Skip to content

[FR] Update ATT&CK Package to v12.1#2422

Merged
terrancedejesus merged 6 commits intomainfrom
update_attck_12.1
Dec 16, 2022
Merged

[FR] Update ATT&CK Package to v12.1#2422
terrancedejesus merged 6 commits intomainfrom
update_attck_12.1

Conversation

@terrancedejesus
Copy link
Copy Markdown
Contributor

@terrancedejesus terrancedejesus commented Dec 12, 2022 •
edited
Loading

Summary

Latest release of ATT&CK is v12.1, whereas our current package is v11.3.
Reference: https://github.com/mitre/cti/tags

This PR also makes adjustments to code relied on by the CLI commands in the attack click group of devtools.py.

  • Checks for technique name changes in addition to technique IDs
  • Removes @multi_collection decorator from update-rules command (Logic updates all rules, no need to specify rule specifics)

Testing

python -m detection_rules dev attack refresh-data
python -m detection_rules dev attack refresh-redirect-mappings
python -m detection_rules dev attack update-rules
  • refresh-data - Should pull v12.1 package and remove 11.3 (already done)
  • refresh-redirect-mappings - Should update custom technique changes mapping file
  • update-rules iterates all rules and checks for technique ID or name changes, adjusts and overwrites path to existing rule

Output from update-rules (should be able to replicate by checking out commit - 9cf62d6 and running command):

❯ python -m detection_rules dev attack update-rules 
Loaded config file: /Users/tdejesus/code/src/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

'WebServer Access Logs Deleted' requires update - technique name change
'Tampering of Bash Command-Line History' requires update - technique name change
'Timestomping using Touch Command' requires update - technique name change
'AWS CloudTrail Log Created' requires update - technique name change
'AWS S3 Bucket Configuration Deletion' requires update - technique name change
'AWS CloudTrail Log Updated' requires update - technique name change
'Azure Event Hub Authorization Rule Created or Updated' requires update - technique name change
'GCP Pub/Sub Subscription Creation' requires update - technique name change
'GCP Pub/Sub Topic Creation' requires update - technique name change
'File Deletion via Shred' requires update - technique name change
'System Log File Deletion' requires update - technique name change
'Clearing Windows Console History' requires update - technique name change
'Clearing Windows Event Logs' requires update - technique name change
'Windows Event Logs Cleared' requires update - technique name change
'Delete Volume USN Journal with Fsutil' requires update - technique name change
'Disable Windows Event and Security Logs Using Built-in Tools' requires update - technique name change
'Temporarily Scheduled Task Creation' requires update - technique name change
'Process Termination followed by Deletion' requires update - technique name change
'Potential Secure File Deletion via SDelete Utility' requires update - technique name change
Finished - 19 rules updated!

@terrancedejesus terrancedejesus added enhancement New feature or request python Internal python for the repository labels Dec 12, 2022
@terrancedejesus terrancedejesus self-assigned this Dec 12, 2022
@botelastic botelastic bot added Domain: Endpoint OS: Windows windows related rules labels Dec 12, 2022
terrancedejesus
terrancedejesus commented Dec 12, 2022
View reviewed changes
detection_rules/devtools.py


@attack_group.command('update-rules')
@multi_collection
Copy link
Copy Markdown
Contributor Author

@terrancedejesus terrancedejesus Dec 12, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We load and loop over all rules and check for necessary updates, starting at L1236 so this is not necessary.

Copy link
Copy Markdown
Contributor

@Mikaayenson Mikaayenson Dec 15, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see you added the ability to get the rule collection, but I think the purpose of the decorator was to get a RuleCollection by file, directory or a list of IDs. Whereas the logic now just gets all the rules within our collection. I agree with this decision, but just wanted to be clear that the multi_collection did serve a difference purpose/feature.

terrancedejesus
terrancedejesus commented Dec 12, 2022
View reviewed changes
detection_rules/devtools.py
new_data = dataclasses.replace(rule.contents.data, threat=valid_threat)
new_contents = dataclasses.replace(rule.contents, data=new_data, metadata=new_meta)
new_rule = TOMLRule(contents=new_contents)
new_rule = TOMLRule(contents=new_contents, path=rule.path)
Copy link
Copy Markdown
Contributor Author

@terrancedejesus terrancedejesus Dec 12, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If path is not given the variable will be blank in the new TOMLRule object so we must pass the path of the original rule to overwrite.

Copy link
Copy Markdown
Contributor

@Mikaayenson Mikaayenson Dec 15, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TBD, im not sure how this worked prior to this addition. I too saw it error during testing without the path specified.

Mikaayenson
Mikaayenson approved these changes Dec 15, 2022
View reviewed changes
Copy link
Copy Markdown
Contributor

@Mikaayenson Mikaayenson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great work 🎊

I checked out 9cf62d69 and ran the command python -m detection_rules dev attack update-rules and the rules updated as expected.

output 
(detection_dev) ➜  detection-rules git:(9cf62d69) ✗ python -m detection_rules dev attack update-rules
Loaded config file: /Users/stryker/workspace/Elastic/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

'WebServer Access Logs Deleted' requires update - technique name change
'Tampering of Bash Command-Line History' requires update - technique name change
'Timestomping using Touch Command' requires update - technique name change
'AWS CloudTrail Log Created' requires update - technique name change
'AWS S3 Bucket Configuration Deletion' requires update - technique name change
'AWS CloudTrail Log Updated' requires update - technique name change
'Azure Event Hub Authorization Rule Created or Updated' requires update - technique name change
'GCP Pub/Sub Subscription Creation' requires update - technique name change
'GCP Pub/Sub Topic Creation' requires update - technique name change
'File Deletion via Shred' requires update - technique name change
'System Log File Deletion' requires update - technique name change
'Clearing Windows Console History' requires update - technique name change
'Clearing Windows Event Logs' requires update - technique name change
'Windows Event Logs Cleared' requires update - technique name change
'Delete Volume USN Journal with Fsutil' requires update - technique name change
'Disable Windows Event and Security Logs Using Built-in Tools' requires update - technique name change
'Process Termination followed by Deletion' requires update - technique name change
'Potential Secure File Deletion via SDelete Utility' requires update - technique name change

Finished - 18 rules updated!
  • I agree with the decision to default the rules collection instead of the multi_collection given the utility of these attack commands. 👍
  • A couple nits/questions, not worth blocking.

rules/windows/defense_evasion_disabling_windows_logs.toml
Comment on lines +67 to +75
tags = [
"Elastic",
"Host",
"Windows",
"Threat Detection",
"Defense Evasion",
"Investigation Guide",
"Elastic Endgame",
]
Copy link
Copy Markdown
Contributor

@Mikaayenson Mikaayenson Dec 15, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: I wish the toml_save didn't update other things like tags and references. 🤷

detection_rules/devtools.py


@attack_group.command('update-rules')
@multi_collection
Copy link
Copy Markdown
Contributor

@Mikaayenson Mikaayenson Dec 15, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see you added the ability to get the rule collection, but I think the purpose of the decorator was to get a RuleCollection by file, directory or a list of IDs. Whereas the logic now just gets all the rules within our collection. I agree with this decision, but just wanted to be clear that the multi_collection did serve a difference purpose/feature.

@terrancedejesus @Mikaayenson
Update detection_rules/devtools.py
d32febd 
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
@eric-forte-elastic
Copy link
Copy Markdown
Contributor

eric-forte-elastic commented Dec 16, 2022 •
edited
Loading

Just as a note, the output for me on the commit test only has 18 rule updates vs the 19 rule updates shown. However, I do not think this is an issue with the code as the missing rule from the output, Temporarily Scheduled Task Creation , is missing from the commit. The logic is working correctly for the test, the rule just is not there in that commit. However, it is present in the current branch/PR with proper updates, so no issue. All looks good ✔️

Output 
> git checkout 9cf62d6998b5fdd3cf4c42b2a425dab209b75084
HEAD is now at 9cf62d69 addressed flake errors
> python -m detection_rules dev attack update-rules

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

'WebServer Access Logs Deleted' requires update - technique name change
'Tampering of Bash Command-Line History' requires update - technique name change
'Timestomping using Touch Command' requires update - technique name change
'AWS CloudTrail Log Created' requires update - technique name change
'AWS S3 Bucket Configuration Deletion' requires update - technique name change
'AWS CloudTrail Log Updated' requires update - technique name change
'Azure Event Hub Authorization Rule Created or Updated' requires update - technique name change
'GCP Pub/Sub Subscription Creation' requires update - technique name change
'GCP Pub/Sub Topic Creation' requires update - technique name change
'File Deletion via Shred' requires update - technique name change
'System Log File Deletion' requires update - technique name change
'Clearing Windows Console History' requires update - technique name change
'Clearing Windows Event Logs' requires update - technique name change
'Windows Event Logs Cleared' requires update - technique name change
'Delete Volume USN Journal with Fsutil' requires update - technique name change
'Disable Windows Event and Security Logs Using Built-in Tools' requires update - technique name change
'Process Termination followed by Deletion' requires update - technique name change
'Potential Secure File Deletion via SDelete Utility' requires update - technique name change

Finished - 18 rules updated!

Other checks:
✔️ Unit tests passed

Output 
./env/detection-rules-build/bin/python -m detection_rules test

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

=================================== test session starts ===================================
platform linux -- Python 3.8.10, pytest-7.2.0, pluggy-1.0.0 -- /tmp/detection-rules/env/detection-rules-build/bin/python
cachedir: .pytest_cache
rootdir: /tmp/detection-rules
plugins: typeguard-2.13.3
collected 117 items                                                                       

tests/test_all_rules.py::TestValidRules::test_all_rule_queries_optimized PASSED     [  0%]
tests/test_all_rules.py::TestValidRules::test_duplicate_file_names PASSED           [  1%]
tests/test_all_rules.py::TestValidRules::test_file_names PASSED                     [  2%]
tests/test_all_rules.py::TestValidRules::test_production_rules_have_rta PASSED      [  3%]
tests/test_all_rules.py::TestValidRules::test_rule_type_changes PASSED              [  4%]
tests/test_all_rules.py::TestValidRules::test_schema_and_dupes PASSED               [  5%]
tests/test_all_rules.py::TestThreatMappings::test_duplicated_tactics PASSED         [  5%]
tests/test_all_rules.py::TestThreatMappings::test_tactic_to_technique_correlations PASSED [  6%]
tests/test_all_rules.py::TestThreatMappings::test_technique_deprecations PASSED     [  7%]
tests/test_all_rules.py::TestRuleTags::test_casing_and_spacing PASSED               [  8%]
tests/test_all_rules.py::TestRuleTags::test_primary_tactic_as_tag PASSED            [  9%]
tests/test_all_rules.py::TestRuleTags::test_required_tags PASSED                    [ 10%]
tests/test_all_rules.py::TestRuleTimelines::test_timeline_has_title PASSED          [ 11%]
tests/test_all_rules.py::TestRuleFiles::test_rule_file_name_tactic PASSED           [ 11%]
tests/test_all_rules.py::TestRuleMetadata::test_all_min_stack_rules_have_comment PASSED [ 12%]
tests/test_all_rules.py::TestRuleMetadata::test_deprecated_rules PASSED             [ 13%]
tests/test_all_rules.py::TestRuleMetadata::test_integration PASSED                  [ 14%]
tests/test_all_rules.py::TestRuleMetadata::test_rule_demotions PASSED               [ 15%]
tests/test_all_rules.py::TestRuleMetadata::test_updated_date_newer_than_creation PASSED [ 16%]
tests/test_all_rules.py::TestRuleTiming::test_eql_interval_to_maxspan PASSED        [ 17%]
tests/test_all_rules.py::TestRuleTiming::test_eql_lookback PASSED                   [ 17%]
tests/test_all_rules.py::TestRuleTiming::test_event_override PASSED                 [ 18%]
tests/test_all_rules.py::TestRuleTiming::test_required_lookback PASSED              [ 19%]
tests/test_all_rules.py::TestLicense::test_elastic_license_only_v2 PASSED           [ 20%]
tests/test_all_rules.py::TestIntegrationRules::test_integration_guide PASSED        [ 21%]
tests/test_all_rules.py::TestIncompatibleFields::test_rule_backports_for_restricted_fields PASSED [ 22%]
tests/test_all_rules.py::TestBuildTimeFields::test_build_fields_min_stack PASSED    [ 23%]
tests/test_all_rules.py::TestRiskScoreMismatch::test_rule_risk_score_severity_mismatch PASSED [ 23%]
tests/test_all_rules.py::TestOsqueryPluginNote::test_note_guide PASSED              [ 24%]
tests/test_gh_workflows.py::TestWorkflows::test_matrix_to_lock_version_defaults PASSED [ 25%]
tests/test_mappings.py::TestMappings::test_false_positives PASSED                   [ 26%]
tests/test_mappings.py::TestMappings::test_true_positives PASSED                    [ 27%]
tests/test_mappings.py::TestRTAs::test_rtas_with_triggered_rules_have_uuid PASSED   [ 28%]
tests/test_packages.py::TestPackages::test_package_loader_default_configs PASSED    [ 29%]
tests/test_packages.py::TestPackages::test_package_loader_production_config PASSED  [ 29%]
tests/test_packages.py::TestPackages::test_package_summary PASSED                   [ 30%]
tests/test_packages.py::TestPackages::test_rule_versioning PASSED                   [ 31%]
tests/test_packages.py::TestRegistryPackage::test_registry_package_config PASSED    [ 32%]
tests/test_schemas.py::TestSchemas::test_eql_validation PASSED                      [ 33%]
tests/test_schemas.py::TestSchemas::test_query_downgrade_7_x PASSED                 [ 34%]
tests/test_schemas.py::TestSchemas::test_query_downgrade_8_x PASSED                 [ 35%]
tests/test_schemas.py::TestSchemas::test_threshold_downgrade_7_x PASSED             [ 35%]
tests/test_schemas.py::TestSchemas::test_threshold_downgrade_8_x PASSED             [ 36%]
tests/test_schemas.py::TestSchemas::test_versioned_downgrade_7_x PASSED             [ 37%]
tests/test_schemas.py::TestSchemas::test_versioned_downgrade_8_x PASSED             [ 38%]
tests/test_schemas.py::TestVersionLockSchema::test_version_lock_has_nested_previous PASSED [ 39%]
tests/test_schemas.py::TestVersionLockSchema::test_version_lock_no_previous PASSED  [ 40%]
tests/test_schemas.py::TestVersions::test_stack_schema_map PASSED                   [ 41%]
tests/test_toml_formatter.py::TestRuleTomlFormatter::test_formatter_deep PASSED     [ 41%]
tests/test_toml_formatter.py::TestRuleTomlFormatter::test_formatter_rule PASSED     [ 42%]
tests/test_toml_formatter.py::TestRuleTomlFormatter::test_normalization PASSED      [ 43%]
tests/test_utils.py::TestTimeUtils::test_caching PASSED                             [ 44%]
tests/test_utils.py::TestTimeUtils::test_event_class_normalization PASSED           [ 45%]
tests/test_utils.py::TestTimeUtils::test_schema_multifields PASSED                  [ 46%]
tests/test_utils.py::TestTimeUtils::test_time_normalize PASSED                      [ 47%]
tests/test_version_locking.py::TestVersionLock::test_previous_entries_gte_current_min_stack PASSED [ 47%]
tests/kuery/test_dsl.py::TestKQLtoDSL::test_and_query PASSED                        [ 48%]
tests/kuery/test_dsl.py::TestKQLtoDSL::test_field_exists PASSED                     [ 49%]
tests/kuery/test_dsl.py::TestKQLtoDSL::test_field_inequality PASSED                 [ 50%]
tests/kuery/test_dsl.py::TestKQLtoDSL::test_field_match PASSED                      [ 51%]
tests/kuery/test_dsl.py::TestKQLtoDSL::test_not_query PASSED                        [ 52%]
tests/kuery/test_dsl.py::TestKQLtoDSL::test_optimizations PASSED                    [ 52%]
tests/kuery/test_dsl.py::TestKQLtoDSL::test_or_query PASSED                         [ 53%]
tests/kuery/test_eql2kql.py::TestEql2Kql::test_and_query PASSED                     [ 54%]
tests/kuery/test_eql2kql.py::TestEql2Kql::test_boolean_precedence PASSED            [ 55%]
tests/kuery/test_eql2kql.py::TestEql2Kql::test_field_equals PASSED                  [ 56%]
tests/kuery/test_eql2kql.py::TestEql2Kql::test_field_inequality PASSED              [ 57%]
tests/kuery/test_eql2kql.py::TestEql2Kql::test_ip_checks PASSED                     [ 58%]
tests/kuery/test_eql2kql.py::TestEql2Kql::test_list_of_values PASSED                [ 58%]
tests/kuery/test_eql2kql.py::TestEql2Kql::test_not_query PASSED                     [ 59%]
tests/kuery/test_eql2kql.py::TestEql2Kql::test_or_query PASSED                      [ 60%]
tests/kuery/test_eql2kql.py::TestEql2Kql::test_wildcard_field PASSED                [ 61%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_and_expr PASSED                 [ 62%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_and_values PASSED               [ 63%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_cidr_match PASSED               [ 64%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_field_exists PASSED             [ 64%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_flattening PASSED               [ 65%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_list_value PASSED               [ 66%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_not_value PASSED                [ 67%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_or_expr PASSED                  [ 68%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_or_values PASSED                [ 69%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_quoted_wildcard PASSED          [ 70%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_range PASSED                    [ 70%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_single_value PASSED             [ 71%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_wildcard PASSED                 [ 72%]
tests/kuery/test_kql2eql.py::TestKql2Eql::test_and_query PASSED                     [ 73%]
tests/kuery/test_kql2eql.py::TestKql2Eql::test_boolean_precedence PASSED            [ 74%]
tests/kuery/test_kql2eql.py::TestKql2Eql::test_field_equals PASSED                  [ 75%]
tests/kuery/test_kql2eql.py::TestKql2Eql::test_field_inequality PASSED              [ 76%]
tests/kuery/test_kql2eql.py::TestKql2Eql::test_list_of_values PASSED                [ 76%]
tests/kuery/test_kql2eql.py::TestKql2Eql::test_lone_value PASSED                    [ 77%]
tests/kuery/test_kql2eql.py::TestKql2Eql::test_nested_query PASSED                  [ 78%]
tests/kuery/test_kql2eql.py::TestKql2Eql::test_not_query PASSED                     [ 79%]
tests/kuery/test_kql2eql.py::TestKql2Eql::test_or_query PASSED                      [ 80%]
tests/kuery/test_kql2eql.py::TestKql2Eql::test_schema PASSED                        [ 81%]
tests/kuery/test_lint.py::LintTests::test_and_not PASSED                            [ 82%]
tests/kuery/test_lint.py::LintTests::test_compound PASSED                           [ 82%]
tests/kuery/test_lint.py::LintTests::test_double_negate PASSED                      [ 83%]
tests/kuery/test_lint.py::LintTests::test_extract_not PASSED                        [ 84%]
tests/kuery/test_lint.py::LintTests::test_ip PASSED                                 [ 85%]
tests/kuery/test_lint.py::LintTests::test_lint_field PASSED                         [ 86%]
tests/kuery/test_lint.py::LintTests::test_lint_precedence PASSED                    [ 87%]
tests/kuery/test_lint.py::LintTests::test_merge_fields PASSED                       [ 88%]
tests/kuery/test_lint.py::LintTests::test_mixed_demorgans PASSED                    [ 88%]
tests/kuery/test_lint.py::LintTests::test_not_demorgans PASSED                      [ 89%]
tests/kuery/test_lint.py::LintTests::test_not_or PASSED                             [ 90%]
tests/kuery/test_lint.py::LintTests::test_upper_tokens PASSED                       [ 91%]
tests/kuery/test_parser.py::ParserTests::test_conversion PASSED                     [ 92%]
tests/kuery/test_parser.py::ParserTests::test_date PASSED                           [ 93%]
tests/kuery/test_parser.py::ParserTests::test_keyword PASSED                        [ 94%]
tests/kuery/test_parser.py::ParserTests::test_list_equals PASSED                    [ 94%]
tests/kuery/test_parser.py::ParserTests::test_multiple_types_fail PASSED            [ 95%]
tests/kuery/test_parser.py::ParserTests::test_multiple_types_success PASSED         [ 96%]
tests/kuery/test_parser.py::ParserTests::test_number_exists PASSED                  [ 97%]
tests/kuery/test_parser.py::ParserTests::test_number_wildcard_fail PASSED           [ 98%]
tests/kuery/test_parser.py::ParserTests::test_type_family_fail PASSED               [ 99%]
tests/kuery/test_parser.py::ParserTests::test_type_family_success PASSED            [100%]

==================================== warnings summary =====================================
env/detection-rules-build/lib/python3.8/site-packages/_pytest/config/__init__.py:1171
  /tmp/detection-rules/env/detection-rules-build/lib/python3.8/site-packages/_pytest/config/__init__.py:1171: PytestAssertRewriteWarning: Module already imported so cannot be rewritten: typeguard
    self._mark_plugins_for_rewrite(hook)

tests/test_all_rules.py: 199 warnings
  /tmp/detection-rules/tests/test_all_rules.py:689: DeprecationWarning: Please use assertTrue instead.
    self.assert_(rule.contents.data.note, f'{self.rule_str(rule)} note required for config information')

-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
=========================== 117 passed, 200 warnings in 14.29s ============================

@terrancedejesus terrancedejesus merged commit ae4e59e into main Dec 16, 2022
@terrancedejesus terrancedejesus deleted the update_attck_12.1 branch December 16, 2022 17:04
protectionsmachine pushed a commit that referenced this pull request Dec 16, 2022
@terrancedejesus @github-actions
[FR] Update ATT&CK Package to v12.1 (#2422)
c1f9be0 
* initial update to v12.1 attack package

* added additional click echo output

* addressed flake errors

* updated rules with refreshed att&ck data

* Update detection_rules/devtools.py

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

Removed changes from:
- rules/cross-platform/defense_evasion_deleting_websvr_access_logs.toml
- rules/cross-platform/defense_evasion_deletion_of_bash_command_line_history.toml
- rules/cross-platform/defense_evasion_timestomp_touch.toml
- rules/integrations/aws/collection_cloudtrail_logging_created.toml
- rules/integrations/aws/defense_evasion_s3_bucket_configuration_deletion.toml
- rules/integrations/aws/impact_cloudtrail_logging_updated.toml
- rules/integrations/azure/collection_update_event_hub_auth_rule.toml
- rules/integrations/gcp/collection_gcp_pub_sub_subscription_creation.toml
- rules/integrations/gcp/collection_gcp_pub_sub_topic_creation.toml
- rules/linux/defense_evasion_file_deletion_via_shred.toml
- rules/linux/defense_evasion_log_files_deleted.toml
- rules/windows/defense_evasion_clearing_windows_console_history.toml
- rules/windows/defense_evasion_clearing_windows_event_logs.toml
- rules/windows/defense_evasion_clearing_windows_security_logs.toml
- rules/windows/defense_evasion_delete_volume_usn_journal_with_fsutil.toml
- rules/windows/defense_evasion_disabling_windows_logs.toml
- rules/windows/defense_evasion_persistence_temp_scheduled_task.toml
- rules/windows/defense_evasion_process_termination_followed_by_deletion.toml
- rules/windows/defense_evasion_sdelete_like_filename_rename.toml

(selectively cherry picked from commit ae4e59e)
protectionsmachine pushed a commit that referenced this pull request Dec 16, 2022
@terrancedejesus @github-actions
[FR] Update ATT&CK Package to v12.1 (#2422)
152dcb6 
* initial update to v12.1 attack package

* added additional click echo output

* addressed flake errors

* updated rules with refreshed att&ck data

* Update detection_rules/devtools.py

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

Removed changes from:
- rules/cross-platform/defense_evasion_deleting_websvr_access_logs.toml
- rules/cross-platform/defense_evasion_deletion_of_bash_command_line_history.toml
- rules/cross-platform/defense_evasion_timestomp_touch.toml
- rules/integrations/aws/collection_cloudtrail_logging_created.toml
- rules/integrations/aws/defense_evasion_s3_bucket_configuration_deletion.toml
- rules/integrations/aws/impact_cloudtrail_logging_updated.toml
- rules/integrations/azure/collection_update_event_hub_auth_rule.toml
- rules/integrations/gcp/collection_gcp_pub_sub_subscription_creation.toml
- rules/integrations/gcp/collection_gcp_pub_sub_topic_creation.toml
- rules/linux/defense_evasion_file_deletion_via_shred.toml
- rules/linux/defense_evasion_log_files_deleted.toml
- rules/windows/defense_evasion_clearing_windows_console_history.toml
- rules/windows/defense_evasion_clearing_windows_event_logs.toml
- rules/windows/defense_evasion_clearing_windows_security_logs.toml
- rules/windows/defense_evasion_delete_volume_usn_journal_with_fsutil.toml
- rules/windows/defense_evasion_disabling_windows_logs.toml
- rules/windows/defense_evasion_persistence_temp_scheduled_task.toml
- rules/windows/defense_evasion_process_termination_followed_by_deletion.toml
- rules/windows/defense_evasion_sdelete_like_filename_rename.toml

(selectively cherry picked from commit ae4e59e)
protectionsmachine pushed a commit that referenced this pull request Dec 16, 2022
@terrancedejesus @github-actions
[FR] Update ATT&CK Package to v12.1 (#2422)
2b280d8 
* initial update to v12.1 attack package

* added additional click echo output

* addressed flake errors

* updated rules with refreshed att&ck data

* Update detection_rules/devtools.py

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

Removed changes from:
- rules/cross-platform/defense_evasion_deleting_websvr_access_logs.toml
- rules/cross-platform/defense_evasion_deletion_of_bash_command_line_history.toml
- rules/cross-platform/defense_evasion_timestomp_touch.toml
- rules/integrations/aws/collection_cloudtrail_logging_created.toml
- rules/integrations/aws/defense_evasion_s3_bucket_configuration_deletion.toml
- rules/integrations/aws/impact_cloudtrail_logging_updated.toml
- rules/integrations/azure/collection_update_event_hub_auth_rule.toml
- rules/integrations/gcp/collection_gcp_pub_sub_subscription_creation.toml
- rules/integrations/gcp/collection_gcp_pub_sub_topic_creation.toml
- rules/linux/defense_evasion_file_deletion_via_shred.toml
- rules/linux/defense_evasion_log_files_deleted.toml
- rules/windows/defense_evasion_clearing_windows_console_history.toml
- rules/windows/defense_evasion_clearing_windows_event_logs.toml
- rules/windows/defense_evasion_clearing_windows_security_logs.toml
- rules/windows/defense_evasion_delete_volume_usn_journal_with_fsutil.toml
- rules/windows/defense_evasion_disabling_windows_logs.toml
- rules/windows/defense_evasion_persistence_temp_scheduled_task.toml
- rules/windows/defense_evasion_process_termination_followed_by_deletion.toml
- rules/windows/defense_evasion_sdelete_like_filename_rename.toml

(selectively cherry picked from commit ae4e59e)
protectionsmachine pushed a commit that referenced this pull request Dec 16, 2022
@terrancedejesus @github-actions
[FR] Update ATT&CK Package to v12.1 (#2422)
5a5391d 
* initial update to v12.1 attack package

* added additional click echo output

* addressed flake errors

* updated rules with refreshed att&ck data

* Update detection_rules/devtools.py

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

Removed changes from:
- rules/cross-platform/defense_evasion_deleting_websvr_access_logs.toml
- rules/cross-platform/defense_evasion_deletion_of_bash_command_line_history.toml
- rules/cross-platform/defense_evasion_timestomp_touch.toml
- rules/integrations/aws/collection_cloudtrail_logging_created.toml
- rules/integrations/aws/defense_evasion_s3_bucket_configuration_deletion.toml
- rules/integrations/aws/impact_cloudtrail_logging_updated.toml
- rules/integrations/azure/collection_update_event_hub_auth_rule.toml
- rules/integrations/gcp/collection_gcp_pub_sub_subscription_creation.toml
- rules/integrations/gcp/collection_gcp_pub_sub_topic_creation.toml
- rules/linux/defense_evasion_file_deletion_via_shred.toml
- rules/linux/defense_evasion_log_files_deleted.toml
- rules/windows/defense_evasion_clearing_windows_console_history.toml
- rules/windows/defense_evasion_clearing_windows_event_logs.toml
- rules/windows/defense_evasion_clearing_windows_security_logs.toml
- rules/windows/defense_evasion_delete_volume_usn_journal_with_fsutil.toml
- rules/windows/defense_evasion_disabling_windows_logs.toml
- rules/windows/defense_evasion_persistence_temp_scheduled_task.toml
- rules/windows/defense_evasion_process_termination_followed_by_deletion.toml
- rules/windows/defense_evasion_sdelete_like_filename_rename.toml

(selectively cherry picked from commit ae4e59e)
protectionsmachine pushed a commit that referenced this pull request Dec 16, 2022
@terrancedejesus @github-actions
[FR] Update ATT&CK Package to v12.1 (#2422)
8fa20ba 
* initial update to v12.1 attack package

* added additional click echo output

* addressed flake errors

* updated rules with refreshed att&ck data

* Update detection_rules/devtools.py

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

(cherry picked from commit ae4e59e)
protectionsmachine pushed a commit that referenced this pull request Dec 16, 2022
@terrancedejesus @github-actions
[FR] Update ATT&CK Package to v12.1 (#2422)
f6a29ae 
* initial update to v12.1 attack package

* added additional click echo output

* addressed flake errors

* updated rules with refreshed att&ck data

* Update detection_rules/devtools.py

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

(cherry picked from commit ae4e59e)
protectionsmachine pushed a commit that referenced this pull request Dec 16, 2022
@terrancedejesus @github-actions
[FR] Update ATT&CK Package to v12.1 (#2422)
f88a210 
* initial update to v12.1 attack package

* added additional click echo output

* addressed flake errors

* updated rules with refreshed att&ck data

* Update detection_rules/devtools.py

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

(cherry picked from commit ae4e59e)
protectionsmachine pushed a commit that referenced this pull request Dec 16, 2022
@terrancedejesus @github-actions
[FR] Update ATT&CK Package to v12.1 (#2422)
795a18c 
* initial update to v12.1 attack package

* added additional click echo output

* addressed flake errors

* updated rules with refreshed att&ck data

* Update detection_rules/devtools.py

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

(cherry picked from commit ae4e59e)
terrancedejesus added a commit that referenced this pull request Dec 16, 2022
@terrancedejesus
updated ATT&CK references from failed backport - #2422
f9a37f6
terrancedejesus added a commit that referenced this pull request Dec 16, 2022
@terrancedejesus
updated ATT&CK references from failed backport - #2422
8c88d07
terrancedejesus added a commit that referenced this pull request Dec 16, 2022
@terrancedejesus
updated ATT&CK references from failed backport - #2422
f153219
terrancedejesus added a commit that referenced this pull request Dec 16, 2022
@terrancedejesus
updated ATT&CK references from failed backport - #2422
f00cfdf
@terrancedejesus terrancedejesus mentioned this pull request Jan 9, 2023
Merged
@spong spong mentioned this pull request Feb 22, 2023
Merged
1 task
spong added a commit to elastic/kibana that referenced this pull request Feb 23, 2023
@spong
[Security Solution][Detections] Updates MITRE ATT&CK mappings to v12.1 (
bbfa43a 
#151931)

## Summary

Updates MITRE ATT&CK mappings to `v12.1`, see `detection-rules` repo
update here: elastic/detection-rules#2422. Last
update was to `v11.3` in #137122.

To update,  I modified 


https://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22
to point to the `ATT&CK-v12.1` tag.

Then ran `yarn extract-mitre-attacks` from the root `security_solution`
plugin directory, and then `node scripts/i18n_check.js --fix` from
Kibana root to regen the i18n files.

### Checklist

- [X] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Feb 23, 2023
@spong
[Security Solution][Detections] Updates MITRE ATT&CK mappings to v12.1 (
6a10c40 
elastic#151931)

## Summary

Updates MITRE ATT&CK mappings to `v12.1`, see `detection-rules` repo
update here: elastic/detection-rules#2422. Last
update was to `v11.3` in elastic#137122.

To update,  I modified

https://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22
to point to the `ATT&CK-v12.1` tag.

Then ran `yarn extract-mitre-attacks` from the root `security_solution`
plugin directory, and then `node scripts/i18n_check.js --fix` from
Kibana root to regen the i18n files.

### Checklist

- [X] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)

(cherry picked from commit bbfa43a)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Feb 23, 2023
@spong
[Security Solution][Detections] Updates MITRE ATT&CK mappings to v12.1 (
7623898 
elastic#151931)

## Summary

Updates MITRE ATT&CK mappings to `v12.1`, see `detection-rules` repo
update here: elastic/detection-rules#2422. Last
update was to `v11.3` in elastic#137122.

To update,  I modified

https://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22
to point to the `ATT&CK-v12.1` tag.

Then ran `yarn extract-mitre-attacks` from the root `security_solution`
plugin directory, and then `node scripts/i18n_check.js --fix` from
Kibana root to regen the i18n files.

### Checklist

- [X] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)

(cherry picked from commit bbfa43a)
kibanamachine added a commit to elastic/kibana that referenced this pull request Feb 23, 2023
@kibanamachine @spong
[8.6] [Security Solution][Detections] Updates MITRE ATT&CK mappings t…
27c9742 
…o v12.1 (#151931) (#152006)

# Backport

This will backport the following commits from `main` to `8.6`:
- [[Security Solution][Detections] Updates MITRE ATT&CK mappings to
v12.1 (#151931)](#151931)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Garrett
Spong","email":"spong@users.noreply.github.com"},"sourceCommit":{"committedDate":"2023-02-23T15:26:00Z","message":"[Security
Solution][Detections] Updates MITRE ATT&CK mappings to v12.1
(#151931)\n\n## Summary\r\n\r\nUpdates MITRE ATT&CK mappings to `v12.1`,
see `detection-rules` repo\r\nupdate here:
elastic/detection-rules#2422. Last\r\nupdate was
to `v11.3` in https://github.com/elastic/kibana/pull/137122.\r\n\r\nTo
update, I modified
\r\n\r\n\r\nhttps://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\r\nto
point to the `ATT&CK-v12.1` tag.\r\n\r\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\r\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\r\nKibana
root to regen the i18n files.\r\n\r\n### Checklist\r\n\r\n- [X] Any text
added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)","sha":"bbfa43ae58f9d2d94a124b932a26cdd6e8167aba","branchLabelMapping":{"^v8.8.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:enhancement","Feature:Detection
Rules","Team:Detections and Resp","Team:
SecuritySolution","Team:Detection
Rules","v8.6.0","v8.7.0","v8.8.0"],"number":151931,"url":"https://github.com/elastic/kibana/pull/151931","mergeCommit":{"message":"[Security
Solution][Detections] Updates MITRE ATT&CK mappings to v12.1
(#151931)\n\n## Summary\r\n\r\nUpdates MITRE ATT&CK mappings to `v12.1`,
see `detection-rules` repo\r\nupdate here:
elastic/detection-rules#2422. Last\r\nupdate was
to `v11.3` in https://github.com/elastic/kibana/pull/137122.\r\n\r\nTo
update, I modified
\r\n\r\n\r\nhttps://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\r\nto
point to the `ATT&CK-v12.1` tag.\r\n\r\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\r\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\r\nKibana
root to regen the i18n files.\r\n\r\n### Checklist\r\n\r\n- [X] Any text
added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)","sha":"bbfa43ae58f9d2d94a124b932a26cdd6e8167aba"}},"sourceBranch":"main","suggestedTargetBranches":["8.6","8.7"],"targetPullRequestStates":[{"branch":"8.6","label":"v8.6.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.7","label":"v8.7.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.8.0","labelRegex":"^v8.8.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/151931","number":151931,"mergeCommit":{"message":"[Security
Solution][Detections] Updates MITRE ATT&CK mappings to v12.1
(#151931)\n\n## Summary\r\n\r\nUpdates MITRE ATT&CK mappings to `v12.1`,
see `detection-rules` repo\r\nupdate here:
elastic/detection-rules#2422. Last\r\nupdate was
to `v11.3` in https://github.com/elastic/kibana/pull/137122.\r\n\r\nTo
update, I modified
\r\n\r\n\r\nhttps://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\r\nto
point to the `ATT&CK-v12.1` tag.\r\n\r\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\r\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\r\nKibana
root to regen the i18n files.\r\n\r\n### Checklist\r\n\r\n- [X] Any text
added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)","sha":"bbfa43ae58f9d2d94a124b932a26cdd6e8167aba"}}]}]
BACKPORT-->

Co-authored-by: Garrett Spong <spong@users.noreply.github.com>
kibanamachine added a commit to elastic/kibana that referenced this pull request Feb 23, 2023
@kibanamachine @spong
[8.7] [Security Solution][Detections] Updates MITRE ATT&CK mappings t…
7114fb6 
…o v12.1 (#151931) (#152007)

# Backport

This will backport the following commits from `main` to `8.7`:
- [[Security Solution][Detections] Updates MITRE ATT&CK mappings to
v12.1 (#151931)](#151931)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Garrett
Spong","email":"spong@users.noreply.github.com"},"sourceCommit":{"committedDate":"2023-02-23T15:26:00Z","message":"[Security
Solution][Detections] Updates MITRE ATT&CK mappings to v12.1
(#151931)\n\n## Summary\r\n\r\nUpdates MITRE ATT&CK mappings to `v12.1`,
see `detection-rules` repo\r\nupdate here:
elastic/detection-rules#2422. Last\r\nupdate was
to `v11.3` in https://github.com/elastic/kibana/pull/137122.\r\n\r\nTo
update, I modified
\r\n\r\n\r\nhttps://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\r\nto
point to the `ATT&CK-v12.1` tag.\r\n\r\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\r\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\r\nKibana
root to regen the i18n files.\r\n\r\n### Checklist\r\n\r\n- [X] Any text
added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)","sha":"bbfa43ae58f9d2d94a124b932a26cdd6e8167aba","branchLabelMapping":{"^v8.8.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:enhancement","Feature:Detection
Rules","Team:Detections and Resp","Team:
SecuritySolution","Team:Detection
Rules","v8.6.0","v8.7.0","v8.8.0"],"number":151931,"url":"https://github.com/elastic/kibana/pull/151931","mergeCommit":{"message":"[Security
Solution][Detections] Updates MITRE ATT&CK mappings to v12.1
(#151931)\n\n## Summary\r\n\r\nUpdates MITRE ATT&CK mappings to `v12.1`,
see `detection-rules` repo\r\nupdate here:
elastic/detection-rules#2422. Last\r\nupdate was
to `v11.3` in https://github.com/elastic/kibana/pull/137122.\r\n\r\nTo
update, I modified
\r\n\r\n\r\nhttps://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\r\nto
point to the `ATT&CK-v12.1` tag.\r\n\r\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\r\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\r\nKibana
root to regen the i18n files.\r\n\r\n### Checklist\r\n\r\n- [X] Any text
added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)","sha":"bbfa43ae58f9d2d94a124b932a26cdd6e8167aba"}},"sourceBranch":"main","suggestedTargetBranches":["8.6","8.7"],"targetPullRequestStates":[{"branch":"8.6","label":"v8.6.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.7","label":"v8.7.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.8.0","labelRegex":"^v8.8.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/151931","number":151931,"mergeCommit":{"message":"[Security
Solution][Detections] Updates MITRE ATT&CK mappings to v12.1
(#151931)\n\n## Summary\r\n\r\nUpdates MITRE ATT&CK mappings to `v12.1`,
see `detection-rules` repo\r\nupdate here:
elastic/detection-rules#2422. Last\r\nupdate was
to `v11.3` in https://github.com/elastic/kibana/pull/137122.\r\n\r\nTo
update, I modified
\r\n\r\n\r\nhttps://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\r\nto
point to the `ATT&CK-v12.1` tag.\r\n\r\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\r\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\r\nKibana
root to regen the i18n files.\r\n\r\n### Checklist\r\n\r\n- [X] Any text
added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)","sha":"bbfa43ae58f9d2d94a124b932a26cdd6e8167aba"}}]}]
BACKPORT-->

Co-authored-by: Garrett Spong <spong@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Mikaayenson Mikaayenson Mikaayenson approved these changes

@eric-forte-elastic eric-forte-elastic eric-forte-elastic approved these changes

@brokensound77 brokensound77 Awaiting requested review from brokensound77

@w0rk3r w0rk3r Awaiting requested review from w0rk3r

Assignees

@terrancedejesus terrancedejesus

Labels

backport: auto Domain: Cloud Workloads Domain: Endpoint enhancement New feature or request Integration: AWS AWS related rules Integration: Azure azure related rules Integration: GCP GCP related rules OS: Linux OS: Windows windows related rules python Internal python for the repository

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@terrancedejesus @eric-forte-elastic @Mikaayenson