Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Tag Events with MITRE TTPs #1869

Open
kerrymilan opened this issue Oct 18, 2024 · 0 comments
Open

Tag Events with MITRE TTPs #1869

kerrymilan opened this issue Oct 18, 2024 · 0 comments
Labels
enhancement New feature or request

Comments

@kerrymilan
Copy link
Collaborator

Description
For each module, add an optional property denoting which MITRE ATT&CK TTP is associated with the events being generated. These should be hard-coded into the module's properties where appropriate.

Example:

class badsecrets(BaseModule):
    watched_events = ["HTTP_RESPONSE"]
    produced_events = ["FINDING", "VULNERABILITY", "TECHNOLOGY"]
    flags = ["active", "safe", "web-basic"]
    meta = {
        "description": "Library for detecting known or weak secrets across many web frameworks",
        "created_date": "2022-11-19",
        "author": "@liquidsec",
        "mitre_ttp": "T1078.001",
    }

Result:

{
    "data": {
        "host": "evilcorp.com", 
        "severity": "INFO", 
        "description": "asdf",
        "mitre_ttp": "T1078.001",
    },
    "event_type": "VULNERABILITY",
    ...
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants