";

OUTPUT

List all Malware objects along with their description

SQL

SELECT name, description FROM sdos_object 
WHERE type IS "malware";

OUTPUT

List all Adversaries (intrusion-sets) along with their description

SQL

SELECT name, description FROM sdos_object 
WHERE type IS "intrusion-set";

OUTPUT

List all Tools and Malware used by a certain Adversary

All STIX 2.0 Domain Objects (SDO) relations are stored in "relationship" table. The following query is a nested query used to get the tools/malware used by APT3:

SQL

SELECT name, description
FROM sdos_object
WHERE (type IS "malware" OR type IS "tool") -- Query for tools or malware
  AND id IN (SELECT target_ref -- filter tools/malware associated with APT3
             FROM relationship
             WHERE relationship_type IS "uses" -- Source "uses" Target
               AND source_ref IS -- Source is APT3 identifier
                   "intrusion-set--0bbdf25b-30ff-4894-a1cd-49260d0dd2d9");

OUTPUT

Get ATOMIC™ test(s) associated with an ATT&CK™ technique

ATOMIC™ Tests are stored in three tables

• atomic_test table, this table simply maps ATOMIC™ tests to ATT&CK™ techniques. Each atomic_test record has one or more atomic_attack_test records that contains the actual test details
• atomic_attack_test, this tables holds the actual ATOMIC™ test details, each test has one or more input arguments represented with an atomic_input_arguments record
• atomic_input_arguments, holds tests input arguments details

The following SQL statement retrieves the ATOMIC™ test(s) associated with ATT&CK™ technique "T1031"

SQL

SELECT name, description, executor_name, executor_command
FROM atomic_attack_test
  WHERE fk_atomic_attack_id IN 
    (SELECT id FROM atomic_attack 
     WHERE fk_attack_external_id IS "T1031");

OUTPUT

Additional Resources

• Research Automation with ATT&CK & Python

• MITRE ATT&CK™ : de l’importance de la temporalité

License

Copyright 2018 Nader Shallabi. All rights reserved. 

ATT&CK™ TOOLS CAN BE COPIED AND/OR DISTRIBUTED WITHOUT ANY EXPRESS PERMISSION OF NADER SHALLABI.

THIS SOFTWARE IS PROVIDED BY NADER SHALLABI ''AS IS'' AND ANY EXPRESS OR IMPLIED
WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL NADER SHALLABI
OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

The views and conclusions contained in the software and documentation are those of the authors and
should not be interpreted as representing official policies, either expressed or implied, of Nader Shallabi.