Skip to content

Commit 7595709

Browse files
jmcarlocksusan-shu-c
jmcarlock
and
susan-shu-c
authored
add mitre attack rules for ML job rules, bump dates (#5333)
Co-authored-by: Susan <[email protected]>
1 parent 6915e39 commit 7595709

15 files changed

+735
-15
lines changed

‎rules/integrations/aws/ml_cloudtrail_error_message_spike.toml‎

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2020/07/13"
33
integration = ["aws"]
44
maturity = "production"
5-
updated_date = "2024/06/18"
5+
updated_date = "2025/11/18"
66

77
[rule]
88
anomaly_threshold = 50
@@ -112,3 +112,37 @@ tags = [
112112
]
113113
type = "machine_learning"
114114

115+
[[rule.threat]]
116+
framework = "MITRE ATT&CK"
117+
118+
[rule.threat.tactic]
119+
id = "TA0007"
120+
name = "Discovery"
121+
reference = "https://attack.mitre.org/tactics/TA0007/"
122+
123+
[[rule.threat.technique]]
124+
id = "T1526"
125+
name = "Cloud Service Discovery"
126+
reference = "https://attack.mitre.org/techniques/T1526/"
127+
128+
[[rule.threat.technique]]
129+
id = "T1580"
130+
name = "Cloud Infrastructure Discovery"
131+
reference = "https://attack.mitre.org/techniques/T1580/"
132+
133+
[[rule.threat]]
134+
framework = "MITRE ATT&CK"
135+
136+
[rule.threat.tactic]
137+
id = "TA0004"
138+
name = "Privilege Escalation"
139+
reference = "https://attack.mitre.org/tactics/TA0004/"
140+
141+
[[rule.threat]]
142+
framework = "MITRE ATT&CK"
143+
144+
[rule.threat.tactic]
145+
id = "TA0008"
146+
name = "Lateral Movement"
147+
reference = "https://attack.mitre.org/tactics/TA0008/"
148+

‎rules/integrations/aws/ml_cloudtrail_rare_error_code.toml‎

Lines changed: 59 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2020/07/13"
33
integration = ["aws"]
44
maturity = "production"
5-
updated_date = "2024/06/18"
5+
updated_date = "2025/11/18"
66

77
[rule]
88
anomaly_threshold = 50
@@ -114,3 +114,61 @@ tags = [
114114
]
115115
type = "machine_learning"
116116

117+
[[rule.threat]]
118+
framework = "MITRE ATT&CK"
119+
120+
[rule.threat.tactic]
121+
id = "TA0007"
122+
name = "Discovery"
123+
reference = "https://attack.mitre.org/tactics/TA0007/"
124+
125+
[[rule.threat.technique]]
126+
id = "T1526"
127+
name = "Cloud Service Discovery"
128+
reference = "https://attack.mitre.org/techniques/T1526/"
129+
130+
[[rule.threat.technique]]
131+
id = "T1580"
132+
name = "Cloud Infrastructure Discovery"
133+
reference = "https://attack.mitre.org/techniques/T1580/"
134+
135+
[[rule.threat]]
136+
framework = "MITRE ATT&CK"
137+
138+
[rule.threat.tactic]
139+
id = "TA0004"
140+
name = "Privilege Escalation"
141+
reference = "https://attack.mitre.org/tactics/TA0004/"
142+
143+
[[rule.threat]]
144+
framework = "MITRE ATT&CK"
145+
146+
[rule.threat.tactic]
147+
id = "TA0005"
148+
name = "Defense Evasion"
149+
reference = "https://attack.mitre.org/tactics/TA0005/"
150+
151+
[[rule.threat]]
152+
framework = "MITRE ATT&CK"
153+
154+
[rule.threat.tactic]
155+
id = "TA0008"
156+
name = "Lateral Movement"
157+
reference = "https://attack.mitre.org/tactics/TA0008/"
158+
159+
[[rule.threat]]
160+
framework = "MITRE ATT&CK"
161+
162+
[rule.threat.tactic]
163+
id = "TA0003"
164+
name = "Persistence"
165+
reference = "https://attack.mitre.org/tactics/TA0003/"
166+
167+
[[rule.threat]]
168+
framework = "MITRE ATT&CK"
169+
170+
[rule.threat.tactic]
171+
id = "TA0009"
172+
name = "Collection"
173+
reference = "https://attack.mitre.org/tactics/TA0009/"
174+

‎rules/integrations/aws/ml_cloudtrail_rare_method_by_city.toml‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2020/07/13"
33
integration = ["aws"]
44
maturity = "production"
5-
updated_date = "2024/06/18"
5+
updated_date = "2025/11/18"
66

77
[rule]
88
anomaly_threshold = 50
@@ -116,3 +116,21 @@ tags = [
116116
]
117117
type = "machine_learning"
118118

119+
[[rule.threat]]
120+
framework = "MITRE ATT&CK"
121+
122+
[rule.threat.tactic]
123+
id = "TA0001"
124+
name = "Initial Access"
125+
reference = "https://attack.mitre.org/tactics/TA0001/"
126+
127+
[[rule.threat.technique]]
128+
id = "T1078"
129+
name = "Valid Accounts"
130+
reference = "https://attack.mitre.org/techniques/T1078/"
131+
132+
[[rule.threat.technique.subtechnique]]
133+
id = "T1078.004"
134+
name = "Cloud Accounts"
135+
reference = "https://attack.mitre.org/techniques/T1078/004/"
136+

‎rules/integrations/aws/ml_cloudtrail_rare_method_by_country.toml‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2020/07/13"
33
integration = ["aws"]
44
maturity = "production"
5-
updated_date = "2024/06/18"
5+
updated_date = "2025/11/18"
66

77
[rule]
88
anomaly_threshold = 50
@@ -116,3 +116,21 @@ tags = [
116116
]
117117
type = "machine_learning"
118118

119+
[[rule.threat]]
120+
framework = "MITRE ATT&CK"
121+
122+
[rule.threat.tactic]
123+
id = "TA0001"
124+
name = "Initial Access"
125+
reference = "https://attack.mitre.org/tactics/TA0001/"
126+
127+
[[rule.threat.technique]]
128+
id = "T1078"
129+
name = "Valid Accounts"
130+
reference = "https://attack.mitre.org/techniques/T1078/"
131+
132+
[[rule.threat.technique.subtechnique]]
133+
id = "T1078.004"
134+
name = "Cloud Accounts"
135+
reference = "https://attack.mitre.org/techniques/T1078/004/"
136+

‎rules/integrations/aws/ml_cloudtrail_rare_method_by_user.toml‎

Lines changed: 58 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2020/07/13"
33
integration = ["aws"]
44
maturity = "production"
5-
updated_date = "2024/06/18"
5+
updated_date = "2025/11/18"
66

77
[rule]
88
anomaly_threshold = 75
@@ -114,3 +114,60 @@ tags = [
114114
]
115115
type = "machine_learning"
116116

117+
[[rule.threat]]
118+
framework = "MITRE ATT&CK"
119+
120+
[rule.threat.tactic]
121+
id = "TA0001"
122+
name = "Initial Access"
123+
reference = "https://attack.mitre.org/tactics/TA0001/"
124+
125+
[[rule.threat.technique]]
126+
id = "T1078"
127+
name = "Valid Accounts"
128+
reference = "https://attack.mitre.org/techniques/T1078/"
129+
130+
[[rule.threat.technique.subtechnique]]
131+
id = "T1078.004"
132+
name = "Cloud Accounts"
133+
reference = "https://attack.mitre.org/techniques/T1078/004/"
134+
135+
[[rule.threat]]
136+
framework = "MITRE ATT&CK"
137+
138+
[rule.threat.tactic]
139+
id = "TA0008"
140+
name = "Lateral Movement"
141+
reference = "https://attack.mitre.org/tactics/TA0008/"
142+
143+
[[rule.threat.technique]]
144+
id = "T1021"
145+
name = "Remote Services"
146+
reference = "https://attack.mitre.org/techniques/T1021/"
147+
148+
[[rule.threat.technique.subtechnique]]
149+
id = "T1021.007"
150+
name = "Cloud Services"
151+
reference = "https://attack.mitre.org/techniques/T1021/007/"
152+
153+
[[rule.threat]]
154+
framework = "MITRE ATT&CK"
155+
156+
[rule.threat.tactic]
157+
id = "TA0003"
158+
name = "Persistence"
159+
reference = "https://attack.mitre.org/tactics/TA0003/"
160+
161+
[[rule.threat]]
162+
framework = "MITRE ATT&CK"
163+
164+
[rule.threat.tactic]
165+
id = "TA0010"
166+
name = "Exfiltration"
167+
reference = "https://attack.mitre.org/tactics/TA0010/"
168+
169+
[[rule.threat.technique]]
170+
id = "T1041"
171+
name = "Exfiltration Over C2 Channel"
172+
reference = "https://attack.mitre.org/techniques/T1041/"
173+

‎rules/ml/ml_high_count_events_for_a_host_name.toml‎

Lines changed: 58 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2025/02/18"
33
integration = ["endpoint"]
44
maturity = "production"
5-
updated_date = "2025/02/18"
5+
updated_date = "2025/11/18"
66

77
[rule]
88
anomaly_threshold = 75
@@ -91,3 +91,60 @@ The detection of a spike in host-based traffic leverages machine learning to ide
9191
- Restore the affected host from a known good backup if malware or significant unauthorized changes are detected.
9292
- Implement network segmentation to limit the spread of potential threats and reduce the impact of similar incidents in the future.
9393
- Escalate the incident to the security operations center (SOC) or relevant team for further analysis and to determine if additional resources are needed for a comprehensive response."""
94+
95+
[[rule.threat]]
96+
framework = "MITRE ATT&CK"
97+
98+
[rule.threat.tactic]
99+
id = "TA0010"
100+
name = "Exfiltration"
101+
reference = "https://attack.mitre.org/tactics/TA0010/"
102+
103+
[[rule.threat.technique]]
104+
id = "T1041"
105+
name = "Exfiltration Over C2 Channel"
106+
reference = "https://attack.mitre.org/techniques/T1041/"
107+
108+
[[rule.threat]]
109+
framework = "MITRE ATT&CK"
110+
111+
[rule.threat.tactic]
112+
id = "TA0040"
113+
name = "Impact"
114+
reference = "https://attack.mitre.org/tactics/TA0040/"
115+
116+
[[rule.threat.technique]]
117+
id = "T1498"
118+
name = "Network Denial of Service"
119+
reference = "https://attack.mitre.org/techniques/T1498/"
120+
121+
[[rule.threat.technique]]
122+
id = "T1499"
123+
name = "Endpoint Denial of Service"
124+
reference = "https://attack.mitre.org/techniques/T1499/"
125+
126+
[[rule.threat]]
127+
framework = "MITRE ATT&CK"
128+
129+
[rule.threat.tactic]
130+
id = "TA0002"
131+
name = "Execution"
132+
reference = "https://attack.mitre.org/tactics/TA0002/"
133+
134+
[[rule.threat.technique]]
135+
id = "T1204"
136+
name = "User Execution"
137+
reference = "https://attack.mitre.org/techniques/T1204/"
138+
139+
[[rule.threat]]
140+
framework = "MITRE ATT&CK"
141+
142+
[rule.threat.tactic]
143+
id = "TA0004"
144+
name = "Privilege Escalation"
145+
reference = "https://attack.mitre.org/tactics/TA0004/"
146+
147+
[[rule.threat.technique]]
148+
id = "T1068"
149+
name = "Exploitation for Privilege Escalation"
150+
reference = "https://attack.mitre.org/techniques/T1068/"

0 commit comments

Comments
 (0)