“mitre-attack”的搜索结果

Set up MISP to collect, store, and correlate threat intelligence from multiple feeds. Use PyMISP to automate searches and imports of indicators of compromise, such as suspicious IP addresses and file hashes, and export data for security monitoring tools.

中文简介正在准备中。当前显示英语简介。

• Collecting threat indicators from multiple feeds
• Automating MISP imports and searches
• Exporting indicators for security monitoring tools

Create threat detection rules in Sigma, a shared format for security log searches, and convert them for Splunk, Elastic, or Microsoft Sentinel. Validate syntax, test expected matches and false positives, and map coverage to MITRE ATT&CK.

中文简介正在准备中。当前显示英语简介。

• Turning threat reports into detection rules
• Reusing detection logic across SIEM platforms
• Testing rule matches and reducing false positives

Plan and run authorized security exercises that simulate an attacker's actions, from reconnaissance to activities after entry. Map techniques to MITRE ATT&CK, a framework of attack behaviors, and report detection gaps and response performance.

中文简介正在准备中。当前显示英语简介。

• Planning the scope and objectives of a red team exercise
• Designing scenarios based on a specific threat actor
• Measuring detection and response during an exercise

Analyze Windows event logs in Splunk to investigate suspicious logins, privilege changes, persistence, and movement between computers. Build detection searches and organize endpoint activity into timelines, with findings linked to MITRE ATT&CK attack techniques.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious Windows logins
• Building detection searches in Splunk
• Creating incident timelines

Turn cyber threat intelligence reports into a searchable library of attacker behaviors linked to MITRE ATT&CK techniques. Export structured STIX 2.1 data, a threat information exchange format, and create detection rule templates from documented activity.

中文简介正在准备中。当前显示英语简介。

• Cataloging attacker behaviors from threat intelligence reports
• Organizing attack patterns by tactic, technique, and threat actor
• Creating detection rule templates from documented behaviors

Map threat groups and their attack techniques to MITRE ATT&CK, a catalog of adversary behavior. Generate Navigator visualization files, compare groups, and overlay detection coverage to identify gaps that can guide defensive planning.

中文简介正在准备中。当前显示英语简介。

• Profiling the attack techniques used by a specific threat group
• Comparing techniques across multiple threat groups
• Finding detection gaps against a target adversary

Map threat groups’ documented attack techniques in MITRE ATT&CK Navigator. Creates visual layers and heatmaps, compares groups, and highlights techniques missing from existing detection coverage to support security reporting and decisions about detection priorities.

中文简介正在准备中。当前显示英语简介。

• Visualizing a threat group's attack techniques
• Comparing techniques shared by multiple threat groups
• Finding gaps in existing detection coverage

Review Cuckoo or AnyRun behavior reports for signs that malware is avoiding an analysis environment. Identify timing checks, virtual machine detection, and user activity checks, then produce a JSON report with evidence, technique mappings, and an evasion sophistication score.

中文简介正在准备中。当前显示英语简介。

• Investigating malware that stays inactive in a sandbox
• Reviewing behavior reports for analysis evasion
• Developing detections for anti-analysis behavior

Compare evidence from cyber operations to assess which attacker may be responsible. Weigh shared infrastructure, attack methods, malware similarities, timing, and language clues against competing explanations, then report attribution findings with justified confidence levels.

中文简介正在准备中。当前显示英语简介。

• Assessing possible attackers during an incident investigation
• Comparing infrastructure and attack methods across campaigns
• Evaluating conflicting evidence against multiple hypotheses

IOC extraction, threat intelligence correlation, MITRE ATT&CK mapping, hunt hypothesis generation, and detection rule creation

中文简介正在准备中。当前显示原文说明。

MITRE ATT&CK framework reference — tactics, techniques, and tool-to-TTP mappings for pentest documentation and detection rule writing

中文简介正在准备中。当前显示原文说明。

Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a

中文简介正在准备中。当前显示原文说明。

Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization. Use when building an ATT&CK-based coverage heatmap, tagging SIEM alerts with technique IDs, aligning security controls to adversary playbooks, or reporting threat exposure to executives. Activates for requests involving ATT&CK Navigator, Sigma rules, MITRE D3FEND, or coverage gap analysis.

中文简介正在准备中。当前显示原文说明。

Red team engagement planning is the foundational phase that defines scope, objectives, rules of engagement (ROE), threat model selection, and operational timelines before any offensive testing begins.

中文简介正在准备中。当前显示原文说明。

MITRE ATT&CK local dataset reference. Query techniques, groups, software, and mitigations from the local enterprise-attack.json.

中文简介正在准备中。当前显示原文说明。

Use when you need to hunt in the organisation's own Microsoft Sentinel workspace — sweep the logs for IOC hits (IP, domain, hash, URL, account), hunt behavioural TTPs from MITRE ATT&CK techniques, run KQL against live data, or check which tables the workspace actually ingests. Discovers available tables first and only generates KQL for tables that verifiably exist, so hunts adapt to each environment's connectors. Commonly chained by the /*-investigation skills to answer "were we exposed?". Reads $SENTINEL_TENANT_ID, $SENTINEL_CLIENT_ID, $SENTINEL_CLIENT_SECRET, $SENTINEL_WORKSPACE_ID. Read-only.

中文简介正在准备中。当前显示原文说明。

Use when you need to answer "which attacker techniques do our controls actually stop, and how well?", "what controls should I have for this threat?", or "what telemetry should I collect to detect it?" — joining a customer's or your own security control baseline to ATT&CK techniques using a public, versioned evidence base of 9,545 control-to-technique mappings from six sources. Produces four ranked lists (addressed strongly, addressed weakly, real gaps, and techniques no control anywhere addresses). Use for control gap analysis, security programme prioritisation, board reporting on coverage, or the Resistance Strength side of a FAIR risk assessment. Invoke after /threat-actor-profiling or /lookup-liberty91 has produced a technique list.

中文简介正在准备中。当前显示原文说明。

Structures a clear, actionable malware analysis report covering summary, sample identity, capabilities, IOCs, ATT&CK mapping, and detection guidance for both technical and decision-making audiences. Activates for requests to write, structure, or review a malware analysis or reverse-engineering report.

中文简介正在准备中。当前显示原文说明。

Operationalizes a threat intelligence report into hunts: extracting IOCs and TTPs, mapping behaviors to ATT&CK and available telemetry, prioritizing durable behavioral indicators over volatile atomic ones, and producing concrete hunt queries. Activates for requests to hunt from a threat report, operationalize CTI, or turn an intel report into detections.

中文简介正在准备中。当前显示原文说明。

Profiles a threat actor by aggregating observed ATT&CK techniques into a TTP profile and comparing it against known-group technique sets to estimate similarity and candidate attribution. Activates for requests to profile a threat actor, compare observed TTPs to known groups, or estimate attribution from technique overlap.

中文简介正在准备中。当前显示原文说明。

Uses capa to identify malware capabilities from a binary: running rule-based detection over disassembly, mapping matched capabilities to MITRE ATT&CK and MBC, and interpreting results to focus deeper analysis. Activates for requests to run capa, generate a capability report, or map a sample's behaviors to ATT&CK automatically.

中文简介正在准备中。当前显示原文说明。

Frames a structured, testable threat-hunting hypothesis: grounding it in adversary behavior and available telemetry, defining the data sources and detection logic, and setting success criteria and outcomes. Activates for requests to start a threat hunt, write a hunt hypothesis, or plan a hypothesis-driven hunt.

中文简介正在准备中。当前显示原文说明。

Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.

中文简介正在准备中。当前显示原文说明。

Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests targeting service accounts with SPNs for offline password cracking.

中文简介正在准备中。当前显示原文说明。