0xtf / nsm-attack

Mapping NSM rules to MITRE ATT&CK

Mapping NSM rules to MITRE ATT&CK Techniques

About

The idea behind this project is to categorize and develop, where feasible, Suricata (and general NSM) rules by mapping them against the MITRE ATT&CK framework.

How does it work?

Each technique has its own folder. Inside the folder, one of two things can happen:

• We will link to existing rules from known rulesets if a rule already exists
• We will share the rule in the format used by Suricata

The following rulesets are currently considered by this project:

• Emerging Threats Open
• Emerging Threats Pro

Have something to share?

Feel free to reach out to me via Twitter (@0xtf) if you have some rules you'd like to share or comments/questions/tips.

MITRE ATT&CK Navigator

Browse supported techniques using this URL.

Sponsorship

If you're interested in working in this project, 3CORESec has a sponsorship program that allows you to get paid for your contributions to open source projects.

Get in touch for more information!

nsm-attack's Issues

Technique data sources

Hi! First of all, kudos for the initiative, and reminding us that ATT&CK is not EDR only.

Many (if not all) of the techniques you have mapped don't have the 'Network intrusion detection system' data source. Depending on how you are using ATT&CK, this might be an issue if you are planing to perform gap/coverage analysis. Are you planning to request the ATT&CK team to add the NIDS data source as you map the techniques?

Thanks!
RD

NSM Attack T1100 should include "*" in the signature

To be coherent with other definitions and more precise in general, the signature should be ET WEB_SERVER ATTACKER WebShell *.

What license is this project under?

Can you please update with which open source license this work is under? Thanks!

how to use this with mitre navigator?

please share some manual or instructions to use these rules with mitre local navigator