Identify MITRE ATT&CK Techniques

Identify Mitreattack Techniques

Query

SecurityAlert
// Define timerange
| where TimeGenerated > ago(30d)
| where isnotempty(Techniques)
| mvexpand todynamic(Techniques) to typeof(string)
| summarize AlertCount = dcount(SystemAlertId) by Techniques
| sort by AlertCount desc
// Define graphic
| render piechart

About this query

Identify MITRE ATT&CK Techniques

Description

The following queries provide for Microsoft Sentinel and Microsoft 365 Defender a graphic representation of MITRE ATT&CK techniques from alerts within the timerange defined.

References

https://attack.mitre.org/techniques/enterprise/

Microsoft Defender XDR

AlertInfo
// Define timerange
| where Timestamp > ago(30d)
| where AttackTechniques != ""
| mvexpand todynamic(AttackTechniques)
| summarize count() by tostring(AttackTechniques)
// Define graphic
| render piechart

Microsoft Sentinel

Versioning

Version	Date	Comments
1.0	01/02/2023	Initial publish
1.1	18/05/2023	Transformed to template, minor changes

Explanation

This query is designed to help visualize the use of MITRE ATT&CK techniques detected in alerts over the past 30 days using Microsoft Sentinel and Microsoft 365 Defender. Here's a simple breakdown:

Purpose: The query aims to identify and graphically represent MITRE ATT&CK techniques that have been triggered in security alerts within a specified time frame.
Data Sources:
- Microsoft Defender XDR: It pulls data from the AlertInfo table.
- Microsoft Sentinel: It uses the SecurityAlert table.
Time Frame: Both queries focus on alerts generated in the last 30 days.
Process:
- Microsoft Defender XDR:
  - Filters alerts with non-empty attack techniques.
  - Expands the list of techniques for each alert.
  - Counts occurrences of each technique.
  - Displays the results in a pie chart.
- Microsoft Sentinel:
  - Filters alerts with non-empty techniques.
  - Expands the list of techniques for each alert.
  - Counts unique alert IDs for each technique.
  - Sorts techniques by the number of alerts in descending order.
  - Displays the results in a pie chart.
Output: Both queries produce a pie chart that visually represents the frequency of different MITRE ATT&CK techniques detected in the alerts.
Versioning: The document includes a version history indicating the initial publication and subsequent updates.

This query helps security analysts quickly understand which attack techniques are most prevalent in their environment, aiding in threat detection and response efforts.

Details

Michalis Michalos

Released: March 25, 2024

Tables

AlertInfoSecurityAlert

Keywords

AlertInfoTimestampAttackTechniquesSecurityAlertTimeGeneratedTechniquesSystemAlertId

Operators

ago()where!=mvexpandtodynamic()summarizetostring()renderpiechartisnotempty()to typeof()dcount()sortdesc

Actions

GitHub

KQL Search