Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Idea: Update all techniques by mitre/cti repository automatically #2610

Closed
socketz opened this issue Nov 17, 2023 · 4 comments
Closed

Idea: Update all techniques by mitre/cti repository automatically #2610

socketz opened this issue Nov 17, 2023 · 4 comments
Assignees

Comments

@socketz
Copy link
Contributor

socketz commented Nov 17, 2023

Use-cases

Many techniques had been replaced by new techniques in recent MITRE ATT&CK versions. Currently is v14.1 for Enterprise, Mobile and ICS, and PRE matrix is deprecated, and merged to Enterprise, that is bad mapped in current version of ART, e.g T1063 does not exists in v14.1 because is an older PRE technique, and now belongs to Enterprise as T1286.

Proposal

Automatic updates of TTP's by a mapping in yaml or json to test this techniques with old and new ID's when is called by Invoke-Atomic scripts. This mapping could be good integrated with STIX data to reports generated after atomic tests execution.

References

Enterprise: https://github.com/mitre/cti/blob/master/enterprise-attack/enterprise-attack.json

Mobile: https://github.com/mitre/cti/blob/master/mobile-attack/mobile-attack.json

ICS: https://github.com/mitre/cti/blob/master/ics-attack/ics-attack.json

@cyberbuff cyberbuff self-assigned this Nov 25, 2023
Copy link

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

@github-actions github-actions bot added the Stale label Dec 26, 2023
@clr2of8 clr2of8 removed the Stale label Dec 26, 2023
@cyberbuff
Copy link
Collaborator

Hello @socketz Sorry for the delay. We don't have any atomics related to T1063 and I was wondering instead of adding adding old ATT&CK Technique ID to the yaml, would #167 work for you ? We are working on running atomics solely by GUID. This way even when the ATT&CK IDs change in the future, you can use the GUID to test them out.

Copy link

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

@github-actions github-actions bot added the Stale label Jan 28, 2024
Copy link

github-actions bot commented Feb 8, 2024

This issue was closed because it has been stalled for 5 days with no activity.

@github-actions github-actions bot closed this as not planned Won't fix, can't repro, duplicate, stale Feb 8, 2024
@cyberbuff cyberbuff removed the Stale label Apr 27, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants