☁️
CTHFM: AWS
  • Welcome
  • Getting Started
    • Account Setup
  • AWS CLI
    • AWS CLI Overview
    • Installation
  • AWS Fundamentals
    • AWS Documentation
    • AWS Shared Responsibility Model
    • Organizational Hierarchy
    • AWS Principals
    • IAM Fundamentals
      • IAM Policy Components
      • IAM Documentation References
    • AWS Security Services Overview
    • AWS Core Services
    • AWS Frameworks
    • Regions and Availability Zones
  • SQL
    • SQL Refresher for Threat Hunting
  • Logging Reference
    • Cloudtrail
      • What is Cloudtrail?
      • Setting Up Cloudtrail
      • Cloudtrail Events Structure
      • Filtering and Searching CloudTrail Logs
      • IAM ID Prefixes
      • Additional Resources
      • API References
    • VPCFlow Logs
    • GuardDuty
      • Multi-Account Setup
      • GuardDuty Concepts
      • GuardDuty Finding References
      • S3 Protection
      • Malware Protection
        • EC2 Malware Protection
          • EC2 Protection Resources
          • Monitoring Scans
          • EC2 Malware Protection Events: CloudWatch
        • S3 Malware Protection
          • Enabling S3 Malware Protection
          • After Enabling S3 Malware Protection
          • S3 Malware Resource Plan Status
          • S3 Malware Protection Quotas
      • RDS Protection Enablement
      • Lambda Protection Enablement
      • Trusted IP Lists and Threat Lists in Amazon GuardDuty
      • Remediation Recommendations
      • GuardDuty API Reference
      • GuardDuty Quotas
    • Access Analyzer
      • Setup
      • External Access and Unused Access Analyzer Findings
      • Review Findings
      • Access Analyzer Resources
      • Access Analyzer API Reference
    • AWS Network Firewall
      • Permissions
      • Firewall Log Contents
      • Logging Destinations
      • CloudWatch Firewall Metrics
    • AWS Config
      • Resource Management in AWS Config
      • AWS Config Integrations
      • AWS Config Resources
      • Configuration Item
      • Config Rules
        • Evaluation Modes
  • CloudWatch
    • Amazon CloudWatch
      • CloudWatch Concepts
      • CloudWatch Metrics
        • Filter Pattern Syntax
      • CloudWatch Alarms
        • Alarm Recommendations
      • Subscriptions
      • CloudWatch Agent
      • CloudWatch Insights
        • Supported Logs and Discovered Fields
        • CloudWatch Insights Query Syntax
      • Anomaly Detection
        • Create Anomaly Detector
        • Alarms for Anomaly Detections
      • CloudWatch Filter Syntax
      • CloudWatch Service Quota
  • Athena For Threat Hunting
    • Introduction to Athena
    • Setting Up Athena
    • SQL For Threat Hunters
    • Automated Response
    • Query Best Practices
  • AWS Security Research and Resources
    • AWS Security Blog
    • AWS Goat
    • Cloud Goat
    • Pacu
    • Prowler
    • Scout Suite
  • Threat Hunting in AWS
    • Threat Hunting in AWS
    • Threat Hunting Introduction
    • Threat Hunting Process
      • Hypothesis Generation
      • Investigation
      • Identification
      • Resolution & Follow Up
    • Pyramid of Pain
    • MITRE Att&ck
      • MITRE Att&ck Concepts
      • MITRE Att&CK Data Sources
      • MITRE Att&CK Mitigations
    • MITRE Att&ck: AWS
      • MITRE Att&CK Matrix
      • Amazon Web Services Security Control Mappings
    • AWS Threat Hunting Ideas
      • AWS Threat Hunting Ideas: EC2
      • AWS Threat Hunting Ideas: Lambda
      • AWS Threat Hunting Ideas: SQS
      • AWS Threat Hunting Ideas: SNS
      • AWS Threat Hunting Ideas: RDS
Powered by GitBook
On this page
  • Overview of MITRE ATT&CK Data Sources
  • Data Source List:
  • Data Source Documentation:
  1. Threat Hunting in AWS
  2. MITRE Att&ck

MITRE Att&CK Data Sources

Overview of MITRE ATT&CK Data Sources

The MITRE ATT&CK framework not only categorizes adversary tactics and techniques but also provides valuable insights into the data sources that can be used to detect these activities. These data sources are essential for security professionals to monitor and analyze in order to identify and respond to threats effectively. Below is an overview of the key data sources referenced in the MITRE ATT&CK framework:

Data Source List:

  1. Application Logs:

    • Logs generated by applications which can provide insights into application-specific activities and potential misuse or exploitation.

  2. Authentication Logs:

    • Logs that record authentication events, such as successful and failed login attempts, helping to detect unauthorized access attempts.

  3. Command Execution:

    • Data capturing the execution of commands on systems, which can reveal malicious script execution or command-line activity.

  4. File Monitoring:

    • Data related to the creation, modification, and deletion of files, aiding in the detection of suspicious file activities.

  5. Network Traffic:

    • Monitoring network communications to identify abnormal traffic patterns, potential data exfiltration, and command and control communications.

  6. Process Monitoring:

    • Data capturing the creation and termination of processes, useful for identifying unauthorized or unusual processes running on a system.

  7. Registry:

    • Monitoring registry modifications and access, particularly in Windows environments, to detect persistence mechanisms and configuration changes.

  8. Sensor Health and Status:

    • Information about the status and health of security sensors, ensuring they are functioning correctly and have not been tampered with.

  9. User Account:

    • Data on user account creation, deletion, and modification, which can indicate potential account misuse or compromise.

  10. BIOS:

    • Information from the Basic Input/Output System (BIOS), useful for detecting low-level tampering and persistence mechanisms.

  11. Email Gateway:

    • Data from email gateways can help in identifying phishing attempts and malicious email attachments or links.

  12. Firewall:

    • Logs and alerts from firewalls provide visibility into blocked and allowed traffic, aiding in the detection of unauthorized access attempts.

  13. Host Network Interface:

    • Data from network interfaces on hosts, which can provide insights into local network traffic and potential lateral movement.

  14. Packet Capture:

    • Detailed data from packet captures, enabling deep analysis of network traffic for signs of malicious activity.

  15. Cloud Service:

    • Monitoring and logging data from cloud services, essential for detecting and responding to threats in cloud environments.

  16. DNS:

    • DNS logs can reveal attempts to resolve malicious domains, indicating potential command and control activities.

  17. Web Proxy:

    • Data from web proxies helps in monitoring and controlling web traffic, useful for identifying access to malicious websites.

These data sources form the backbone of a comprehensive monitoring and detection strategy. By leveraging these sources, security professionals can gain a holistic view of their environment, enabling the detection and mitigation of adversarial tactics and techniques as outlined in the MITRE ATT&CK framework.

Data Source Documentation:

PreviousMITRE Att&ck ConceptsNextMITRE Att&CK Mitigations

Last updated 8 months ago

Data Sources | MITRE ATT&CK®
Logo