topic Mitre ATT&CK techniques missing in Cortex XDR Discussions

topic Mitre ATT&CK techniques missing in Cortex XDR Discussions https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/mitre-att-amp-ck-techniques-missing/m-p/351138#M332 <P>After reading <A href="https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-release-notes/release-information/features-introduced/features-introduced-in-2020.html#ide2559432-5eb3-4f83-8e85-c4159aeed9ed" target="_blank" rel="noopener">https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-release-notes/release-information/features-introduced/features-introduced-in-2020.html#ide2559432-5eb3-4f83-8e85-c4159aeed9ed</A> → "MITRE Tags Enhancements", I retroactively added the appropriate MITRE ATT&CK technique numbers to my custom BIOC rules and noticed that the following are missing:</P><UL><LI><A href="https://attack.mitre.org/techniques/T1564/005/" target="_blank" rel="noopener">T1564.005 "Hidden File System"</A></LI><LI><A href="https://attack.mitre.org/techniques/T1564/006/" target="_blank" rel="noopener">T1564.006 "Run Virtual Instance"</A></LI></UL><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2020 ∕ 09 ∕ 22 16꞉15꞉16 - BIOC_-_Cortex_XDR_-_Google_Chrome.png" style="width: 328px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/27844i9930D9B4A3C15404/image-size/large/is-moderation-mode/true?v=v2&px=999" role="button" title="2020 ∕ 09 ∕ 22 16꞉15꞉16 - BIOC_-_Cortex_XDR_-_Google_Chrome.png" alt="2020 ∕ 09 ∕ 22 16꞉15꞉16 - BIOC_-_Cortex_XDR_-_Google_Chrome.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2020 ∕ 09 ∕ 22 16꞉15꞉27 - Hide_Artifacts,_Technique_T1564_-_Enterprise__MIT.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/27845i2D6CA8B3BB4DF000/image-size/large/is-moderation-mode/true?v=v2&px=999" role="button" title="2020 ∕ 09 ∕ 22 16꞉15꞉27 - Hide_Artifacts,_Technique_T1564_-_Enterprise__MIT.png" alt="2020 ∕ 09 ∕ 22 16꞉15꞉27 - Hide_Artifacts,_Technique_T1564_-_Enterprise__MIT.png" /></span></P> Tue, 22 Sep 2020 15:21:11 GMT BenHooper 2020-09-22T15:21:11Z Mitre ATT&CK techniques missing https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/mitre-att-amp-ck-techniques-missing/m-p/351138#M332 <P>After reading <A href="https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-release-notes/release-information/features-introduced/features-introduced-in-2020.html#ide2559432-5eb3-4f83-8e85-c4159aeed9ed" target="_blank" rel="noopener">https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-release-notes/release-information/features-introduced/features-introduced-in-2020.html#ide2559432-5eb3-4f83-8e85-c4159aeed9ed</A> → "MITRE Tags Enhancements", I retroactively added the appropriate MITRE ATT&CK technique numbers to my custom BIOC rules and noticed that the following are missing:</P><UL><LI><A href="https://attack.mitre.org/techniques/T1564/005/" target="_blank" rel="noopener">T1564.005 "Hidden File System"</A></LI><LI><A href="https://attack.mitre.org/techniques/T1564/006/" target="_blank" rel="noopener">T1564.006 "Run Virtual Instance"</A></LI></UL><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2020 ∕ 09 ∕ 22 16꞉15꞉16 - BIOC_-_Cortex_XDR_-_Google_Chrome.png" style="width: 328px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/27844i9930D9B4A3C15404/image-size/large/is-moderation-mode/true?v=v2&px=999" role="button" title="2020 ∕ 09 ∕ 22 16꞉15꞉16 - BIOC_-_Cortex_XDR_-_Google_Chrome.png" alt="2020 ∕ 09 ∕ 22 16꞉15꞉16 - BIOC_-_Cortex_XDR_-_Google_Chrome.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2020 ∕ 09 ∕ 22 16꞉15꞉27 - Hide_Artifacts,_Technique_T1564_-_Enterprise__MIT.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/27845i2D6CA8B3BB4DF000/image-size/large/is-moderation-mode/true?v=v2&px=999" role="button" title="2020 ∕ 09 ∕ 22 16꞉15꞉27 - Hide_Artifacts,_Technique_T1564_-_Enterprise__MIT.png" alt="2020 ∕ 09 ∕ 22 16꞉15꞉27 - Hide_Artifacts,_Technique_T1564_-_Enterprise__MIT.png" /></span></P> Tue, 22 Sep 2020 15:21:11 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/mitre-att-amp-ck-techniques-missing/m-p/351138#M332 BenHooper 2020-09-22T15:21:11Z Re: Mitre ATT&CK techniques missing https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/mitre-att-amp-ck-techniques-missing/m-p/366936#M405 <P>Hi BenHooper,</P><P> </P><P>The Cortex XDR console should include those MITRE ATT&CK technique numbers as of version 2.6.5. Could you confirm?</P><P> </P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="gjenkins_0-1606954913707.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/28935i8C0A69DC87ED7F39/image-size/medium/is-moderation-mode/true?v=v2&px=400" role="button" title="gjenkins_0-1606954913707.png" alt="gjenkins_0-1606954913707.png" /></span></P><P> </P> Thu, 03 Dec 2020 00:22:55 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/mitre-att-amp-ck-techniques-missing/m-p/366936#M405 gjenkins 2020-12-03T00:22:55Z