Skip to content

Commit ae4e59e

Browse files
terrancedejesusMikaayenson
terrancedejesus
and
Mikaayenson
authored
[FR] Update ATT&CK Package to v12.1 (#2422)
* initial update to v12.1 attack package * added additional click echo output * addressed flake errors * updated rules with refreshed att&ck data * Update detection_rules/devtools.py Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com> Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
1 parent 06053fa commit ae4e59e

23 files changed

+135
-91
lines changed

‎detection_rules/devtools.py‎

Lines changed: 26 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
from kibana.connector import Kibana
2929

3030
from . import attack, rule_loader, utils
31-
from .cli_utils import multi_collection, single_collection
31+
from .cli_utils import single_collection
3232
from .docs import IntegrationSecurityDocs
3333
from .endgame import EndgameSchemaManager
3434
from .eswrap import CollectEvents, add_range_to_dsl
@@ -1226,13 +1226,14 @@ def refresh_threat_mappings():
12261226

12271227

12281228
@attack_group.command('update-rules')
1229-
@multi_collection
1230-
def update_attack_in_rules(rules: RuleCollection) -> List[Optional[TOMLRule]]:
1229+
def update_attack_in_rules() -> List[Optional[TOMLRule]]:
12311230
"""Update threat mappings attack data in all rules."""
12321231
new_rules = []
12331232
redirected_techniques = attack.load_techniques_redirect()
12341233
today = time.strftime('%Y/%m/%d')
12351234

1235+
rules = RuleCollection.default()
1236+
12361237
for rule in rules.rules:
12371238
needs_update = False
12381239
valid_threat: List[ThreatMapping] = []
@@ -1241,14 +1242,29 @@ def update_attack_in_rules(rules: RuleCollection) -> List[Optional[TOMLRule]]:
12411242

12421243
for entry in threat:
12431244
tactic = entry.tactic.name
1244-
techniques = []
1245+
technique_ids = []
1246+
technique_names = []
12451247
for technique in entry.technique or []:
1246-
techniques.append(technique.id)
1247-
techniques.extend([st.id for st in technique.subtechnique or []])
1248+
technique_ids.append(technique.id)
1249+
technique_names.append(technique.name)
1250+
technique_ids.extend([st.id for st in technique.subtechnique or []])
1251+
technique_names.extend([st.name for st in technique.subtechnique or []])
1252+
1253+
# check redirected techniques by ID
1254+
# redirected techniques are technique IDs that have changed but represent the same technique
1255+
if any([tid for tid in technique_ids if tid in redirected_techniques]):
1256+
needs_update = True
1257+
threat_pending_update[tactic] = technique_ids
1258+
click.echo(f"'{rule.contents.name}' requires update - technique ID change")
12481259

1249-
if any([t for t in techniques if t in redirected_techniques]):
1260+
# check for name change
1261+
# happens if technique ID is the same but name changes
1262+
expected_technique_names = [attack.technique_lookup[str(tid)]["name"] for tid in technique_ids]
1263+
if any([tname for tname in technique_names if tname not in expected_technique_names]):
12501264
needs_update = True
1251-
threat_pending_update[tactic] = techniques
1265+
threat_pending_update[tactic] = technique_ids
1266+
click.echo(f"'{rule.contents.name}' requires update - technique name change")
1267+
12521268
else:
12531269
valid_threat.append(entry)
12541270

@@ -1265,12 +1281,12 @@ def update_attack_in_rules(rules: RuleCollection) -> List[Optional[TOMLRule]]:
12651281
new_meta = dataclasses.replace(rule.contents.metadata, updated_date=today)
12661282
new_data = dataclasses.replace(rule.contents.data, threat=valid_threat)
12671283
new_contents = dataclasses.replace(rule.contents, data=new_data, metadata=new_meta)
1268-
new_rule = TOMLRule(contents=new_contents)
1284+
new_rule = TOMLRule(contents=new_contents, path=rule.path)
12691285
new_rule.save_toml()
12701286
new_rules.append(new_rule)
12711287

12721288
if new_rules:
1273-
click.echo(f'{len(new_rules)} rules updated')
1289+
click.echo(f'\nFinished - {len(new_rules)} rules updated!')
12741290
else:
12751291
click.echo('No rule changes needed')
12761292
return new_rules

‎detection_rules/etc/attack-technique-redirects.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -132,5 +132,5 @@
132132
"T1536": "T1578.004",
133133
"T1547.011": "T1647"
134134
},
135-
"saved_date": "Tue Oct 4 21:58:48 2022"
135+
"saved_date": "Mon Dec 12 12:29:00 2022"
136136
}

‎detection_rules/etc/attack-v11.3.json.gz‎

-4.81 MB
Binary file not shown.

‎detection_rules/etc/attack-v12.1.json.gz‎

5.19 MB
Binary file not shown.

‎rules/cross-platform/defense_evasion_deleting_websvr_access_logs.toml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ creation_date = "2020/11/03"
33
maturity = "production"
44
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
55
min_stack_version = "8.3.0"
6-
updated_date = "2022/08/24"
6+
updated_date = "2022/12/12"
77

88
[rule]
99
author = ["Elastic"]
@@ -41,7 +41,7 @@ file where event.type == "deletion" and
4141
framework = "MITRE ATT&CK"
4242
[[rule.threat.technique]]
4343
id = "T1070"
44-
name = "Indicator Removal on Host"
44+
name = "Indicator Removal"
4545
reference = "https://attack.mitre.org/techniques/T1070/"
4646

4747

‎rules/cross-platform/defense_evasion_deletion_of_bash_command_line_history.toml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ creation_date = "2020/05/04"
33
maturity = "production"
44
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
55
min_stack_version = "8.3.0"
6-
updated_date = "2022/08/24"
6+
updated_date = "2022/12/12"
77

88
[rule]
99
author = ["Elastic"]
@@ -47,7 +47,7 @@ process where event.type in ("start", "process_started") and
4747
framework = "MITRE ATT&CK"
4848
[[rule.threat.technique]]
4949
id = "T1070"
50-
name = "Indicator Removal on Host"
50+
name = "Indicator Removal"
5151
reference = "https://attack.mitre.org/techniques/T1070/"
5252
[[rule.threat.technique.subtechnique]]
5353
id = "T1070.003"

‎rules/cross-platform/defense_evasion_timestomp_touch.toml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ creation_date = "2020/11/03"
33
maturity = "production"
44
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
55
min_stack_version = "8.3.0"
6-
updated_date = "2022/08/24"
6+
updated_date = "2022/12/12"
77

88
[rule]
99
author = ["Elastic"]
@@ -40,7 +40,7 @@ process where event.type == "start" and
4040
framework = "MITRE ATT&CK"
4141
[[rule.threat.technique]]
4242
id = "T1070"
43-
name = "Indicator Removal on Host"
43+
name = "Indicator Removal"
4444
reference = "https://attack.mitre.org/techniques/T1070/"
4545
[[rule.threat.technique.subtechnique]]
4646
id = "T1070.006"

‎rules/integrations/aws/collection_cloudtrail_logging_created.toml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
11
[metadata]
22
creation_date = "2020/06/10"
3+
integration = "aws"
34
maturity = "production"
45
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
56
min_stack_version = "8.3.0"
6-
updated_date = "2022/08/24"
7-
integration = "aws"
7+
updated_date = "2022/12/12"
88

99
[rule]
1010
author = ["Elastic"]
1111
description = "Identifies the creation of an AWS log trail that specifies the settings for delivery of log data."
1212
false_positives = [
1313
"""
1414
Trail creations may be made by a system or network administrator. Verify whether the user identity, user agent,
15-
and/or hostname should be making changes in your environment. Trail creations by unfamiliar users or hosts should
16-
be investigated. If known behavior is causing false positives, it can be exempted from the rule.
15+
and/or hostname should be making changes in your environment. Trail creations by unfamiliar users or hosts should be
16+
investigated. If known behavior is causing false positives, it can be exempted from the rule.
1717
""",
1818
]
1919
from = "now-60m"
@@ -45,7 +45,7 @@ event.dataset:aws.cloudtrail and event.provider:cloudtrail.amazonaws.com and eve
4545
framework = "MITRE ATT&CK"
4646
[[rule.threat.technique]]
4747
id = "T1530"
48-
name = "Data from Cloud Storage Object"
48+
name = "Data from Cloud Storage"
4949
reference = "https://attack.mitre.org/techniques/T1530/"
5050

5151

‎rules/integrations/aws/defense_evasion_s3_bucket_configuration_deletion.toml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
[metadata]
22
creation_date = "2020/05/27"
3+
integration = "aws"
34
maturity = "production"
45
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
56
min_stack_version = "8.3.0"
6-
updated_date = "2022/08/24"
7-
integration = "aws"
7+
updated_date = "2022/12/12"
88

99
[rule]
1010
author = ["Elastic"]
@@ -51,7 +51,7 @@ event.dataset:aws.cloudtrail and event.provider:s3.amazonaws.com and
5151
framework = "MITRE ATT&CK"
5252
[[rule.threat.technique]]
5353
id = "T1070"
54-
name = "Indicator Removal on Host"
54+
name = "Indicator Removal"
5555
reference = "https://attack.mitre.org/techniques/T1070/"
5656

5757

‎rules/integrations/aws/impact_cloudtrail_logging_updated.toml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
[metadata]
22
creation_date = "2020/06/10"
3+
integration = "aws"
34
maturity = "production"
45
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
56
min_stack_version = "8.3.0"
6-
updated_date = "2022/09/13"
7-
integration = "aws"
7+
updated_date = "2022/12/12"
88

99
[rule]
1010
author = ["Elastic"]
@@ -119,7 +119,7 @@ reference = "https://attack.mitre.org/tactics/TA0040/"
119119
framework = "MITRE ATT&CK"
120120
[[rule.threat.technique]]
121121
id = "T1530"
122-
name = "Data from Cloud Storage Object"
122+
name = "Data from Cloud Storage"
123123
reference = "https://attack.mitre.org/techniques/T1530/"
124124

125125

0 commit comments

Comments
 (0)