See Also: https://attack.mitre.org/datasources/ This MITRE effort came out after my work here, and has surpassed it. I will look for a way to expand/compliment MITRE’s efforts rather than recreate.
ATT&CK Abbreviations Used
Initial Access (IA), Execution (Exe), Persistence (P), Privilege Escalation (PE), Defense Evasion (DE),
Credential Access (CA), Discovery (D), Lateral Movement (LM), Collection (C), Exfiltration (Exf), Command and Control (CC)
Detect | ATT&CK Tactics Cross Mapping
Resources
- SANS FOR508
- https://attack.mitre.org/
- https://threathunterplaybook.com/introduction.html
- https://www.elastic.co/guide/en/siem/guide/current/prebuilt-rules.html
- https://github.com/Neo23x0/sigma
- https://github.com/splunk/security_content/tree/develop/detections
- https://github.com/Azure/Azure-Sentinel/tree/master/Detections
- https://lolbas-project.github.io/
- https://docs.rapid7.com/insightidr/windows-suspicious-process/
- http://tajdini.net/blog/forensics-and-security/digital-forensics-and-incident-response/
- https://rules.fluencysecurity.com/
- https://splunkresearch.com/detections/
- https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES
- https://ihsansencan.github.io/index.html
- https://www.siemusecases.com/
- https://docs.logpoint.com/docs/alert-rules/en/latest/MITRE.html
- https://github.com/olafhartong/sysmon-modular