KQL Search

This document provides a summary of KQL (Kusto Query Language) queries that are mapped to the MITRE ATT&CK framework, which is a comprehensive knowledge base of adversary tactics and techniques observed in real-world cyber threats. The document categorizes these queries based on different tactics and techniques used by adversaries, excluding the Reconnaissance and Resource Development phases.

Here's a breakdown of the statistics and some examples of queries for each tactic:

1. Initial Access (15 queries): Techniques to gain initial access to a system, such as exploiting public-facing applications or phishing. Examples include detecting new authentication apps and identifying malicious emails.

2. Execution (10 queries): Methods used by adversaries to run malicious code on a system. Examples include detecting suspicious PowerShell executions and WMIC remote command executions.

3. Persistence (13 queries): Techniques that adversaries use to maintain their foothold in a system. Examples include detecting scheduled tasks and account manipulations.

4. Privilege Escalation (7 queries): Methods to gain higher-level permissions on a system. Examples include detecting users added to sensitive groups and command-line group additions.

5. Stealth (20 queries): Techniques to avoid detection. Examples include detecting obfuscated PowerShell commands and indicator removal activities.

6. Defense Impairment (9 queries): Methods to disable or evade security defenses. Examples include disabling security tools and modifying cloud logs.

7. Credential Access (7 queries): Techniques to steal credentials. Examples include brute force attacks and adversary-in-the-middle phishing.

8. Discovery (23 queries): Techniques to gather information about the system and network. Examples include network sniffing and permission group discovery.

9. Lateral Movement (2 queries): Methods to move through a network. Examples include SMB file copy and exploitation of remote services.

10. Collection (3 queries): Techniques to gather data of interest to the adversary. Examples include collecting files from hosts and email collection.

11. Command and Control (9 queries): Methods to communicate with compromised systems. Examples include detecting remote access software and potential beaconing activity.

12. Exfiltration (1 query): Techniques to steal data from a network. This section is yet to be fully implemented.

13. Impact (6 queries): Techniques to disrupt or destroy systems and data. Examples include data destruction and ransomware activities.

Each tactic and technique is associated with specific queries that help detect and respond to these adversarial actions within a network.