Most Triggered Mitre Techniques
Statistics Most Triggered Mitre Techniques
Query
let timeframe = 7d;
AlertInfo
| where Timestamp > ago(timeframe)
// Collect the last entry of each alert
| summarize arg_max(Timestamp, *) by AlertId
// Ensure that events with multiple techniques can be counted
| extend MitreTechnique = todynamic(AttackTechniques)
| mv-expand MitreTechnique
| summarize TriggerCount = count() by tostring(MitreTechnique)
| top 10 by TriggerCountAbout this query
Most Triggered Mitre Techniques
Query Information
Description
The results of this query provide insight in the top 10 MITRE ATT&CK Techniques that have been triggered in the past 10 days. This can indicate that adversaries use specific techniques to gain access to your environment. On the otherhand if this information is combined with FP/BP statistics it can give insight into the detections that need to be improved.
Defender XDR
Sentinel
// Timeframe to collect incident statistics
let timeframe = 7d;
SecurityIncident
| where TimeGenerated > ago(timeframe)
// Collect the last entry of each alert
| summarize arg_max(TimeGenerated, *) by IncidentNumber
// Ensure that events with multiple techniques can be counted
| extend MitreTechnique = todynamic(AdditionalData).techniques
| mv-expand MitreTechnique
| summarize TriggerCount = count() by tostring(MitreTechnique)
| top 10 by TriggerCount
Explanation
This query is designed to identify the top 10 MITRE ATT&CK techniques that have been most frequently triggered in the past 7 days. It does this by analyzing security alerts or incidents to see which techniques are being used by potential adversaries to gain access to your environment. Here's a simplified breakdown of what each part of the query does:
-
Timeframe Definition: The query sets a timeframe of 7 days to look back and analyze data.
-
Data Filtering: It filters alerts or incidents to only include those that have occurred within the last 7 days.
-
Latest Entry Collection: For each alert or incident, it collects the most recent entry to ensure that the data is up-to-date.
-
Technique Extraction: It extracts the MITRE ATT&CK techniques associated with each alert or incident. This is done by converting the techniques data into a dynamic format and expanding it so that each technique can be counted individually.
-
Counting and Ranking: The query counts how many times each technique has been triggered and then ranks them to find the top 10 most frequently triggered techniques.
By identifying these top techniques, organizations can gain insights into the tactics used by adversaries and potentially improve their detection and response strategies.
Details
Bert-Jan Pals
Released: October 20, 2024
Tables
Keywords
Operators