Skip to content

Commit dc73d7d

Browse files
committed
Cleaned up deprecated components
1 parent 225fefa commit dc73d7d

File tree

120 files changed

+3
-3925
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

120 files changed

+3
-3925
lines changed

README.md

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,12 @@
55

66
Sentinel ATT&CK aims to simplify the rapid deployment of a threat hunting capability that leverages Sysmon and [MITRE ATT&CK](https://attack.mitre.org/) on Azure Sentinel.
77

8-
**DISCLAIMER:** This tool requires tuning and investigative trialling to be truly effective in a production environment.
8+
It provides a [Sysmon log parser](https://github.com/netevert/sentinel-attack/blob/master/Sysmon-OSSEM.txt) mapped against the [OSSEM](https://github.com/OTRF/OSSEM) data model and compatible with the [Sysmon Modular XML configuration file](https://github.com/olafhartong/sysmon-modular/blob/master/sysmonconfig.xml).
99

10-
### Overview
11-
Sentinel ATT&CK provides the following tools:
12-
- A [Sysmon log parser](https://github.com/netevert/sentinel-attack/blob/master/parser/Sysmon-OSSEM.txt) mapped against the [OSSEM](https://github.com/OTRF/OSSEM) data model and compatible with the [Sysmon Modular XML configuration file](https://github.com/olafhartong/sysmon-modular/blob/master/sysmonconfig.xml)
13-
- 117 ready-to-use Kusto [detection rules](https://github.com/netevert/sentinel-attack/tree/master/detections) covering 156 ATT&CK techniques
10+
**DISCLAIMER:** This tool requires tuning and investigative trialling to be truly effective in a production environment.
1411

1512
### Usage
16-
Head over to the [WIKI](https://github.com/netevert/sentinel-attack/wiki) to learn how to deploy and run Sentinel ATT&CK.
13+
To use the Sentinel-ATT&CK parser, copy-paste it into your Sentinel Logs blade and store it as a function named `Sysmon`.
1714

1815
A copy of the DEF CON 27 cloud village presentation introducing Sentinel ATT&CK can be found [here](https://2019.cloud-village.org/#talks?olafedoardo) and [here](https://github.com/netevert/sentinel-attack/blob/master/docs/DEFCON_attacking_the_sentinel.pdf).
1916

File renamed without changes.

detections/T0000_Console_History.txt

Lines changed: 0 additions & 19 deletions
This file was deleted.

detections/T0000_Named_Pipes.txt

Lines changed: 0 additions & 32 deletions
This file was deleted.

detections/T0000_Named_Pipes_CobaltStrike.txt

Lines changed: 0 additions & 17 deletions
This file was deleted.

detections/T0000_Remotely_Query_Login_Sessions_Network.txt

Lines changed: 0 additions & 17 deletions
This file was deleted.

detections/T0000_Remotely_Query_Login_Sessions_Process.txt

Lines changed: 0 additions & 17 deletions
This file was deleted.

detections/T0000_Suspicious_Filename_Used.txt

Lines changed: 0 additions & 53 deletions
This file was deleted.

detections/T1002_Data_Compressed.txt

Lines changed: 0 additions & 20 deletions
This file was deleted.

detections/T1003_Credential_Dumping_ImageLoad.txt

Lines changed: 0 additions & 25 deletions
This file was deleted.

detections/T1003_Credential_Dumping_Process.txt

Lines changed: 0 additions & 21 deletions
This file was deleted.

detections/T1003_Credential_Dumping_Process_Access.txt

Lines changed: 0 additions & 24 deletions
This file was deleted.

detections/T1003_Credential_Dumping_Registry.txt

Lines changed: 0 additions & 22 deletions
This file was deleted.

detections/T1003_Credential_Dumping_Registry_Save.txt

Lines changed: 0 additions & 19 deletions
This file was deleted.

detections/T1004_Win_Logon_Helper_DLL.txt

Lines changed: 0 additions & 20 deletions
This file was deleted.

detections/T1007_System_Service_Discovery.txt

Lines changed: 0 additions & 24 deletions
This file was deleted.

detections/T1012_Query_Registry_Network.txt

Lines changed: 0 additions & 17 deletions
This file was deleted.

0 commit comments

Comments
 (0)