Merged
Conversation
Remove placeholder rule IDs that don't correspond to real detection rules. Add real rule IDs where coverage exists: - account_discovery_domain: Added real SIEM rule 871ea072 (Enumeration of Administrator Accounts) - ssh_authorized_keys_modification: Added real SIEM rule 2215b8bd (SSH Authorized Keys File Activity) - clear_linux_system_logs: Added real SIEM rule 7bcbb3ac (Tampering of Shell Command-Line History) RTAs with no current detection rule coverage (empty rule lists): - defacement_internal (T1491.001) - user_execution_malicious_file (T1204.002) - user_execution_malicious_link (T1204.001) - exfil_to_cloud_storage (T1567.002) - valid_accounts_domain (T1078.002)
Mikaayenson
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Removes placeholder/fake rule IDs from newly created RTAs and replaces them with real rule IDs where coverage exists.
Changes
RTAs - Rule Mapping Updates
account_discovery_domain871ea072-1b71-4def-b016-6278b505138dssh_authorized_keys_modification2215b8bd-1759-4ffa-8ab8-55c8e6b32e7fclear_linux_system_logs7bcbb3ac-e533-41ad-a612-d6c3bf666abaRTAs with No Detection Rule Coverage
These RTAs simulate MITRE techniques without 1:1 mitre mapping in our rules:
defacement_internaluser_execution_malicious_fileuser_execution_malicious_linkexfil_to_cloud_storagevalid_accounts_domain