KQL Search

This KQL query is designed to analyze threat intelligence data, specifically looking for indicators related to a specific MITRE ATT&CK technique. Here's a simplified breakdown of what the query does:

1. Data Source: It starts by querying the ThreatIntelIndicators table.

2. Time Filter: It filters the data to include only records generated in the last 365 days.

3. Validity Check: It ensures that the current time (now()) falls within the validity period of the threat indicators (ValidFrom to ValidUntil).

4. Label Check: It filters out records that have empty Data.labels.

5. Label Expansion: It expands the Data.labels field to handle multiple labels within a single record.

6. MITRE Label Filter: It further filters the records to include only those with labels containing the term "mitre".

7. MITRE ID Extraction: It extracts the MITRE technique ID from the labels and assigns it to a new field called MitreID.

8. Specific Technique Filter: It filters the records to include only those with the MITRE ID "T1219", which corresponds to "Remote Access Tools".

9. Count and Group: It counts the number of indicators (IOCcount) for each unique ObservableKey and groups them by Confidence.

10. Sorting: Finally, it sorts the results in descending order based on the count of indicators (IOCcount).

In summary, this query identifies and counts threat intelligence indicators related to the "Remote Access Tools" technique from the MITRE ATT&CK framework, within the last year, and sorts them by the number of occurrences.