Analyze Adversary Tactics and Techniques Using the MITRE ATT&CK CTI Corpus
MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community. Tools are provided to analyze adversary tactics and techniques, build incident metrics, and identify high level program gaps using the MITRE ATT&CK CTI Corpus.
The following functions are implemented:
enterprise_attack
: Enterprise Attack Taxonomy v2.0fct_tactic
: Make an ordered Tactics factor with optional better labellingmobile_attack
: Mobile Attack Taxonomy v2.0pre_attack
: Pre-Attack Taxonomy v2.0read_events
: Read in ATT&CK events from a filetactics_f
: Tactics factors (generally for sorting & pretty-printing)tidy_attack
: Combined ATT&CK Matricies Tactics, Techniques and Technique detailvalidate_tactics
: Validate Tactics strings against MITRE authoritative sourcevalidate_technique_ids
: Validate Technique IDsvalidate_techniques
: Validate Techniques strings against MITRE authoritative sourceThe following datasets are included:
enterprise_attack
: Enterprise Attack Taxonomy v2.0mobile_attack
: Mobile Attack Taxonomy v2.0pre_attack
: Pre-Attack Taxonomy v2.0tactics_f
: Tactics factors (generally for sorting & pretty-printing)tidy_attack
: Combined ATT&CK Matricies Tactics, Techniques and Technique detailinstall.packages("attckr", repos = "https://cinc.rud.is")
# or
remotes::install_git("https://git.rud.is/hrbrmstr/attckr.git")
# or
remotes::install_git("https://git.sr.ht/~hrbrmstr/attckr")
# or
remotes::install_gitlab("hrbrmstr/attckr")
# or
remotes::install_bitbucket("hrbrmstr/attckr")
# or
remotes::install_github("hrbrmstr/attckr")
NOTE: To use the ‘remotes’ install options you will need to have the {remotes} package installed.
library(attckr)
library(tidyverse)
# current version
packageVersion("attckr")
## [1] '0.1.0'
tidy_attack
## # A tibble: 708 x 5
## technique description id tactic matrix
## <chr> <chr> <chr> <chr> <chr>
## 1 .bash_profile and… "<code>~/.bash_profile</code> and <code>~/.bashrc</code> are exec… T1156 persistence mitre-at…
## 2 Access Token Mani… "Windows uses access tokens to determine the ownership of a runni… T1134 defense-evas… mitre-at…
## 3 Access Token Mani… "Windows uses access tokens to determine the ownership of a runni… T1134 privilege-es… mitre-at…
## 4 Accessibility Fea… "Windows contains accessibility features that may be launched wit… T1015 persistence mitre-at…
## 5 Accessibility Fea… "Windows contains accessibility features that may be launched wit… T1015 privilege-es… mitre-at…
## 6 Accessibility Fea… "Windows contains accessibility features that may be launched wit… CAPEC-… persistence mitre-at…
## 7 Accessibility Fea… "Windows contains accessibility features that may be launched wit… CAPEC-… privilege-es… mitre-at…
## 8 Account Discovery "Adversaries may attempt to get a listing of local system or doma… T1087 discovery mitre-at…
## 9 Account Discovery "Adversaries may attempt to get a listing of local system or doma… CAPEC-… discovery mitre-at…
## 10 Account Manipulat… Account manipulation may aid adversaries in maintaining access to… T1098 credential-a… mitre-at…
## # … with 698 more rows
events <- read_events(system.file("extdat/sample-incidents.csv.gz", package = "attckr"))
## Parsed with column specification:
## cols(
## event_id = col_character(),
## incident_id = col_character(),
## event_ts = col_date(format = ""),
## detection_ts = col_date(format = ""),
## tactic = col_character(),
## technique = col_character(),
## discovery_source = col_character(),
## reporting_source = col_character(),
## responder_id = col_character()
## )
## You appear to be using Tactic ids.
## You appear to be using Techinque ids.
count(head(events, 30), tactic, technique) %>%
mutate(tactic = fct_tactic(tactic, "pretty", "nl")) %>%
left_join(
filter(tidy_attack, matrix == "mitre-attack") %>%
distinct(id, technique),
c("technique" = "id")
) %>%
complete(tactic, technique.y) %>%
mutate(technique.y = factor(technique.y, rev(sort(unique(technique.y))))) %>%
ggplot(aes(tactic, technique.y)) +
geom_tile(aes(fill = n), color = "#2b2b2b", size = 0.125) +
scale_x_discrete(expand = c(0, 0), position = "top") +
scale_fill_viridis_c(direction = -1, na.value = "white") +
labs(
x = NULL, y = NULL
) +
theme_minimal() +
theme(panel.grid=element_blank())