MITRE ATT&CK Mapping

This query is a comprehensive mapping of KQL (Kusto Query Language) queries to the MITRE ATT&CK framework, which is a widely used knowledge base of adversary tactics and techniques observed in real-world cyber threats. The document categorizes various KQL queries according to different tactics and techniques outlined in the MITRE ATT&CK framework, excluding the Reconnaissance and Resource Development tactics.

Here's a simplified breakdown of the query:

1. Statistics: It provides a count of KQL queries mapped to each tactic in the MITRE ATT&CK framework, such as Initial Access, Execution, Persistence, etc.

2. Initial Access: Lists queries related to techniques like Valid Accounts, Exploit Public-Facing Application, and Phishing, which are used by adversaries to gain initial access to a system.

3. Execution: Includes queries for techniques like Windows Management Instrumentation and Command and Scripting Interpreter, which are used to execute malicious code.

4. Persistence: Covers queries for techniques that allow adversaries to maintain their foothold, such as Scheduled Tasks and Account Manipulation.

5. Privilege Escalation: Lists queries related to techniques that adversaries use to gain higher-level permissions, like Valid Accounts and Access Token Manipulation.

6. Stealth: Contains queries for techniques used to avoid detection, such as Obfuscated Files or Information and Indicator Removal.

7. Defense Impairment: Includes queries for techniques that impair security defenses, like disabling security tools or modifying cloud logs.

8. Credential Access: Lists queries for techniques used to steal credentials, such as Brute Force and OS Credential Dumping.

9. Discovery: Covers queries for techniques used to gather information about the system and network, like Remote System Discovery and Account Discovery.

10. Lateral Movement: Includes queries for techniques that allow adversaries to move through a network, such as Remote Services and Exploitation of Remote Services.

11. Collection: Lists queries for techniques used to gather data, such as Data from Local System and Email Collection.

12. Command and Control: Contains queries for techniques used to communicate with compromised systems, like Application Layer Protocol and Remote Access Software.

13. Exfiltration: This section is noted as "to be implemented," indicating future work to map queries related to data exfiltration.

14. Impact: Lists queries for techniques that affect the integrity and availability of systems, such as Data Destruction and Data Encrypted for Impact.

Overall, the document serves as a reference for security professionals to identify and map KQL queries to specific adversary tactics and techniques, aiding in threat detection and response efforts.