Skip to main content

Introduction

Revision History​

DateAuthorSummary
28-NOV-2022TSgt. BernadotteInitial draft
12-DEC-2022TSgt. BernadotteUpdated references to required scripts

Purpose​

This aid is tailored specifically for visualizing the effectiveness (or lack-there-of) of Elastic Detection Rules against a targeted threat within the MITRE ATT&CK Navigator. This information can be used to highlight gaps that require additional rule development, as well as to estimate how successful the Elastic Detection Rules would be at detecting specific techniques. The guide is structured around four critical areas:

  • Visualizing technique coverage of Elastic Detection Rules: This visualization allows for a quick assessment of defensive strengths and the identification of areas requiring further attention or development.

  • Visualizing the Techniques of a targeted threat: This is a visual profile of a targeted threat, outlining the related tactics and techniques related.

  • Visualizing detection gaps: This is a visual cross-reference of the techniques used by targeted threats against the existing Elastic Detection Rules, highlighting gaps in the current detection posture.

  • Visualizing detection coverage against a targeted threat: This is a visual overlay of the Elastic Detection Rules over the targeted threat's techniques to visualize how well current rules can detect attacks.

The results from the employment of this aid can used to convey your detection capabilities/shortfalls to mission partners/owners.

End-State​

  • Elastic Detection Rules will be parsed to produce a JSON file that can be loaded into the MITRE ATT&CK Navigator for visualizing:

    • Coverage of what techniques the rules will detect
    • Density of overlapping rules that detect the same techniques
    • Rule names listed per technique they detect

  • A list of adversary technique IDs will be parsed to produce a JSON file that can be loaded into the MITRE ATT&CK Navigator for visualizing:

    • Mapping of adversary techniques
    • Density of duplicate adversary techniques

  • Detection coverage and adversary techniques will be combined and diff'd for visualizing:

    • Elastic Detection Rule coverage gaps vs. adversary techniques
    • Adversary techniques that can be detected by Elastic Detection Rules

Requirements​

  • Access to the MITRE ATT&CK Navigator. This can be achieved by one of three methods:

  • The 262COS-MITRE_ATTACK_Scripts-PACKAGE-001 package (found in \\fileserver\share\share\SCRIPTS\262COS-MITRE_ATTACK_Scripts-PACKAGE-001\)