KQL Search

This document is a mapping of KQL (Kusto Query Language) queries to the MITRE ATT&CK framework, which is a comprehensive knowledge base of adversary tactics and techniques observed in real-world cyber attacks. The mapping focuses on specific stages of an attack, excluding Reconnaissance and Resource Development.

Here's a summary of the sections covered:

1. Execution: Includes a query related to Windows Management Instrumentation (WMI) Event Subscription, which is a technique used by attackers to execute malicious code.

2. Persistence: Lists queries for detecting the creation of local accounts, which attackers might use to maintain access to a compromised system.

3. Defense Evasion: Contains queries for detecting various techniques attackers use to avoid detection, such as hiding artifacts using NTFS file attributes, modifying group policies, disabling security tools, and configuring firewall settings.

4. Credential Access: Features a query for identifying password spraying attacks, a method used to gain unauthorized access by trying common passwords across many accounts.

5. Discovery: Includes a query for detecting domain account discovery activities, which attackers use to gather information about user accounts.

6. Collection: Lists a query related to email forwarding rules, which attackers might use to collect sensitive information by automatically forwarding emails.

The document does not include queries for the Initial Access, Privilege Escalation, Lateral Movement, Command and Control, Exfiltration, and Impact stages, except for the ones mentioned above. Each query is linked to a specific technique ID from the MITRE ATT&CK framework, providing a structured approach to understanding and detecting cyber threats.