Repository navigation
Missing x-mitre-data-component refs in ICSv20 #78
Description
Some x-mitre-data-component referenced in x_mitre_log_source_references of x-mitre-analytic objects are missing from the ICS json file.
The missing x-mitre-data-component are however present in the Enterprise json file.
In the past, the assumption that a JSON file was standalone hold true. All objects were always present in each file and thus sometimes the same was in multiple matrix files.
Is this assumption wrong or the missing x-mitre-data-component objects are an oversight ?
Example (from mitre/cti as objects are also provided separated):
- A referenced
x-mitre-data-componentadded: https://github.com/mitre/cti/blame/master/ics-attack/x-mitre-analytic/x-mitre-analytic--05ca4f07-df4f-4e88-b216-f40ca6ce39b8.json#L77C18-L77C18 - Not found in ICS (404): https://github.com/mitre/cti/blob/master/ics-attack/x-mitre-data-component/x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6.json
- Present in enterprise: https://github.com/mitre/cti/blob/master/enterprise-attack/x-mitre-data-component/x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6.json
The exact lists:
Missing data-component refs in ICS: 4
x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6
name='Process Access' found_in=enterprise
referenced by 4 analytic log-source(s):
- analytic 'Analytic 1855' (x-mitre-analytic--05ca4f07-df4f-4e88-b216-f40ca6ce39b8) log_source='WinEventLog:Sysmon'
- analytic 'Analytic 1899' (x-mitre-analytic--3e456d4d-397d-4e04-9261-9399960c9633) log_source='WinEventLog:Sysmon'
- analytic 'Analytic 2154' (x-mitre-analytic--33c51048-bfa2-431a-a1d9-40fb60248de4) log_source='auditd:SYSCALL'
- analytic 'Analytic 2279' (x-mitre-analytic--c6a85d88-e62c-4bc2-8210-a8c94705d0f4) log_source='WinEventLog:Sysmon'
x-mitre-data-component--3551476e-14f5-4e48-a518-e82135329e03
name='Driver Load' found_in=enterprise
referenced by 5 analytic log-source(s):
- analytic 'Analytic 1932' (x-mitre-analytic--28eb77c1-1834-4b7a-a06f-afebb7f2e756) log_source='WinEventLog:Sysmon'
- analytic 'Analytic 2272' (x-mitre-analytic--866a9b33-9fd4-4f1a-a44e-dd919f31efc1) log_source='WinEventLog:Sysmon'
- analytic 'Analytic 2269' (x-mitre-analytic--92483574-b54e-403d-a08b-f6e07a77f963) log_source='WinEventLog:Sysmon'
- analytic 'Analytic 2261' (x-mitre-analytic--c1ff324d-8321-49f5-95db-db99c888bb2c) log_source='WinEventLog:Sysmon'
- analytic 'Analytic 2167' (x-mitre-analytic--ee5da023-236b-4c86-b228-9280aa402119) log_source='WinEventLog:Sysmon'
x-mitre-data-component--746f095a-f84c-4ccc-90a5-c7caa5c100a2
name='Firewall Metadata' found_in=enterprise
referenced by 1 analytic log-source(s):
- analytic 'Analytic 2267' (x-mitre-analytic--13d41f06-6c14-4b45-8c66-bc0fdd878419) log_source='WinEventLog:Security'
x-mitre-data-component--d2ff4b56-8351-4ed8-b0fb-d8605366005f
name='Firewall Rule Modification' found_in=enterprise
referenced by 2 analytic log-source(s):
- analytic 'Analytic 2266' (x-mitre-analytic--869e2789-fd07-4bda-8d59-a6fc6c4ee96f) log_source='WinEventLog:Security'
- analytic 'Analytic 2264' (x-mitre-analytic--d6db8902-24b1-4e69-bc3d-78585c78a5d4) log_source='WinEventLog:Security'
Activity