MITRE ATT&CK Mapping

This document provides a summary of KQL (Kusto Query Language) queries mapped to the MITRE ATT&CK framework, which is a comprehensive knowledge base of adversary tactics and techniques observed in real-world cyber incidents. The document excludes queries related to Reconnaissance and Resource Development tactics.

The statistics section lists various tactics and the number of queries associated with each:

• Initial Access: 16 queries
• Execution: 10 queries
• Persistence: 14 queries
• Privilege Escalation: 7 queries
• Stealth: 20 queries
• Defense Impairment: 9 queries
• Credential Access: 10 queries
• Discovery: 27 queries
• Lateral Movement: 2 queries
• Collection: 3 queries
• Command and Control: 9 queries
• Exfiltration: Not implemented
• Impact: 6 queries

Each tactic is further broken down into specific techniques, with associated queries that help detect or analyze those techniques. For example, under "Initial Access," techniques like "Valid Accounts: Cloud Accounts" and "Phishing" are listed with specific queries to detect suspicious activities.

The document serves as a reference for security professionals to understand how different KQL queries align with the MITRE ATT&CK framework, aiding in threat detection and response efforts.