GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → olafhartong → Attackdatamap

olafhartong / Attackdatamap

Licence: mit
A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework

Programming Languages

powershell
5483 projects

Labels

dfirthreat-huntingmitre-attacksiem

Projects that are alternatives of or similar to Attackdatamap

Malwless
Test Blue Team detections without running any attack.
Stars: ✭ 215 (-18.56%)
Mutual labels:  dfir, mitre-attack, siem
Threathunting
A Splunk app mapped to MITRE ATT&CK to guide your threat hunts
Stars: ✭ 738 (+179.55%)
Mutual labels:  dfir, threat-hunting, mitre-attack
rhq
Recon Hunt Queries
Stars: ✭ 66 (-75%)
Mutual labels:  dfir, threat-hunting, mitre-attack
Sysmon Modular
A repository of sysmon configuration modules
Stars: ✭ 1,229 (+365.53%)
Mutual labels:  dfir, threat-hunting, mitre-attack
Sentinel Attack
Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK
Stars: ✭ 676 (+156.06%)
Mutual labels:  threat-hunting, mitre-attack, siem
Evtx Attack Samples
Windows Events Attack Samples
Stars: ✭ 1,243 (+370.83%)
Mutual labels:  dfir, threat-hunting, mitre-attack
Atc React
A knowledge base of actionable Incident Response techniques
Stars: ✭ 226 (-14.39%)
Mutual labels:  dfir, mitre-attack
Threathunter Playbook
A Threat hunter's playbook to aid the development of techniques and hypothesis for hunting campaigns.
Stars: ✭ 2,879 (+990.53%)
Mutual labels:  dfir, threat-hunting
Threatpinchlookup
Documentation and Sharing Repository for ThreatPinch Lookup Chrome & Firefox Extension
Stars: ✭ 257 (-2.65%)
Mutual labels:  dfir, threat-hunting
SIGMA-detection-rules
Set of SIGMA rules (>250) mapped to MITRE Att@k tactic and techniques
Stars: ✭ 97 (-63.26%)
Mutual labels:  threat-hunting, mitre-attack
Oriana
Oriana is a threat hunting tool that leverages a subset of Windows events to build relationships, calculate totals and run analytics. The results are presented in a Web layer to help defenders identify outliers and suspicious behavior on corporate environments.
Stars: ✭ 152 (-42.42%)
Mutual labels:  dfir, threat-hunting
Vast
🔮 Visibility Across Space and Time
Stars: ✭ 227 (-14.02%)
Mutual labels:  dfir, siem
Azure-Sentinel-4-SecOps
Microsoft Sentinel SOC Operations
Stars: ✭ 140 (-46.97%)
Mutual labels:  threat-hunting, siem
Slides
Misc Threat Hunting Resources
Stars: ✭ 203 (-23.11%)
Mutual labels:  dfir, threat-hunting
Whids
Open Source EDR for Windows
Stars: ✭ 188 (-28.79%)
Mutual labels:  dfir, threat-hunting
TA-Sysmon-deploy
Deploy and maintain Symon through the Splunk Deployment Sever
Stars: ✭ 31 (-88.26%)
Mutual labels:  dfir, threat-hunting
S2AN
S2AN - Mapper of Sigma/Suricata Rules/Signatures ➡️ MITRE ATT&CK Navigator
Stars: ✭ 70 (-73.48%)
Mutual labels:  threat-hunting, mitre-attack
SysmonConfigPusher
Pushes Sysmon Configs
Stars: ✭ 59 (-77.65%)
Mutual labels:  threat-hunting, siem
detection-rules
Threat Detection & Anomaly Detection rules for popular open-source components
Stars: ✭ 34 (-87.12%)
Mutual labels:  threat-hunting, siem
fastfinder
Incident Response - Fast suspicious file finder
Stars: ✭ 116 (-56.06%)
Mutual labels:  dfir, threat-hunting
View All Similar Projects ➔

license Maintenance GitHub last commit Twitter

ATTACKdatamap

A datasource assessment on an event level to show potential coverage of the "MITRE ATT&CK" framework.

This tool is developed by me and has no affiliation with "MITRE" nor with its great "ATT&CK" team, it is developed with the intention to ease the mapping of data sources to assess one's potential coverate.

More details in a blogpost here

Start

This tool requires module ImportExcel, Install it like this PS C:\> Install-Module ImportExcel

Import the module with Import-Module .\ATTACKdatamap.psd1

OS X Only, ImportExcel Module Cannot Autosize by default, install: brew install mono-libgdiplus

Request-ATTACKjson

Generates a JSON file to be imported into the ATT&CK Navigator. The mitre_data_assessment.xlsx file contains all Techniques, which can be updated via Invoke-ATTACK-UpdateExcel.

Each technique contains DataSources, which are individually scored by me with a weight. The DataSourceEventTypes need to be scored per environment.

This script multiplies the respective DataSource scores and adds them to a total technique score. The generation date is added to the description.

EXAMPLE

PS C:\> Request-ATTACKjson -Excelfile .\mitre_data_assessment.xlsx -Template .\template.json -Output 2019-03-23-ATTACKcoverage.json

This is all gathered into a JSON file which can be opened here; MITRE ATT&CK Navigator/enterprise/

Invoke-ATTACKUpdateExcel

This generates all MITRE ATT&CK relevant fields into a table and creates or updates the REF-DataSources worksheet in an Excel sheet

EXAMPLE

PS C:\> Invoke-ATTACKUpdateExcel -AttackPath .\enterprise-attack.json -Excelfile .\mitre_data_assessment.xlsx

The -AttackPath and -Excelfile parameters are optional

Get-ATTACKdata

This downloads the MITRE ATT&CK Enterprise JSON file

EXAMPLE

PS C:\> Get-ATTACKdata -AttackPath ./enterprise-attack.json

The -AttackPath parameter is optional

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].