Mitre ATT&CK
整合版本：15.0
在 Google Security Operations 中設定 Mitre ATT&CK 整合
如需在 Google SecOps 中設定整合功能的詳細操作說明，請參閱「設定整合功能」。
整合參數
請使用下列參數設定整合：
| 參數顯示名稱 | 類型 | 預設值 | 為必填項目 | 說明 |
|---|---|---|---|---|
| 執行個體名稱 | 字串 | 不適用 | 否 | 您要設定整合的執行個體名稱。 |
| 說明 | 字串 | 不適用 | 否 | 執行個體的說明。 |
| API 根目錄 | 字串 | https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json | 是 | Mitre ATT&CK 執行個體的位址。 |
| 驗證 SSL | 核取方塊 | 已勾選 | 否 | 如果 Mitre ATT&CK 連線需要 SSL 驗證，請勾選這個核取方塊。 |
| 遠端執行 | 核取方塊 | 已取消勾選 | 否 | 勾選這個欄位，即可遠端執行設定的整合項目。勾選後，系統會顯示選取遠端使用者 (服務專員) 的選項。 |
動作
如要進一步瞭解動作，請參閱「 從工作台回覆待處理動作」和「執行手動動作」。
取得相關入侵事件
說明
擷取與 MITRE 攻擊技術相關的入侵事件資訊。
參數
| 參數 | 類型 | 預設值 | 為必填項目 | 說明 |
|---|---|---|---|---|
| 技術 ID | 字串 | 不適用 | 是 | 指定用於尋找相關入侵事件的 ID。 |
| ID 類型 | DDL | 攻擊 ID 選用值： 攻擊名稱、 攻擊 ID、 外部攻擊 ID |
是 | 指定要使用的 ID 類型。
可能的值如下：
雖然 UI 會將參數選項顯示為 |
| 要傳回的入侵次數上限 | 字串 | 20 | 否 | 指定要傳回的入侵次數。 |
執行時間
這項操作會對所有實體執行。
動作執行結果
指令碼執行結果
| 指令碼結果名稱 | 價值選項 | 示例 |
|---|---|---|
| is_success | True/False | is_success:False |
JSON 結果
以下範例顯示使用「Get Associated Intrusions」(取得相關入侵事件) 動作時收到的 JSON 結果輸出內容：
[
{
"created_by_ref":"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"description":"[APT32](https://attack.mitre.org/groups/G0050) is a threat group that has been active since at least 2014. The group ...",
"created":"2017-12-14T16:46:06.044Z",
"x_mitre_contributors":["Romain Dumont, ESET"],
"modified":"2019-07-17T13:11:37.402Z",
"name":"APT32",
"object_marking_refs":["marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"],
"x_mitre_version":"2.0",
"aliases":["APT32","SeaLotus","OceanLotus","APT-C-00"],
"type":"intrusion-set",
"id":"intrusion-set--247cb30b-955f-42eb-97a5-a89fef69341e",
"external_references":
[
{
"url":"https://attack.mitre.org/groups/G0050",
"source_name":"mitre-attack",
"external_id":"G0050"
},{
"source_name":"APT32",
"description":"(Citation: FireEye APT32 May 2017) (Citation: Volexity OceanLotus Nov 2017)(Citation: Cybereason Oceanlotus May 2017)"
}]},{
"created_by_ref":"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"name":"BRONZE BUTLER",
"created":"2018-01-16T16:13:52.465Z",
"description":"[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) is a cyber espionage group with...",
"modified":"2019-03-22T19:57:36.804Z",
"object_marking_refs":["marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"],
"external_references": [
{
"url":"https://attack.mitre.org/groups/G0060",
"source_name":"mitre-attack",
"external_id":"G0060"
},{
"source_name":"BRONZE BUTLER",
"description":"(Citation: Trend Micro Daserf Nov 2017)"
}],
"x_mitre_version":"1.0",
"type":"intrusion-set",
"id":"intrusion-set--93f52415-0fe4-4d3d-896c-fc9b8e88ab90",
"aliases":["BRONZE BUTLER","REDBALDKNIGHT","Tick"]
},{
"created_by_ref":"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"name":"CopyKittens",
"created":"2018-01-16T16:13:52.465Z",
"description":"[CopyKittens](https://attack.mitre.org/groups/G0052) is a cyber espionage group that has been ...",
"modified":"2019-05-03T16:42:19.026Z",
"object_marking_refs":["marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"],
"external_references":
[{
"url":"https://attack.mitre.org/groups/G0052",
"source_name":"mitre-attack",
"external_id":"G0052"
},{
"source_name":"CopyKittens",
"description":"(Citation: ClearSky CopyKittens March 2017) (Citation: ClearSky Wilted Tulip July 2017) (Citation: CopyKittens Nov 2015)"
},],
"x_mitre_version":"1.1",
"type":"intrusion-set",
"id":"intrusion-set--dcd81c6e-ebf7-4a16-93e0-9a97fa49c88a",
"aliases":["CopyKittens"]
}
]
取得緩解措施
說明
擷取與 MITRE 攻擊技術相關聯的緩解措施資訊。
參數
| 參數 | 類型 | 預設值 | 為必填項目 | 說明 |
|---|---|---|---|---|
| 技術 ID | 字串 | 不適用 | 是 | 指定用於尋找與攻擊技術相關緩解措施的 ID。 |
| ID 類型 | DDL | 攻擊 ID 選用值： 攻擊名稱、 攻擊 ID、 外部攻擊 ID |
是 | 指定要使用的 ID 類型。
可能的值如下：
雖然 UI 會將參數選項顯示為 |
| 要傳回的因應措施數量上限 | 字串 | 20 | 否 | 指定要傳回的入侵次數。 |
執行時間
這項操作會對所有實體執行。
動作執行結果
指令碼執行結果
| 指令碼結果名稱 | 價值選項 | 示例 |
|---|---|---|
| is_success | True/False | is_success:False |
JSON 結果
[
{
"created_by_ref":"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"description":"Identify unnecessary system utilities, third-party tools, or potentially malicious software that may be used to encrypt files, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)",
"created":"2018-10-17T00:14:20.652Z",
"x_mitre_deprecated":true,
"modified":"2019-07-24T14:26:14.411Z",
"object_marking_refs":["marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"],
"external_references":
[{
"url":"https://attack.mitre.org/mitigations/T1022",
"source_name":"mitre-attack",
"external_id":"T1022"
},{
"url":"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
"source_name":"Beechey 2010",
"description":"Beechey, J. (2010, December). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014."
},{
"url":"http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
"source_name":"Windows Commands JPCERT",
"description":"Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016."
},{
"url":"https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"source_name":"NSA MS AppLocker",
"description":"NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016."
},{
"url":"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"source_name":"Corio 2008",
"description":"Corio, C., & Sayana, D. P. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved November 18, 2014."
},{
"url":"https://technet.microsoft.com/en-us/library/ee791851.aspx",
"source_name":"TechNet Applocker vs SRP",
"description":"Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016."
}],
"x_mitre_version":"1.0",
"type":"course-of-action",
"id":"course-of-action--2a8de25c-f743-4348-b101-3ee33ab5871b",
"name":"Data Encrypted Mitigation"
}
]
取得技術詳細資料
說明
擷取 MITRE 攻擊技術的詳細資訊。
參數
| 參數 | 類型 | 預設值 | 為必填項目 | 說明 |
|---|---|---|---|---|
| 技術 ID | 字串 | 不適用 | 是 | 指定以半形逗號分隔的 ID 清單，用於尋找技術的詳細資訊。範例：identifier_1,identifier_2 |
| ID 類型 | DDL | 攻擊 ID 選用值： 攻擊名稱、 攻擊 ID、 外部攻擊 ID |
是 | 指定要使用的 ID 類型。
可能的值如下：
雖然 UI 會將參數選項顯示為 |
| 建立洞察資料 | 核取方塊 | 已取消勾選 | 否 | 如果啟用這項功能，系統會為每個處理過的技術建立個別的洞察資料。 |
執行時間
這項操作會對所有實體執行。
動作執行結果
指令碼執行結果
| 指令碼結果名稱 | 價值選項 | 示例 |
|---|---|---|
| is_success | True/False | is_success:False |
JSON 結果
{
"created_by_ref":"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"external_references":
[{
"url":"https://attack.mitre.org/techniques/T1022",
"external_id":"T1022",
"source_name":"mitre-attack"
},{
"url":"http://www.netsec.colostate.edu/~zhang/DetectingEncryptedBotnetTraffic.pdf",
"source_name":"Zhang 2013",
"description":"Zhang, H., Papadopoulos, C., & Massey, D. (2013, April). Detecting encrypted botnet traffic. Retrieved August 19, 2015."
},{
"url":"https://en.wikipedia.org/wiki/List_of_file_signatures",
"source_name":"Wikipedia File Header Signatures",
"description":"Wikipedia. (2016, March 31). List of file signatures. Retrieved April 22, 2016."
}],
"created":"2017-05-31T21:30:30.26Z",
"x_mitre_platforms":["Linux","macOS","Windows"],
"type":"attack-pattern",
"description":"Data is encrypted before being exfiltrated in order to hide the information that is being exfiltrated from detection or to make the exfiltration less conspicuous upon inspection by a defender. The encryption is performed by a utility, programming library, or custom algorithm on the data itself and is considered separate from any encryption performed by the command and control or file transfer protocol. Common file archive formats that can encrypt files are RAR and zip.\\n\\nOther exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over Command and Control Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048)",
"kill_chain_phases":
[{
"phase_name":"exfiltration",
"kill_chain_name":"mitre-attack"
}],
"modified":"2018-10-17T00:14:20.652Z",
"id":"attack-pattern--d54416bd-0803-41ca-870a-ce1af7c05638",
"object_marking_refs":["marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"],
"x_mitre_network_requirements":false,
"x_mitre_version":"1.0",
"x_mitre_data_sources":["File monitoring","Process monitoring","Process command-line parameters","Binary file metadata"],
"x_mitre_detection":"Encryption software and encrypted files can be detected in many ways. Common utilities that may be present on the system or brought in by an adversary may be detectable through process monitoring and monitoring for command-line arguments for known encryption utilities. This may yield a significant amount of benign events, depending on how systems in the environment are typically used. Often the encryption key is stated within command-line invocation of the software. \\n\\nA process that loads the Windows DLL crypt32.dll may be used to perform encryption, decryption, or verification of file signatures. \\n\\nNetwork traffic may also be analyzed for entropy to determine if encrypted data is being transmitted. (Citation: Zhang 2013) If the communications channel is unencrypted, encrypted files of known file types can be detected in transit during exfiltration with a network intrusion detection or data loss prevention system analyzing file headers. (Citation: Wikipedia File Header Signatures)",
"name":"Data Encrypted"
}
取得技術詳細資料
說明
擷取 MITRE 攻擊技術的詳細資訊。
參數
| 參數 | 類型 | 預設值 | 為必填項目 | 說明 |
|---|---|---|---|---|
| 技術 ID | 字串 | 不適用 | 是 | 指定以半形逗號分隔的 ID 清單，用於尋找技術的詳細資訊。範例：identifier_1,identifier_2 |
| ID 類型 | DDL | 攻擊 ID 選用值： 攻擊名稱、 攻擊 ID、 外部攻擊 ID |
是 | 指定要使用的 ID 類型。
可能的值如下：
雖然 UI 會將參數選項顯示為 |
| 建立洞察資料 | 核取方塊 | 已取消勾選 | 否 | 如果啟用這項功能，系統會為每個處理過的技術建立個別的洞察資料。 |
執行時間
這項操作會對所有實體執行。
動作執行結果
指令碼執行結果
| 指令碼結果名稱 | 價值選項 | 示例 |
|---|---|---|
| is_success | True/False | is_success:False |
JSON 結果
[{
"Entity": "course-of-action--4f170666-7edb-4489-85c2-9affa28a72e0",
"EntityResult": {
"created_by_ref":"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"external_references":[{
"url":"https://attack.mitre.org/techniques/T1022",
"external_id":"T1022",
"source_name":"mitre-attack"
},{
"url":"http://www.netsec.colostate.edu/~zhang/DetectingEncryptedBotnetTraffic.pdf",
"source_name":"Zhang 2013",
"description":"Zhang, H., Papadopoulos, C., & Massey, D. (2013, April). Detecting encrypted botnet traffic. Retrieved August 19, 2015."
},{
"url":"https://en.wikipedia.org/wiki/List_of_file_signatures","source_name":"Wikipedia File Header Signatures",
"description":"Wikipedia. (2016, March 31). List of file signatures. Retrieved April 22, 2016."
}],
"created":"2017-05-31T21:30:30.26Z",
"x_mitre_platforms":["Linux","macOS","Windows"],
"type":"attack-pattern",
"description":"Data is encrypted before being exfiltrated in order to hide the information that is being exfiltrated from detection or to make the exfiltration less conspicuous upon inspection by a defender. The encryption is performed by a utility, programming library, or custom algorithm on the data itself and is considered separate from any encryption performed by the command and control or file transfer protocol. Common file archive formats that can encrypt files are RAR and zip.nnOther exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over Command and Control Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048)",
"kill_chain_phases":[{
"phase_name":"exfiltration",
"kill_chain_name":"mitre-attack"
}],
"modified":"2018-10-17T00:14:20.652Z",
"id":"attack-pattern--d54416bd-0803-41ca-870a-ce1af7c05638",
"object_marking_refs":["marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"],
"x_mitre_network_requirements":false,
"x_mitre_version":"1.0",
"x_mitre_data_sources":["File monitoring","Process monitoring","Process command-line parameters","Binary file metadata"],
"x_mitre_detection":"Encryption software and encrypted files can be detected in many ways. Common utilities that may be present on the system or brought in by an adversary may be detectable through process monitoring and monitoring for command-line arguments for known encryption utilities. This may yield a significant amount of benign events, depending on how systems in the environment are typically used. Often the encryption key is stated within command-line invocation of the software. nnA process that loads the Windows DLL crypt32.dll may be used to perform encryption, decryption, or verification of file signatures. nnNetwork traffic may also be analyzed for entropy to determine if encrypted data is being transmitted. (Citation: Zhang 2013) If the communications channel is unencrypted, encrypted files of known file types can be detected in transit during exfiltration with a network intrusion detection or data loss prevention system analyzing file headers. (Citation: Wikipedia File Header Signatures)",
"name":"Data Encrypted"
}
}]
案件總覽
| 結果類型 | 值 / 說明 | 類型 |
|---|---|---|
| 輸出訊息* | 如果至少處理了一個 ID： print "Retrieved detailed information about the following techniques: {0}\n".format(new line separated list of processed techniques) 如果至少有一個 ID 未處理： print "Action wasn't able to retrieve detailed information about the following techniques: {0}\n".format(new line separated list of unprocessed techniques) 如果系統未處理任何 ID print "Action wasn't able to find the provided techniques." |
一般 |
取得技術緩解措施
說明
擷取與 MITRE 攻擊技術相關的防範措施資訊。
參數
| 參數 | 類型 | 預設值 | 為必填項目 | 說明 |
|---|---|---|---|---|
| 技術 ID | 字串 | 不適用 | 是 | 指定用於尋找與攻擊技術相關緩解措施的 ID。逗號分隔值。 |
| 攻擊 ID | DDL | 攻擊 ID 選用值： 攻擊名稱、 攻擊 ID、 外部攻擊 ID |
是 | 指定要使用的 ID 類型。可能的值：攻擊名稱 (例如：存取權杖操控)、攻擊 ID (例如：attack-pattern--478aa214-2ca7-4ec0-9978-18798e514790)、外部攻擊 ID (例如：T1050) |
| 要傳回的因應措施數量上限 | 字串 | 20 | 否 | 指定要傳回的緩解措施數量。 |
執行時間
這項操作會對所有實體執行。
動作執行結果
指令碼執行結果
| 指令碼結果名稱 | 價值選項 | 示例 |
|---|---|---|
| is_success | True/False | is_success:False |
JSON 結果
[{
"Entity": "course-of-action--4f170666-7edb-4489-85c2-9affa28a72e0",
"EntityResult": {
"mitigations": [{
"created_by_ref":"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"description":"Identify unnecessary system utilities, third-party tools, or potentially malicious software that may be used to encrypt files, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)",
"created":"2018-10-17T00:14:20.652Z",
"x_mitre_deprecated":true,
"modified":"2019-07-24T14:26:14.411Z",
"object_marking_refs":["marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"],
"external_references":[{"url":"https://attack.mitre.org/mitigations/T1022",
"source_name":"mitre-attack",
"external_id":"T1022"
},{
"url":"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
"source_name":"Beechey 2010",
"description":"Beechey, J. (2010, December). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014."
},{
"url":"http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
"source_name":"Windows Commands JPCERT",
"description":"Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016."
},{
"url":"https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"source_name":"NSA MS AppLocker",
"description":"NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016."
},{
"url":"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"source_name":"Corio 2008",
"description":"Corio, C., & Sayana, D. P. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved November 18, 2014."
},{
"url":"https://technet.microsoft.com/en-us/library/ee791851.aspx",
"source_name":"TechNet Applocker vs SRP",
"description":"Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016."
}],
"x_mitre_version":"1.0",
"type":"course-of-action",
"id":"course-of-action--2a8de25c-f743-4348-b101-3ee33ab5871b",
"name":"Data Encrypted Mitigation"
}]
}
}]
案件總覽
| 結果類型 | 值 / 說明 | 類型 |
|---|---|---|
| 輸出訊息* | 動作不應失敗或停止劇本執行： 如果回應中的「ErrorCode」(is_success=false)，或沒有傳回任何資料 (is_success=true)「動作無法找到下列技術的緩解措施：<identifiers> 如果成功：「Successfully retrieved mitigations for the following techniques: <identifiers>」(已成功擷取下列技術的緩解措施：<identifiers>) 動作應會失敗並停止執行應對手冊： 如果發生嚴重錯誤、SDK 錯誤 (例如憑證錯誤、沒有連線或其他錯誤)：「執行動作『取得技術緩解措施』時發生錯誤。原因：{0}''.format(error.Stacktrace) |
一般 |
乒乓
說明
測試連線。
參數
不適用
執行時間
這項操作會對所有實體執行。
動作執行結果
指令碼執行結果
| 指令碼結果名稱 | 價值選項 | 示例 |
|---|---|---|
| is_success | True/False | is_success:False |
還有其他問題嗎？向社群成員和 Google SecOps 專業人員尋求答案。