Technique T1207 and integration sub-techniques ? about dettect

[rubinatorz]

hi @Blackkout

Not every technique is listed within the sample file: /sample-data/techniques-administration-endpoints.yaml. This is just a sample-file to play around. You can edit this techniques administration file if you want, you may want to use the DeTT&CT Editor for that: http://rabobank-cdc.github.io/dettect-editor/

You can also start a brand new file within the DeTT&CT Editor. Within the Editor you can add all techniques you want and there's auto completion in the technique Name/ID field.

It's also possible to start with the data sources administration file. When having such file containing all your data sources, you can generate the techniques administration file based on the data source administration file with the --yaml option in the ds mode. In addition to this option, you can also use the --yaml-all-techniques option to include all techniques in the techniques administration file.

A good resource to start is:
https://github.com/rabobank-cdc/DeTTECT/wiki/Getting-started

The latest version of DeTT&CT (including the DeTT&CT Editor) supports sub-techniques already.

Regards,
Ruben

[Blackkout]

Thank you @rubinatorz !