{ "schema_version": "2.0", "updated": "2026-08-21", "boundary": "These are product-neutral engineering packages and validation templates. They are not deployable rules and do not prove that any environment detects the mapped behaviour.", "capability_dimensions": [ { "id": "telemetry", "label": "Telemetry", "question": "Are the necessary events and fields collected with sufficient quality?" }, { "id": "analytic", "label": "Analytic", "question": "Is product-specific logic implemented, versioned and owned?" }, { "id": "validation", "label": "Validation", "question": "Has representative behaviour produced the expected event, match and alert?" }, { "id": "operations", "label": "Operations", "question": "Can an analyst triage, escalate and respond to the alert?" } ], "packages": [ { "id": "HXD-T1059.001-001", "technique_id": "T1059.001", "title": "Suspicious PowerShell execution chain", "status": "validation-ready", "scope": { "platforms": [ "Windows" ], "behaviour": "PowerShell used through direct or indirect invocation with suspicious execution context, followed by network, file or child-process activity.", "not_covered": [ "PowerShell activity with no available process or script context", "In-memory activity invisible to the configured sensors", "Environment-specific administrative behaviour not represented in the validation set" ] }, "hypothesis": "If PowerShell is used for adversary execution, process or script telemetry should expose a combination of abnormal parentage, suspicious arguments or content, and consequential network, file or child-process activity. A binary name alone is not sufficient.", "official_detection": { "strategy_id": "DET0455", "strategy_name": "Abuse of PowerShell for Arbitrary Execution", "url": "https://attack.mitre.org/detectionstrategies/DET0455", "analytic_id": "AN1252", "description": "Detect behavioural chains where PowerShell is launched with encoded commands, unusual parent processes or suspicious modules and is followed by network connections or child-process creation.", "platforms": [ "Windows" ], "log_sources": [ { "component_id": "DC0032", "component": "Process Creation", "source": "WinEventLog:Sysmon", "channel": "EventCode=1" }, { "component_id": "DC0064", "component": "Command Execution", "source": "WinEventLog:PowerShell", "channel": "EventCode=4103, 4104, 4105, 4106" }, { "component_id": "DC0034", "component": "Process Metadata", "source": "WinEventLog:PowerShell", "channel": "EventCode=400, 403" }, { "component_id": "DC0016", "component": "Module Load", "source": "WinEventLog:Sysmon", "channel": "EventCode=7" } ], "mutable_elements": [ "Command-line patterns", "Parent process allowlists", "Time window", "Loaded modules", "Script-block length threshold" ] }, "data_requirements": [ { "source": "Process creation", "acceptable_sensors": [ "EDR process telemetry", "Sysmon Event ID 1", "Windows Security Event ID 4688 with command-line auditing" ], "required_fields": [ "event time with timezone", "host identifier", "user or security principal", "process image", "complete command line", "parent image and process identifier", "process identifier" ], "quality_checks": [ "Command line is populated and not truncated", "Parent identifiers correlate reliably", "Host clocks are synchronised", "Coverage and ingestion delay are measured" ] }, { "source": "PowerShell operational logging", "acceptable_sensors": [ "PowerShell Script Block Logging 4104", "PowerShell Module Logging 4103", "AMSI or equivalent content telemetry" ], "required_fields": [ "script or command content", "script-block or operation identifier", "host", "user", "event time", "engine or host application" ], "quality_checks": [ "Logging policy is enabled on in-scope hosts", "Multi-part script blocks can be reconstructed", "Protected or sensitive content handling is documented", "Retention supports the investigation window" ] }, { "source": "Consequential activity", "acceptable_sensors": [ "EDR network and file events", "DNS or proxy telemetry", "Child-process telemetry" ], "required_fields": [ "initiating process identifier", "destination or created object", "event time", "host", "result or action" ], "quality_checks": [ "Events can be correlated to the initiating process", "Network address translation or proxy identity is preserved", "File hashes are captured where supported" ] } ], "analytic_logic": { "required": [ "PowerShell execution or PowerShell-hosted script content", "User, host and parent-process context" ], "elevating_context": [ "Office, browser, archive utility, script host or service process as parent", "Encoded, hidden or obfuscated arguments", "Download, child-process, file-write or external-network activity", "Execution by an unusual user, host role or time window", "Rare PowerShell module or automation assembly use" ], "lowering_context": [ "Documented management or deployment tool", "Signed and version-controlled administrative script", "Expected account, host population and maintenance window", "Reproducible approved change record" ], "decision": "Require a behavioural combination appropriate to the environment. Do not alert solely because powershell.exe or pwsh.exe executed. Preserve individual signals for hunting even when the alert threshold is not met." }, "benign_baseline": [ "Endpoint management and software deployment", "Administrator and help-desk automation", "Security product response actions", "Build and configuration-management jobs", "Developer automation on approved systems" ], "known_blind_spots": [ "PowerShell hosted through System.Management.Automation without process-name indicators", "Disabled, bypassed or truncated script logging", "Process telemetry without complete command lines", "Short-lived processes lost during sensor or ingestion outages", "Approved tools abused from otherwise expected parent processes" ], "safe_validation_cases": [ { "id": "HX-PS-01", "class": "positive", "title": "Encoded benign command with suspicious parent simulation", "procedure": "In an isolated validation host, use the organisation's approved test harness to launch a harmless encoded Write-Output command through the process ancestry the analytic intends to recognise.", "expected": [ "Process event contains complete encoded arguments", "Parent-child relationship is preserved", "Analytic matches", "Alert contains host, user, parent and command context" ] }, { "id": "HX-PS-02", "class": "positive", "title": "Script block followed by harmless network test", "procedure": "Execute an approved script that writes a unique marker and performs a request to an organisation-controlled test endpoint.", "expected": [ "Script content is recorded", "Network activity correlates to the process", "Compound analytic or investigation view joins both events" ] }, { "id": "HX-PS-03", "class": "negative", "title": "Approved administration baseline", "procedure": "Run a representative signed administrative script using the normal management account, parent process and maintenance window.", "expected": [ "Telemetry remains searchable", "Production alert is suppressed or correctly classified", "Suppression depends on documented context rather than a broad process exclusion" ] }, { "id": "HX-PS-04", "class": "resilience", "title": "Indirect PowerShell hosting", "procedure": "Use an approved test harness that invokes a harmless PowerShell automation operation without relying on the powershell.exe filename.", "expected": [ "Content or module telemetry remains visible", "Documented blind spot is confirmed if the analytic cannot observe it" ] } ], "acceptance_criteria": [ "All required fields are present on at least 95% of in-scope hosts during the test window", "Each positive case produces the expected event and analytic match", "The negative case remains available for hunting without generating an unjustified high-severity alert", "Alert includes enough context for first-line triage without a second console", "Runbook owner acknowledges and completes the test alert", "Known failures are recorded as gaps rather than counted as coverage" ], "triage": [ "Confirm the complete command or script and preserve the original encoding", "Establish parent, user, host role, logon session and execution origin", "Correlate network, file and child-process activity", "Compare against signed scripts, management tooling and change records", "Scope the same content, destination and parent chain across hosts", "Escalate based on the complete behaviour chain and affected identity, not the interpreter name" ], "response": [ "Preserve process, script, network and identity evidence before remediation", "Contain the host when the wider execution chain supports malicious activity", "Protect credentials or sessions exposed to the affected host", "Block confirmed infrastructure or payloads using evidence-backed indicators", "Feed validated benign and malicious examples back into regression tests" ], "lifecycle": { "package_owner": "HECAVEX", "package_status": "validation-ready reference", "created": "2026-08-20", "last_reviewed": "2026-08-20", "review_due": "2026-11-20", "attack_version": "19.2", "technique_version": "1.5", "change_policy": "Review after material ATT&CK changes, telemetry changes, analytic changes or failed regression tests." }, "references": [ { "title": "MITRE ATT&CK T1059.001 PowerShell", "url": "https://attack.mitre.org/techniques/T1059/001/" }, { "title": "MITRE ATT&CK DET0455", "url": "https://attack.mitre.org/detectionstrategies/DET0455" }, { "title": "Microsoft PowerShell logging documentation", "url": "https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_logging_windows" }, { "title": "Sigma rule specification", "url": "https://github.com/SigmaHQ/sigma-specification/blob/main/specification/sigma-rules-specification.md" } ] }, { "id": "HXD-T1003.001-CANDIDATE", "technique_id": "T1003.001", "title": "LSASS Memory detection engineering candidate", "status": "engineering-candidate", "starter": true, "scope": { "platforms": [ "Windows" ], "behaviour": "Use when a process accesses or dumps LSASS memory to obtain credentials. Process access alone may be ambiguous; access rights, signer, lineage, dump creation and subsequent credential use matter.", "not_covered": [ "A deployable product query", "Proof that the required telemetry exists locally", "Validation against the organisation's benign baseline" ] }, "hypothesis": "Use when a process accesses or dumps LSASS memory to obtain credentials. Process access alone may be ambiguous; access rights, signer, lineage, dump creation and subsequent credential use matter.", "official_detection": { "strategy_id": "DET0363", "strategy_name": "Detection of Credential Dumping from LSASS Memory via Access and Dump Sequence", "url": "https://attack.mitre.org/detectionstrategies/DET0363", "analytic_id": "Local analytic design required", "description": "Use the official ATT&CK detection relationship as source context, then translate the behaviour and evidence requirements into the local event model.", "platforms": [ "Windows" ], "log_sources": [ { "component_id": "LOCAL-01", "component": "Telemetry requirement 1", "source": "EDR process-access telemetry", "channel": "Map to local schema" }, { "component_id": "LOCAL-02", "component": "Telemetry requirement 2", "source": "Sysmon process access and file creation", "channel": "Map to local schema" }, { "component_id": "LOCAL-03", "component": "Telemetry requirement 3", "source": "Windows security and authentication events", "channel": "Map to local schema" }, { "component_id": "LOCAL-04", "component": "Telemetry requirement 4", "source": "Credential-protection control events", "channel": "Map to local schema" } ], "mutable_elements": [ "Event schema and field names", "Correlation window", "Environment baseline", "Severity and suppression policy" ] }, "data_requirements": [ { "source": "Primary behaviour telemetry", "acceptable_sensors": [ "EDR process-access telemetry" ], "required_fields": [ "Source process and target LSASS process", "Dump-file creation or credential-use evidence" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Identity and execution context", "acceptable_sensors": [ "Sysmon process access and file creation" ], "required_fields": [ "Requested access rights or memory-read evidence" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Corroborating outcome telemetry", "acceptable_sensors": [ "Windows security and authentication events" ], "required_fields": [ "Process signer, hash, path and lineage" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] } ], "analytic_logic": { "required": [ "Source process and target LSASS process", "Requested access rights or memory-read evidence", "Process signer, hash, path and lineage", "Dump-file creation or credential-use evidence" ], "elevating_context": [ "Validate signer and expected product behaviour", "Search for dump files and archive creation", "Trace subsequent logons from affected accounts", "Inspect privilege escalation before LSASS access" ], "lowering_context": [ "Security and diagnostic products", "Crash dump and support tooling", "Approved credential-protection testing" ], "decision": "Require the smallest defensible combination that separates the adversary-relevant claim from documented benign overlap. Keep weaker signals available for hunting." }, "benign_baseline": [ "Security and diagnostic products", "Crash dump and support tooling", "Approved credential-protection testing" ], "known_blind_spots": [ "Required events or join fields are unavailable", "A vendor field is assumed equivalent without schema validation", "Testing covers only one positive path" ], "safe_validation_cases": [ { "id": "T1003001-P01", "class": "positive", "title": "Representative approved behaviour", "procedure": "Use an isolated test system or approved simulation to reproduce the smallest harmless behaviour satisfying the hypothesis.", "expected": [ "Required events and fields are present", "The intended relationships survive ingestion", "The result contains enough context for triage" ] }, { "id": "T1003001-N01", "class": "negative", "title": "Documented benign overlap", "procedure": "Exercise or replay a representative benign case such as: Security and diagnostic products.", "expected": [ "Telemetry remains available for hunting", "The analytic does not create unjustified severity", "Any suppression is narrow and documented" ] }, { "id": "T1003001-R01", "class": "resilience", "title": "Missing or degraded context", "procedure": "Repeat validation with one required field or related event unavailable.", "expected": [ "The failure mode is visible", "The result does not silently become confirmed coverage", "The gap receives an owner" ] } ], "acceptance_criteria": [ "Required telemetry and fields are measured in the intended scope", "Positive and benign cases behave as expected", "An analyst can explain the result", "Ownership, review date and response path are recorded" ], "triage": [ "Validate signer and expected product behaviour", "Search for dump files and archive creation", "Trace subsequent logons from affected accounts", "Inspect privilege escalation before LSASS access" ], "response": [ "Isolate the host when malicious access is supported", "Reset or protect credentials exposed on the system", "Preserve volatile and authentication evidence" ], "lifecycle": { "package_owner": "Local detection team", "package_status": "engineering candidate", "created": "2026-08-20", "last_reviewed": "Not independently reviewed", "review_due": "Set during local implementation", "attack_version": "19.2", "technique_version": "1.5", "change_policy": "Review after ATT&CK, telemetry, analytic or validation changes." }, "references": [ { "title": "MITRE ATT&CK T1003.001 LSASS Memory", "url": "https://attack.mitre.org/techniques/T1003/001" }, { "title": "MITRE ATT&CK DET0363 Detection of Credential Dumping from LSASS Memory via Access and Dump Sequence", "url": "https://attack.mitre.org/detectionstrategies/DET0363" } ] }, { "id": "HXD-T1027-CANDIDATE", "technique_id": "T1027", "title": "Obfuscated Files or Information detection engineering candidate", "status": "engineering-candidate", "starter": true, "scope": { "platforms": [ "ESXi", "Linux", "Network Devices", "Windows", "macOS" ], "behaviour": "Use when content is intentionally transformed to hinder inspection or detection. Encoding or compression alone is common; document the transformation, execution context and adversary-relevant purpose.", "not_covered": [ "A deployable product query", "Proof that the required telemetry exists locally", "Validation against the organisation's benign baseline" ] }, "hypothesis": "Use when content is intentionally transformed to hinder inspection or detection. Encoding or compression alone is common; document the transformation, execution context and adversary-relevant purpose.", "official_detection": { "strategy_id": "DET0378", "strategy_name": "Behavioral Detection of Obfuscated Files or Information", "url": "https://attack.mitre.org/detectionstrategies/DET0378", "analytic_id": "Local analytic design required", "description": "Use the official ATT&CK detection relationship as source context, then translate the behaviour and evidence requirements into the local event model.", "platforms": [ "ESXi", "Linux", "Network Devices", "Windows", "macOS" ], "log_sources": [ { "component_id": "LOCAL-01", "component": "Telemetry requirement 1", "source": "Static file and script analysis metadata", "channel": "Map to local schema" }, { "component_id": "LOCAL-02", "component": "Telemetry requirement 2", "source": "Endpoint process, module and memory telemetry", "channel": "Map to local schema" }, { "component_id": "LOCAL-03", "component": "Telemetry requirement 3", "source": "Mail, proxy or sandbox content inspection", "channel": "Map to local schema" } ], "mutable_elements": [ "Event schema and field names", "Correlation window", "Environment baseline", "Severity and suppression policy" ] }, "data_requirements": [ { "source": "Primary behaviour telemetry", "acceptable_sensors": [ "Static file and script analysis metadata" ], "required_fields": [ "Original bytes or content and cryptographic hash", "Recovered or partially recovered content where safe" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Identity and execution context", "acceptable_sensors": [ "Endpoint process, module and memory telemetry" ], "required_fields": [ "Observed encoding, packing or transformation" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Corroborating outcome telemetry", "acceptable_sensors": [ "Mail, proxy or sandbox content inspection" ], "required_fields": [ "Process or script responsible for handling the content" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] } ], "analytic_logic": { "required": [ "Original bytes or content and cryptographic hash", "Observed encoding, packing or transformation", "Process or script responsible for handling the content", "Recovered or partially recovered content where safe" ], "elevating_context": [ "Cluster on packer, decoder and stable code features", "Compare entropy and section metadata with benign software", "Search decoded configuration and infrastructure", "Track the process that writes or executes recovered content" ], "lowering_context": [ "Signed software packing and installers", "Minified web content", "Normal archive, encryption and data-protection workflows" ], "decision": "Require the smallest defensible combination that separates the adversary-relevant claim from documented benign overlap. Keep weaker signals available for hunting." }, "benign_baseline": [ "Signed software packing and installers", "Minified web content", "Normal archive, encryption and data-protection workflows" ], "known_blind_spots": [ "Required events or join fields are unavailable", "A vendor field is assumed equivalent without schema validation", "Testing covers only one positive path" ], "safe_validation_cases": [ { "id": "T1027-P01", "class": "positive", "title": "Representative approved behaviour", "procedure": "Use an isolated test system or approved simulation to reproduce the smallest harmless behaviour satisfying the hypothesis.", "expected": [ "Required events and fields are present", "The intended relationships survive ingestion", "The result contains enough context for triage" ] }, { "id": "T1027-N01", "class": "negative", "title": "Documented benign overlap", "procedure": "Exercise or replay a representative benign case such as: Signed software packing and installers.", "expected": [ "Telemetry remains available for hunting", "The analytic does not create unjustified severity", "Any suppression is narrow and documented" ] }, { "id": "T1027-R01", "class": "resilience", "title": "Missing or degraded context", "procedure": "Repeat validation with one required field or related event unavailable.", "expected": [ "The failure mode is visible", "The result does not silently become confirmed coverage", "The gap receives an owner" ] } ], "acceptance_criteria": [ "Required telemetry and fields are measured in the intended scope", "Positive and benign cases behave as expected", "An analyst can explain the result", "Ownership, review date and response path are recorded" ], "triage": [ "Cluster on packer, decoder and stable code features", "Compare entropy and section metadata with benign software", "Search decoded configuration and infrastructure", "Track the process that writes or executes recovered content" ], "response": [ "Preserve original and decoded artefacts separately", "Do not upload sensitive samples to public services without approval", "Feed stable recovered features into hunting and validation" ], "lifecycle": { "package_owner": "Local detection team", "package_status": "engineering candidate", "created": "2026-08-20", "last_reviewed": "Not independently reviewed", "review_due": "Set during local implementation", "attack_version": "19.2", "technique_version": "2.0", "change_policy": "Review after ATT&CK, telemetry, analytic or validation changes." }, "references": [ { "title": "MITRE ATT&CK T1027 Obfuscated Files or Information", "url": "https://attack.mitre.org/techniques/T1027" }, { "title": "MITRE ATT&CK DET0378 Behavioral Detection of Obfuscated Files or Information", "url": "https://attack.mitre.org/detectionstrategies/DET0378" } ] }, { "id": "HXD-T1053.005-CANDIDATE", "technique_id": "T1053.005", "title": "Scheduled Task detection engineering candidate", "status": "engineering-candidate", "starter": true, "scope": { "platforms": [ "Windows" ], "behaviour": "Use when Windows Task Scheduler is used to execute a program at a configured time or condition. The same mechanism is heavily used by operating-system and enterprise software.", "not_covered": [ "A deployable product query", "Proof that the required telemetry exists locally", "Validation against the organisation's benign baseline" ] }, "hypothesis": "Use when Windows Task Scheduler is used to execute a program at a configured time or condition. The same mechanism is heavily used by operating-system and enterprise software.", "official_detection": { "strategy_id": "DET0441", "strategy_name": "Detection of Suspicious Scheduled Task Creation and Execution on Windows", "url": "https://attack.mitre.org/detectionstrategies/DET0441", "analytic_id": "Local analytic design required", "description": "Use the official ATT&CK detection relationship as source context, then translate the behaviour and evidence requirements into the local event model.", "platforms": [ "Windows" ], "log_sources": [ { "component_id": "LOCAL-01", "component": "Telemetry requirement 1", "source": "Task Scheduler operational log", "channel": "Map to local schema" }, { "component_id": "LOCAL-02", "component": "Telemetry requirement 2", "source": "Windows security task events", "channel": "Map to local schema" }, { "component_id": "LOCAL-03", "component": "Telemetry requirement 3", "source": "EDR registry, file and process events", "channel": "Map to local schema" }, { "component_id": "LOCAL-04", "component": "Telemetry requirement 4", "source": "Task XML from the affected host", "channel": "Map to local schema" } ], "mutable_elements": [ "Event schema and field names", "Correlation window", "Environment baseline", "Severity and suppression policy" ] }, "data_requirements": [ { "source": "Primary behaviour telemetry", "acceptable_sensors": [ "Task Scheduler operational log" ], "required_fields": [ "Task name, definition and creation/change time", "Process or audit event that created the task" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Identity and execution context", "acceptable_sensors": [ "Windows security task events" ], "required_fields": [ "Author, account and execution principal" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Corroborating outcome telemetry", "acceptable_sensors": [ "EDR registry, file and process events" ], "required_fields": [ "Action, arguments, trigger and working directory" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] } ], "analytic_logic": { "required": [ "Task name, definition and creation/change time", "Author, account and execution principal", "Action, arguments, trigger and working directory", "Process or audit event that created the task" ], "elevating_context": [ "Compare task definition with known-good systems", "Trace the creating process and account", "Inspect referenced binaries and scripts", "Search for the same task across endpoints" ], "lowering_context": [ "Operating-system maintenance", "Software updates and management agents", "Enterprise automation" ], "decision": "Require the smallest defensible combination that separates the adversary-relevant claim from documented benign overlap. Keep weaker signals available for hunting." }, "benign_baseline": [ "Operating-system maintenance", "Software updates and management agents", "Enterprise automation" ], "known_blind_spots": [ "Required events or join fields are unavailable", "A vendor field is assumed equivalent without schema validation", "Testing covers only one positive path" ], "safe_validation_cases": [ { "id": "T1053005-P01", "class": "positive", "title": "Representative approved behaviour", "procedure": "Use an isolated test system or approved simulation to reproduce the smallest harmless behaviour satisfying the hypothesis.", "expected": [ "Required events and fields are present", "The intended relationships survive ingestion", "The result contains enough context for triage" ] }, { "id": "T1053005-N01", "class": "negative", "title": "Documented benign overlap", "procedure": "Exercise or replay a representative benign case such as: Operating-system maintenance.", "expected": [ "Telemetry remains available for hunting", "The analytic does not create unjustified severity", "Any suppression is narrow and documented" ] }, { "id": "T1053005-R01", "class": "resilience", "title": "Missing or degraded context", "procedure": "Repeat validation with one required field or related event unavailable.", "expected": [ "The failure mode is visible", "The result does not silently become confirmed coverage", "The gap receives an owner" ] } ], "acceptance_criteria": [ "Required telemetry and fields are measured in the intended scope", "Positive and benign cases behave as expected", "An analyst can explain the result", "Ownership, review date and response path are recorded" ], "triage": [ "Compare task definition with known-good systems", "Trace the creating process and account", "Inspect referenced binaries and scripts", "Search for the same task across endpoints" ], "response": [ "Preserve the task XML before removal", "Disable malicious tasks and isolate referenced payloads", "Investigate the account and creation path" ], "lifecycle": { "package_owner": "Local detection team", "package_status": "engineering candidate", "created": "2026-08-20", "last_reviewed": "Not independently reviewed", "review_due": "Set during local implementation", "attack_version": "19.2", "technique_version": "1.8", "change_policy": "Review after ATT&CK, telemetry, analytic or validation changes." }, "references": [ { "title": "MITRE ATT&CK T1053.005 Scheduled Task", "url": "https://attack.mitre.org/techniques/T1053/005" }, { "title": "MITRE ATT&CK DET0441 Detection of Suspicious Scheduled Task Creation and Execution on Windows", "url": "https://attack.mitre.org/detectionstrategies/DET0441" } ] }, { "id": "HXD-T1056.003-CANDIDATE", "technique_id": "T1056.003", "title": "Web Portal Capture detection engineering candidate", "status": "engineering-candidate", "starter": true, "scope": { "platforms": [ "Linux", "Windows", "macOS" ], "behaviour": "Use when a web portal is designed to capture information entered by a victim. Visual similarity alone is insufficient; preserve form behaviour or collection endpoints when safely possible.", "not_covered": [ "A deployable product query", "Proof that the required telemetry exists locally", "Validation against the organisation's benign baseline" ] }, "hypothesis": "Use when a web portal is designed to capture information entered by a victim. Visual similarity alone is insufficient; preserve form behaviour or collection endpoints when safely possible.", "official_detection": { "strategy_id": "DET0480", "strategy_name": "Detection of Credential Harvesting via Web Portal Modification", "url": "https://attack.mitre.org/detectionstrategies/DET0480", "analytic_id": "Local analytic design required", "description": "Use the official ATT&CK detection relationship as source context, then translate the behaviour and evidence requirements into the local event model.", "platforms": [ "Linux", "Windows", "macOS" ], "log_sources": [ { "component_id": "LOCAL-01", "component": "Telemetry requirement 1", "source": "Browser developer/network capture from an isolated environment", "channel": "Map to local schema" }, { "component_id": "LOCAL-02", "component": "Telemetry requirement 2", "source": "Web proxy and DNS events", "channel": "Map to local schema" }, { "component_id": "LOCAL-03", "component": "Telemetry requirement 3", "source": "Identity sign-in and risk events", "channel": "Map to local schema" }, { "component_id": "LOCAL-04", "component": "Telemetry requirement 4", "source": "Reported message and URL artefacts", "channel": "Map to local schema" } ], "mutable_elements": [ "Event schema and field names", "Correlation window", "Environment baseline", "Severity and suppression policy" ] }, "data_requirements": [ { "source": "Primary behaviour telemetry", "acceptable_sensors": [ "Browser developer/network capture from an isolated environment" ], "required_fields": [ "Page capture and timestamp", "Evidence of user interaction, if available" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Identity and execution context", "acceptable_sensors": [ "Web proxy and DNS events" ], "required_fields": [ "Form action, script handler or network destination" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Corroborating outcome telemetry", "acceptable_sensors": [ "Identity sign-in and risk events" ], "required_fields": [ "Brand impersonated and fields requested" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] } ], "analytic_logic": { "required": [ "Page capture and timestamp", "Form action, script handler or network destination", "Brand impersonated and fields requested", "Evidence of user interaction, if available" ], "elevating_context": [ "Compare form endpoints and JavaScript across related hosts", "Search reused favicons, page titles and kits", "Correlate entered account with subsequent sign-ins and session creation", "Inspect registrar, hosting and certificate relationships" ], "lowering_context": [ "Legitimate federated login pages", "Reverse proxies and SSO portals", "Security-training replicas" ], "decision": "Require the smallest defensible combination that separates the adversary-relevant claim from documented benign overlap. Keep weaker signals available for hunting." }, "benign_baseline": [ "Legitimate federated login pages", "Reverse proxies and SSO portals", "Security-training replicas" ], "known_blind_spots": [ "Required events or join fields are unavailable", "A vendor field is assumed equivalent without schema validation", "Testing covers only one positive path" ], "safe_validation_cases": [ { "id": "T1056003-P01", "class": "positive", "title": "Representative approved behaviour", "procedure": "Use an isolated test system or approved simulation to reproduce the smallest harmless behaviour satisfying the hypothesis.", "expected": [ "Required events and fields are present", "The intended relationships survive ingestion", "The result contains enough context for triage" ] }, { "id": "T1056003-N01", "class": "negative", "title": "Documented benign overlap", "procedure": "Exercise or replay a representative benign case such as: Legitimate federated login pages.", "expected": [ "Telemetry remains available for hunting", "The analytic does not create unjustified severity", "Any suppression is narrow and documented" ] }, { "id": "T1056003-R01", "class": "resilience", "title": "Missing or degraded context", "procedure": "Repeat validation with one required field or related event unavailable.", "expected": [ "The failure mode is visible", "The result does not silently become confirmed coverage", "The gap receives an owner" ] } ], "acceptance_criteria": [ "Required telemetry and fields are measured in the intended scope", "Positive and benign cases behave as expected", "An analyst can explain the result", "Ownership, review date and response path are recorded" ], "triage": [ "Compare form endpoints and JavaScript across related hosts", "Search reused favicons, page titles and kits", "Correlate entered account with subsequent sign-ins and session creation", "Inspect registrar, hosting and certificate relationships" ], "response": [ "Treat submitted credentials and active sessions as exposed", "Preserve the portal and network evidence without contaminating operator data", "Report and block infrastructure using evidence-backed indicators" ], "lifecycle": { "package_owner": "Local detection team", "package_status": "engineering candidate", "created": "2026-08-20", "last_reviewed": "Not independently reviewed", "review_due": "Set during local implementation", "attack_version": "19.2", "technique_version": "1.1", "change_policy": "Review after ATT&CK, telemetry, analytic or validation changes." }, "references": [ { "title": "MITRE ATT&CK T1056.003 Web Portal Capture", "url": "https://attack.mitre.org/techniques/T1056/003" }, { "title": "MITRE ATT&CK DET0480 Detection of Credential Harvesting via Web Portal Modification", "url": "https://attack.mitre.org/detectionstrategies/DET0480" } ] }, { "id": "HXD-T1059.003-CANDIDATE", "technique_id": "T1059.003", "title": "Windows Command Shell detection engineering candidate", "status": "engineering-candidate", "starter": true, "scope": { "platforms": [ "Windows" ], "behaviour": "Use when the Windows command shell executes adversary-relevant commands. cmd.exe is common infrastructure; parentage, command content, identity and consequences determine significance.", "not_covered": [ "A deployable product query", "Proof that the required telemetry exists locally", "Validation against the organisation's benign baseline" ] }, "hypothesis": "Use when the Windows command shell executes adversary-relevant commands. cmd.exe is common infrastructure; parentage, command content, identity and consequences determine significance.", "official_detection": { "strategy_id": "DET0202", "strategy_name": "Behavioral Detection of Windows Command Shell Execution", "url": "https://attack.mitre.org/detectionstrategies/DET0202", "analytic_id": "Local analytic design required", "description": "Use the official ATT&CK detection relationship as source context, then translate the behaviour and evidence requirements into the local event model.", "platforms": [ "Windows" ], "log_sources": [ { "component_id": "LOCAL-01", "component": "Telemetry requirement 1", "source": "EDR, Sysmon or Security process creation with command lines", "channel": "Map to local schema" }, { "component_id": "LOCAL-02", "component": "Telemetry requirement 2", "source": "Script, file, registry and service modification events", "channel": "Map to local schema" }, { "component_id": "LOCAL-03", "component": "Telemetry requirement 3", "source": "DNS, proxy and endpoint network connections", "channel": "Map to local schema" } ], "mutable_elements": [ "Event schema and field names", "Correlation window", "Environment baseline", "Severity and suppression policy" ] }, "data_requirements": [ { "source": "Primary behaviour telemetry", "acceptable_sensors": [ "EDR, Sysmon or Security process creation with command lines" ], "required_fields": [ "Complete command line", "Correlated file, service, registry or network consequences" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Identity and execution context", "acceptable_sensors": [ "Script, file, registry and service modification events" ], "required_fields": [ "Parent and child process identifiers" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Corroborating outcome telemetry", "acceptable_sensors": [ "DNS, proxy and endpoint network connections" ], "required_fields": [ "User, host and logon context" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] } ], "analytic_logic": { "required": [ "Complete command line", "Parent and child process identifiers", "User, host and logon context", "Correlated file, service, registry or network consequences" ], "elevating_context": [ "Decode quoting, environment variables and chained commands", "Trace the complete ancestry and child tree", "Scope rare commands and parent combinations", "Correlate the same user and logon session across hosts" ], "lowering_context": [ "Logon scripts and software installers", "IT administration and troubleshooting", "Build agents and scheduled maintenance" ], "decision": "Require the smallest defensible combination that separates the adversary-relevant claim from documented benign overlap. Keep weaker signals available for hunting." }, "benign_baseline": [ "Logon scripts and software installers", "IT administration and troubleshooting", "Build agents and scheduled maintenance" ], "known_blind_spots": [ "Required events or join fields are unavailable", "A vendor field is assumed equivalent without schema validation", "Testing covers only one positive path" ], "safe_validation_cases": [ { "id": "T1059003-P01", "class": "positive", "title": "Representative approved behaviour", "procedure": "Use an isolated test system or approved simulation to reproduce the smallest harmless behaviour satisfying the hypothesis.", "expected": [ "Required events and fields are present", "The intended relationships survive ingestion", "The result contains enough context for triage" ] }, { "id": "T1059003-N01", "class": "negative", "title": "Documented benign overlap", "procedure": "Exercise or replay a representative benign case such as: Logon scripts and software installers.", "expected": [ "Telemetry remains available for hunting", "The analytic does not create unjustified severity", "Any suppression is narrow and documented" ] }, { "id": "T1059003-R01", "class": "resilience", "title": "Missing or degraded context", "procedure": "Repeat validation with one required field or related event unavailable.", "expected": [ "The failure mode is visible", "The result does not silently become confirmed coverage", "The gap receives an owner" ] } ], "acceptance_criteria": [ "Required telemetry and fields are measured in the intended scope", "Positive and benign cases behave as expected", "An analyst can explain the result", "Ownership, review date and response path are recorded" ], "triage": [ "Decode quoting, environment variables and chained commands", "Trace the complete ancestry and child tree", "Scope rare commands and parent combinations", "Correlate the same user and logon session across hosts" ], "response": [ "Preserve complete process lineage", "Contain when command intent and consequences support malicious execution", "Turn validated benign chains into narrow regression cases" ], "lifecycle": { "package_owner": "Local detection team", "package_status": "engineering candidate", "created": "2026-08-20", "last_reviewed": "Not independently reviewed", "review_due": "Set during local implementation", "attack_version": "19.2", "technique_version": "1.5", "change_policy": "Review after ATT&CK, telemetry, analytic or validation changes." }, "references": [ { "title": "MITRE ATT&CK T1059.003 Windows Command Shell", "url": "https://attack.mitre.org/techniques/T1059/003" }, { "title": "MITRE ATT&CK DET0202 Behavioral Detection of Windows Command Shell Execution", "url": "https://attack.mitre.org/detectionstrategies/DET0202" } ] }, { "id": "HXD-T1078-CANDIDATE", "technique_id": "T1078", "title": "Valid Accounts detection engineering candidate", "status": "engineering-candidate", "starter": true, "scope": { "platforms": [ "Containers", "ESXi", "IaaS", "Identity Provider", "Linux", "Network Devices", "Office Suite", "SaaS", "Windows", "macOS" ], "behaviour": "Use when an adversary authenticates with legitimate credentials or an existing account. A successful login is not enough; establish why the use is inconsistent with the account owner or authorised automation.", "not_covered": [ "A deployable product query", "Proof that the required telemetry exists locally", "Validation against the organisation's benign baseline" ] }, "hypothesis": "Use when an adversary authenticates with legitimate credentials or an existing account. A successful login is not enough; establish why the use is inconsistent with the account owner or authorised automation.", "official_detection": { "strategy_id": "DET0560", "strategy_name": "Detection of Valid Account Abuse Across Platforms", "url": "https://attack.mitre.org/detectionstrategies/DET0560", "analytic_id": "Local analytic design required", "description": "Use the official ATT&CK detection relationship as source context, then translate the behaviour and evidence requirements into the local event model.", "platforms": [ "Containers", "ESXi", "IaaS", "Identity Provider", "Linux", "Network Devices", "Office Suite", "SaaS", "Windows", "macOS" ], "log_sources": [ { "component_id": "LOCAL-01", "component": "Telemetry requirement 1", "source": "Identity-provider and application sign-ins", "channel": "Map to local schema" }, { "component_id": "LOCAL-02", "component": "Telemetry requirement 2", "source": "VPN, remote access and endpoint logons", "channel": "Map to local schema" }, { "component_id": "LOCAL-03", "component": "Telemetry requirement 3", "source": "Device compliance and risk telemetry", "channel": "Map to local schema" }, { "component_id": "LOCAL-04", "component": "Telemetry requirement 4", "source": "Post-authentication resource access", "channel": "Map to local schema" } ], "mutable_elements": [ "Event schema and field names", "Correlation window", "Environment baseline", "Severity and suppression policy" ] }, "data_requirements": [ { "source": "Primary behaviour telemetry", "acceptable_sensors": [ "Identity-provider and application sign-ins" ], "required_fields": [ "Account and authentication result", "Behaviour inconsistent with the legitimate user or workload" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Identity and execution context", "acceptable_sensors": [ "VPN, remote access and endpoint logons" ], "required_fields": [ "Source, device, application and timestamp" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Corroborating outcome telemetry", "acceptable_sensors": [ "Device compliance and risk telemetry" ], "required_fields": [ "Authentication method and session/token context" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] } ], "analytic_logic": { "required": [ "Account and authentication result", "Source, device, application and timestamp", "Authentication method and session/token context", "Behaviour inconsistent with the legitimate user or workload" ], "elevating_context": [ "Build an account timeline before and after access", "Compare device, source and authentication method", "Trace mailbox, file, directory and administrative activity", "Find other accounts from the same source or device" ], "lowering_context": [ "Travel and VPN egress changes", "Shared or service accounts", "New managed devices and automation" ], "decision": "Require the smallest defensible combination that separates the adversary-relevant claim from documented benign overlap. Keep weaker signals available for hunting." }, "benign_baseline": [ "Travel and VPN egress changes", "Shared or service accounts", "New managed devices and automation" ], "known_blind_spots": [ "Required events or join fields are unavailable", "A vendor field is assumed equivalent without schema validation", "Testing covers only one positive path" ], "safe_validation_cases": [ { "id": "T1078-P01", "class": "positive", "title": "Representative approved behaviour", "procedure": "Use an isolated test system or approved simulation to reproduce the smallest harmless behaviour satisfying the hypothesis.", "expected": [ "Required events and fields are present", "The intended relationships survive ingestion", "The result contains enough context for triage" ] }, { "id": "T1078-N01", "class": "negative", "title": "Documented benign overlap", "procedure": "Exercise or replay a representative benign case such as: Travel and VPN egress changes.", "expected": [ "Telemetry remains available for hunting", "The analytic does not create unjustified severity", "Any suppression is narrow and documented" ] }, { "id": "T1078-R01", "class": "resilience", "title": "Missing or degraded context", "procedure": "Repeat validation with one required field or related event unavailable.", "expected": [ "The failure mode is visible", "The result does not silently become confirmed coverage", "The gap receives an owner" ] } ], "acceptance_criteria": [ "Required telemetry and fields are measured in the intended scope", "Positive and benign cases behave as expected", "An analyst can explain the result", "Ownership, review date and response path are recorded" ], "triage": [ "Build an account timeline before and after access", "Compare device, source and authentication method", "Trace mailbox, file, directory and administrative activity", "Find other accounts from the same source or device" ], "response": [ "Revoke sessions and protect the account when compromise is supported", "Preserve identity and resource-access logs", "Investigate persistence such as added credentials, roles or inbox rules" ], "lifecycle": { "package_owner": "Local detection team", "package_status": "engineering candidate", "created": "2026-08-20", "last_reviewed": "Not independently reviewed", "review_due": "Set during local implementation", "attack_version": "19.2", "technique_version": "3.0", "change_policy": "Review after ATT&CK, telemetry, analytic or validation changes." }, "references": [ { "title": "MITRE ATT&CK T1078 Valid Accounts", "url": "https://attack.mitre.org/techniques/T1078" }, { "title": "MITRE ATT&CK DET0560 Detection of Valid Account Abuse Across Platforms", "url": "https://attack.mitre.org/detectionstrategies/DET0560" } ] }, { "id": "HXD-T1098-CANDIDATE", "technique_id": "T1098", "title": "Account Manipulation detection engineering candidate", "status": "engineering-candidate", "starter": true, "scope": { "platforms": [ "Containers", "ESXi", "IaaS", "Identity Provider", "Linux", "Network Devices", "Office Suite", "SaaS", "Windows", "macOS" ], "behaviour": "Use when an adversary modifies an account to maintain access, extend privileges or establish an alternate authentication path. Record the specific sub-technique when evidence supports it.", "not_covered": [ "A deployable product query", "Proof that the required telemetry exists locally", "Validation against the organisation's benign baseline" ] }, "hypothesis": "Use when an adversary modifies an account to maintain access, extend privileges or establish an alternate authentication path. Record the specific sub-technique when evidence supports it.", "official_detection": { "strategy_id": "DET0096", "strategy_name": "Account Manipulation Behavior Chain Detection", "url": "https://attack.mitre.org/detectionstrategies/DET0096", "analytic_id": "Local analytic design required", "description": "Use the official ATT&CK detection relationship as source context, then translate the behaviour and evidence requirements into the local event model.", "platforms": [ "Containers", "ESXi", "IaaS", "Identity Provider", "Linux", "Network Devices", "Office Suite", "SaaS", "Windows", "macOS" ], "log_sources": [ { "component_id": "LOCAL-01", "component": "Telemetry requirement 1", "source": "Identity and directory audit logs", "channel": "Map to local schema" }, { "component_id": "LOCAL-02", "component": "Telemetry requirement 2", "source": "Cloud IAM and role-assignment events", "channel": "Map to local schema" }, { "component_id": "LOCAL-03", "component": "Telemetry requirement 3", "source": "MFA and credential registration events", "channel": "Map to local schema" }, { "component_id": "LOCAL-04", "component": "Telemetry requirement 4", "source": "Mailbox permission and delegation logs", "channel": "Map to local schema" } ], "mutable_elements": [ "Event schema and field names", "Correlation window", "Environment baseline", "Severity and suppression policy" ] }, "data_requirements": [ { "source": "Primary behaviour telemetry", "acceptable_sensors": [ "Identity and directory audit logs" ], "required_fields": [ "Account and changed property", "Authorisation context and subsequent use" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Identity and execution context", "acceptable_sensors": [ "Cloud IAM and role-assignment events" ], "required_fields": [ "Before/after value and timestamp" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Corroborating outcome telemetry", "acceptable_sensors": [ "MFA and credential registration events" ], "required_fields": [ "Actor or session performing the change" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] } ], "analytic_logic": { "required": [ "Account and changed property", "Before/after value and timestamp", "Actor or session performing the change", "Authorisation context and subsequent use" ], "elevating_context": [ "Identify the initiating session and authentication method", "Find parallel changes to other accounts", "Trace use of the added credential or role", "Review approvals and change records" ], "lowering_context": [ "Help-desk recovery", "Role changes and onboarding", "Key rotation and legitimate automation" ], "decision": "Require the smallest defensible combination that separates the adversary-relevant claim from documented benign overlap. Keep weaker signals available for hunting." }, "benign_baseline": [ "Help-desk recovery", "Role changes and onboarding", "Key rotation and legitimate automation" ], "known_blind_spots": [ "Required events or join fields are unavailable", "A vendor field is assumed equivalent without schema validation", "Testing covers only one positive path" ], "safe_validation_cases": [ { "id": "T1098-P01", "class": "positive", "title": "Representative approved behaviour", "procedure": "Use an isolated test system or approved simulation to reproduce the smallest harmless behaviour satisfying the hypothesis.", "expected": [ "Required events and fields are present", "The intended relationships survive ingestion", "The result contains enough context for triage" ] }, { "id": "T1098-N01", "class": "negative", "title": "Documented benign overlap", "procedure": "Exercise or replay a representative benign case such as: Help-desk recovery.", "expected": [ "Telemetry remains available for hunting", "The analytic does not create unjustified severity", "Any suppression is narrow and documented" ] }, { "id": "T1098-R01", "class": "resilience", "title": "Missing or degraded context", "procedure": "Repeat validation with one required field or related event unavailable.", "expected": [ "The failure mode is visible", "The result does not silently become confirmed coverage", "The gap receives an owner" ] } ], "acceptance_criteria": [ "Required telemetry and fields are measured in the intended scope", "Positive and benign cases behave as expected", "An analyst can explain the result", "Ownership, review date and response path are recorded" ], "triage": [ "Identify the initiating session and authentication method", "Find parallel changes to other accounts", "Trace use of the added credential or role", "Review approvals and change records" ], "response": [ "Remove unauthorised credentials, roles or delegates", "Revoke initiating sessions and protect affected accounts", "Preserve audit events and investigate downstream access" ], "lifecycle": { "package_owner": "Local detection team", "package_status": "engineering candidate", "created": "2026-08-20", "last_reviewed": "Not independently reviewed", "review_due": "Set during local implementation", "attack_version": "19.2", "technique_version": "2.8", "change_policy": "Review after ATT&CK, telemetry, analytic or validation changes." }, "references": [ { "title": "MITRE ATT&CK T1098 Account Manipulation", "url": "https://attack.mitre.org/techniques/T1098" }, { "title": "MITRE ATT&CK DET0096 Account Manipulation Behavior Chain Detection", "url": "https://attack.mitre.org/detectionstrategies/DET0096" } ] }, { "id": "HXD-T1105-CANDIDATE", "technique_id": "T1105", "title": "Ingress Tool Transfer detection engineering candidate", "status": "engineering-candidate", "starter": true, "scope": { "platforms": [ "ESXi", "Linux", "Network Devices", "Windows", "macOS" ], "behaviour": "Use when files or tools are transferred from an external system into a compromised environment. Ordinary downloads are common; preserve the initiating process, destination and resulting use.", "not_covered": [ "A deployable product query", "Proof that the required telemetry exists locally", "Validation against the organisation's benign baseline" ] }, "hypothesis": "Use when files or tools are transferred from an external system into a compromised environment. Ordinary downloads are common; preserve the initiating process, destination and resulting use.", "official_detection": { "strategy_id": "DET0060", "strategy_name": "Detect Ingress Tool Transfers via Behavioral Chain", "url": "https://attack.mitre.org/detectionstrategies/DET0060", "analytic_id": "Local analytic design required", "description": "Use the official ATT&CK detection relationship as source context, then translate the behaviour and evidence requirements into the local event model.", "platforms": [ "ESXi", "Linux", "Network Devices", "Windows", "macOS" ], "log_sources": [ { "component_id": "LOCAL-01", "component": "Telemetry requirement 1", "source": "Endpoint process, file and network telemetry", "channel": "Map to local schema" }, { "component_id": "LOCAL-02", "component": "Telemetry requirement 2", "source": "Proxy, DNS and firewall records", "channel": "Map to local schema" }, { "component_id": "LOCAL-03", "component": "Telemetry requirement 3", "source": "Script and command-line logging", "channel": "Map to local schema" }, { "component_id": "LOCAL-04", "component": "Telemetry requirement 4", "source": "File reputation and static-analysis results", "channel": "Map to local schema" } ], "mutable_elements": [ "Event schema and field names", "Correlation window", "Environment baseline", "Severity and suppression policy" ] }, "data_requirements": [ { "source": "Primary behaviour telemetry", "acceptable_sensors": [ "Endpoint process, file and network telemetry" ], "required_fields": [ "Source and destination of transfer", "Execution or operational use, if any" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Identity and execution context", "acceptable_sensors": [ "Proxy, DNS and firewall records" ], "required_fields": [ "Initiating process, account and command" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Corroborating outcome telemetry", "acceptable_sensors": [ "Script and command-line logging" ], "required_fields": [ "Resulting file, hash and path" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] } ], "analytic_logic": { "required": [ "Source and destination of transfer", "Initiating process, account and command", "Resulting file, hash and path", "Execution or operational use, if any" ], "elevating_context": [ "Trace the parent process and preceding access", "Cluster source infrastructure and filenames", "Search the hash and path across endpoints", "Inspect execution, persistence and outbound connections" ], "lowering_context": [ "Software installation and updates", "Administrative file transfer", "Browser and user downloads" ], "decision": "Require the smallest defensible combination that separates the adversary-relevant claim from documented benign overlap. Keep weaker signals available for hunting." }, "benign_baseline": [ "Software installation and updates", "Administrative file transfer", "Browser and user downloads" ], "known_blind_spots": [ "Required events or join fields are unavailable", "A vendor field is assumed equivalent without schema validation", "Testing covers only one positive path" ], "safe_validation_cases": [ { "id": "T1105-P01", "class": "positive", "title": "Representative approved behaviour", "procedure": "Use an isolated test system or approved simulation to reproduce the smallest harmless behaviour satisfying the hypothesis.", "expected": [ "Required events and fields are present", "The intended relationships survive ingestion", "The result contains enough context for triage" ] }, { "id": "T1105-N01", "class": "negative", "title": "Documented benign overlap", "procedure": "Exercise or replay a representative benign case such as: Software installation and updates.", "expected": [ "Telemetry remains available for hunting", "The analytic does not create unjustified severity", "Any suppression is narrow and documented" ] }, { "id": "T1105-R01", "class": "resilience", "title": "Missing or degraded context", "procedure": "Repeat validation with one required field or related event unavailable.", "expected": [ "The failure mode is visible", "The result does not silently become confirmed coverage", "The gap receives an owner" ] } ], "acceptance_criteria": [ "Required telemetry and fields are measured in the intended scope", "Positive and benign cases behave as expected", "An analyst can explain the result", "Ownership, review date and response path are recorded" ], "triage": [ "Trace the parent process and preceding access", "Cluster source infrastructure and filenames", "Search the hash and path across endpoints", "Inspect execution, persistence and outbound connections" ], "response": [ "Preserve the transferred file and network evidence", "Block confirmed malicious sources and hashes", "Scope execution and related access before cleanup" ], "lifecycle": { "package_owner": "Local detection team", "package_status": "engineering candidate", "created": "2026-08-20", "last_reviewed": "Not independently reviewed", "review_due": "Set during local implementation", "attack_version": "19.2", "technique_version": "2.6", "change_policy": "Review after ATT&CK, telemetry, analytic or validation changes." }, "references": [ { "title": "MITRE ATT&CK T1105 Ingress Tool Transfer", "url": "https://attack.mitre.org/techniques/T1105" }, { "title": "MITRE ATT&CK DET0060 Detect Ingress Tool Transfers via Behavioral Chain", "url": "https://attack.mitre.org/detectionstrategies/DET0060" } ] }, { "id": "HXD-T1110.003-CANDIDATE", "technique_id": "T1110.003", "title": "Password Spraying detection engineering candidate", "status": "engineering-candidate", "starter": true, "scope": { "platforms": [ "Containers", "ESXi", "IaaS", "Identity Provider", "Linux", "Network Devices", "Office Suite", "SaaS", "Windows", "macOS" ], "behaviour": "Use when one or a small set of passwords is attempted across many accounts. Separate failures, successful authentication and post-authentication activity; source IP alone is not an actor identity.", "not_covered": [ "A deployable product query", "Proof that the required telemetry exists locally", "Validation against the organisation's benign baseline" ] }, "hypothesis": "Use when one or a small set of passwords is attempted across many accounts. Separate failures, successful authentication and post-authentication activity; source IP alone is not an actor identity.", "official_detection": { "strategy_id": "DET0487", "strategy_name": "Distributed Password Spraying via Authentication Failures Across Multiple Accounts", "url": "https://attack.mitre.org/detectionstrategies/DET0487", "analytic_id": "Local analytic design required", "description": "Use the official ATT&CK detection relationship as source context, then translate the behaviour and evidence requirements into the local event model.", "platforms": [ "Containers", "ESXi", "IaaS", "Identity Provider", "Linux", "Network Devices", "Office Suite", "SaaS", "Windows", "macOS" ], "log_sources": [ { "component_id": "LOCAL-01", "component": "Telemetry requirement 1", "source": "Identity-provider and directory authentication logs", "channel": "Map to local schema" }, { "component_id": "LOCAL-02", "component": "Telemetry requirement 2", "source": "VPN, SaaS and externally accessible application logs", "channel": "Map to local schema" }, { "component_id": "LOCAL-03", "component": "Telemetry requirement 3", "source": "Risk, device, session and conditional-access context", "channel": "Map to local schema" } ], "mutable_elements": [ "Event schema and field names", "Correlation window", "Environment baseline", "Severity and suppression policy" ] }, "data_requirements": [ { "source": "Primary behaviour telemetry", "acceptable_sensors": [ "Identity-provider and directory authentication logs" ], "required_fields": [ "Target account and authentication result", "Population-level pattern across identities" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Identity and execution context", "acceptable_sensors": [ "VPN, SaaS and externally accessible application logs" ], "required_fields": [ "Source address, client and application" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Corroborating outcome telemetry", "acceptable_sensors": [ "Risk, device, session and conditional-access context" ], "required_fields": [ "Accurate timestamp and tenant or domain" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] } ], "analytic_logic": { "required": [ "Target account and authentication result", "Source address, client and application", "Accurate timestamp and tenant or domain", "Population-level pattern across identities" ], "elevating_context": [ "Count distinct targets per source and password-independent pattern", "Identify successes after failure clusters", "Correlate device, session and token issuance", "Scope the same targets across applications and addresses" ], "lowering_context": [ "Misconfigured applications using stale credentials", "Password-manager or mobile-client retries", "Authorised identity testing" ], "decision": "Require the smallest defensible combination that separates the adversary-relevant claim from documented benign overlap. Keep weaker signals available for hunting." }, "benign_baseline": [ "Misconfigured applications using stale credentials", "Password-manager or mobile-client retries", "Authorised identity testing" ], "known_blind_spots": [ "Required events or join fields are unavailable", "A vendor field is assumed equivalent without schema validation", "Testing covers only one positive path" ], "safe_validation_cases": [ { "id": "T1110003-P01", "class": "positive", "title": "Representative approved behaviour", "procedure": "Use an isolated test system or approved simulation to reproduce the smallest harmless behaviour satisfying the hypothesis.", "expected": [ "Required events and fields are present", "The intended relationships survive ingestion", "The result contains enough context for triage" ] }, { "id": "T1110003-N01", "class": "negative", "title": "Documented benign overlap", "procedure": "Exercise or replay a representative benign case such as: Misconfigured applications using stale credentials.", "expected": [ "Telemetry remains available for hunting", "The analytic does not create unjustified severity", "Any suppression is narrow and documented" ] }, { "id": "T1110003-R01", "class": "resilience", "title": "Missing or degraded context", "procedure": "Repeat validation with one required field or related event unavailable.", "expected": [ "The failure mode is visible", "The result does not silently become confirmed coverage", "The gap receives an owner" ] } ], "acceptance_criteria": [ "Required telemetry and fields are measured in the intended scope", "Positive and benign cases behave as expected", "An analyst can explain the result", "Ownership, review date and response path are recorded" ], "triage": [ "Count distinct targets per source and password-independent pattern", "Identify successes after failure clusters", "Correlate device, session and token issuance", "Scope the same targets across applications and addresses" ], "response": [ "Protect successfully accessed identities and sessions", "Apply risk-based controls without locking out the entire target set", "Preserve distributed-source and application context" ], "lifecycle": { "package_owner": "Local detection team", "package_status": "engineering candidate", "created": "2026-08-20", "last_reviewed": "Not independently reviewed", "review_due": "Set during local implementation", "attack_version": "19.2", "technique_version": "1.8", "change_policy": "Review after ATT&CK, telemetry, analytic or validation changes." }, "references": [ { "title": "MITRE ATT&CK T1110.003 Password Spraying", "url": "https://attack.mitre.org/techniques/T1110/003" }, { "title": "MITRE ATT&CK DET0487 Distributed Password Spraying via Authentication Failures Across Multiple Accounts", "url": "https://attack.mitre.org/detectionstrategies/DET0487" } ] }, { "id": "HXD-T1140-CANDIDATE", "technique_id": "T1140", "title": "Deobfuscate/Decode Files or Information detection engineering candidate", "status": "engineering-candidate", "starter": true, "scope": { "platforms": [ "ESXi", "Linux", "Windows", "macOS" ], "behaviour": "Use when a process decodes or deobfuscates content for subsequent use. The operation is meaningful only when linked to the input, recovered output and follow-on behaviour.", "not_covered": [ "A deployable product query", "Proof that the required telemetry exists locally", "Validation against the organisation's benign baseline" ] }, "hypothesis": "Use when a process decodes or deobfuscates content for subsequent use. The operation is meaningful only when linked to the input, recovered output and follow-on behaviour.", "official_detection": { "strategy_id": "DET0275", "strategy_name": "Detect Adversary Deobfuscation or Decoding of Files and Payloads", "url": "https://attack.mitre.org/detectionstrategies/DET0275", "analytic_id": "Local analytic design required", "description": "Use the official ATT&CK detection relationship as source context, then translate the behaviour and evidence requirements into the local event model.", "platforms": [ "ESXi", "Linux", "Windows", "macOS" ], "log_sources": [ { "component_id": "LOCAL-01", "component": "Telemetry requirement 1", "source": "Script-content and command-line telemetry", "channel": "Map to local schema" }, { "component_id": "LOCAL-02", "component": "Telemetry requirement 2", "source": "File creation, memory and module-load events", "channel": "Map to local schema" }, { "component_id": "LOCAL-03", "component": "Telemetry requirement 3", "source": "Process ancestry and consequential network activity", "channel": "Map to local schema" } ], "mutable_elements": [ "Event schema and field names", "Correlation window", "Environment baseline", "Severity and suppression policy" ] }, "data_requirements": [ { "source": "Primary behaviour telemetry", "acceptable_sensors": [ "Script-content and command-line telemetry" ], "required_fields": [ "Input content or identifier", "Follow-on execution, loading or transfer evidence" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Identity and execution context", "acceptable_sensors": [ "File creation, memory and module-load events" ], "required_fields": [ "Decoder process, script or routine" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Corroborating outcome telemetry", "acceptable_sensors": [ "Process ancestry and consequential network activity" ], "required_fields": [ "Recovered output or observable side effect" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] } ], "analytic_logic": { "required": [ "Input content or identifier", "Decoder process, script or routine", "Recovered output or observable side effect", "Follow-on execution, loading or transfer evidence" ], "elevating_context": [ "Preserve both encoded and decoded hashes", "Identify repeated decoder logic across samples", "Trace output to execution or loading", "Search recovered strings, paths and configuration" ], "lowering_context": [ "Installers and update clients", "Application resource extraction", "Administrative encoding and certificate workflows" ], "decision": "Require the smallest defensible combination that separates the adversary-relevant claim from documented benign overlap. Keep weaker signals available for hunting." }, "benign_baseline": [ "Installers and update clients", "Application resource extraction", "Administrative encoding and certificate workflows" ], "known_blind_spots": [ "Required events or join fields are unavailable", "A vendor field is assumed equivalent without schema validation", "Testing covers only one positive path" ], "safe_validation_cases": [ { "id": "T1140-P01", "class": "positive", "title": "Representative approved behaviour", "procedure": "Use an isolated test system or approved simulation to reproduce the smallest harmless behaviour satisfying the hypothesis.", "expected": [ "Required events and fields are present", "The intended relationships survive ingestion", "The result contains enough context for triage" ] }, { "id": "T1140-N01", "class": "negative", "title": "Documented benign overlap", "procedure": "Exercise or replay a representative benign case such as: Installers and update clients.", "expected": [ "Telemetry remains available for hunting", "The analytic does not create unjustified severity", "Any suppression is narrow and documented" ] }, { "id": "T1140-R01", "class": "resilience", "title": "Missing or degraded context", "procedure": "Repeat validation with one required field or related event unavailable.", "expected": [ "The failure mode is visible", "The result does not silently become confirmed coverage", "The gap receives an owner" ] } ], "acceptance_criteria": [ "Required telemetry and fields are measured in the intended scope", "Positive and benign cases behave as expected", "An analyst can explain the result", "Ownership, review date and response path are recorded" ], "triage": [ "Preserve both encoded and decoded hashes", "Identify repeated decoder logic across samples", "Trace output to execution or loading", "Search recovered strings, paths and configuration" ], "response": [ "Acquire original and transformed content", "Contain only when the wider chain supports harmful use", "Add decoder and output examples to regression tests" ], "lifecycle": { "package_owner": "Local detection team", "package_status": "engineering candidate", "created": "2026-08-20", "last_reviewed": "Not independently reviewed", "review_due": "Set during local implementation", "attack_version": "19.2", "technique_version": "2.0", "change_policy": "Review after ATT&CK, telemetry, analytic or validation changes." }, "references": [ { "title": "MITRE ATT&CK T1140 Deobfuscate/Decode Files or Information", "url": "https://attack.mitre.org/techniques/T1140" }, { "title": "MITRE ATT&CK DET0275 Detect Adversary Deobfuscation or Decoding of Files and Payloads", "url": "https://attack.mitre.org/detectionstrategies/DET0275" } ] }, { "id": "HXD-T1190-CANDIDATE", "technique_id": "T1190", "title": "Exploit Public-Facing Application detection engineering candidate", "status": "engineering-candidate", "starter": true, "scope": { "platforms": [ "Containers", "ESXi", "IaaS", "Linux", "Network Devices", "Windows", "macOS" ], "behaviour": "Use when exploitation of an internet-facing system produces adversary access or execution. Vulnerability presence, scanning and successful exploitation are separate facts.", "not_covered": [ "A deployable product query", "Proof that the required telemetry exists locally", "Validation against the organisation's benign baseline" ] }, "hypothesis": "Use when exploitation of an internet-facing system produces adversary access or execution. Vulnerability presence, scanning and successful exploitation are separate facts.", "official_detection": { "strategy_id": "DET0080", "strategy_name": "Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)", "url": "https://attack.mitre.org/detectionstrategies/DET0080", "analytic_id": "Local analytic design required", "description": "Use the official ATT&CK detection relationship as source context, then translate the behaviour and evidence requirements into the local event model.", "platforms": [ "Containers", "ESXi", "IaaS", "Linux", "Network Devices", "Windows", "macOS" ], "log_sources": [ { "component_id": "LOCAL-01", "component": "Telemetry requirement 1", "source": "Reverse-proxy, WAF and application logs", "channel": "Map to local schema" }, { "component_id": "LOCAL-02", "component": "Telemetry requirement 2", "source": "EDR process, file and network events", "channel": "Map to local schema" }, { "component_id": "LOCAL-03", "component": "Telemetry requirement 3", "source": "Vulnerability and asset inventory", "channel": "Map to local schema" }, { "component_id": "LOCAL-04", "component": "Telemetry requirement 4", "source": "Authentication and configuration-change logs", "channel": "Map to local schema" } ], "mutable_elements": [ "Event schema and field names", "Correlation window", "Environment baseline", "Severity and suppression policy" ] }, "data_requirements": [ { "source": "Primary behaviour telemetry", "acceptable_sensors": [ "Reverse-proxy, WAF and application logs" ], "required_fields": [ "Affected service, version and exposure", "Resulting process, file, account or session activity" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Identity and execution context", "acceptable_sensors": [ "EDR process, file and network events" ], "required_fields": [ "Exploit request or equivalent technical evidence" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Corroborating outcome telemetry", "acceptable_sensors": [ "Vulnerability and asset inventory" ], "required_fields": [ "Application or system response indicating success" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] } ], "analytic_logic": { "required": [ "Affected service, version and exposure", "Exploit request or equivalent technical evidence", "Application or system response indicating success", "Resulting process, file, account or session activity" ], "elevating_context": [ "Separate scanning from successful exploitation", "Trace the first post-exploitation process or account", "Search the request pattern across exposed assets", "Identify persistence, credential access and outbound communication" ], "lowering_context": [ "Vulnerability scanning", "Failed exploit attempts", "Application errors and proof-of-concept testing" ], "decision": "Require the smallest defensible combination that separates the adversary-relevant claim from documented benign overlap. Keep weaker signals available for hunting." }, "benign_baseline": [ "Vulnerability scanning", "Failed exploit attempts", "Application errors and proof-of-concept testing" ], "known_blind_spots": [ "Required events or join fields are unavailable", "A vendor field is assumed equivalent without schema validation", "Testing covers only one positive path" ], "safe_validation_cases": [ { "id": "T1190-P01", "class": "positive", "title": "Representative approved behaviour", "procedure": "Use an isolated test system or approved simulation to reproduce the smallest harmless behaviour satisfying the hypothesis.", "expected": [ "Required events and fields are present", "The intended relationships survive ingestion", "The result contains enough context for triage" ] }, { "id": "T1190-N01", "class": "negative", "title": "Documented benign overlap", "procedure": "Exercise or replay a representative benign case such as: Vulnerability scanning.", "expected": [ "Telemetry remains available for hunting", "The analytic does not create unjustified severity", "Any suppression is narrow and documented" ] }, { "id": "T1190-R01", "class": "resilience", "title": "Missing or degraded context", "procedure": "Repeat validation with one required field or related event unavailable.", "expected": [ "The failure mode is visible", "The result does not silently become confirmed coverage", "The gap receives an owner" ] } ], "acceptance_criteria": [ "Required telemetry and fields are measured in the intended scope", "Positive and benign cases behave as expected", "An analyst can explain the result", "Ownership, review date and response path are recorded" ], "triage": [ "Separate scanning from successful exploitation", "Trace the first post-exploitation process or account", "Search the request pattern across exposed assets", "Identify persistence, credential access and outbound communication" ], "response": [ "Remove or restrict the affected service while preserving evidence", "Patch only after scoping compromise and persistence", "Rotate exposed secrets and investigate connected systems" ], "lifecycle": { "package_owner": "Local detection team", "package_status": "engineering candidate", "created": "2026-08-20", "last_reviewed": "Not independently reviewed", "review_due": "Set during local implementation", "attack_version": "19.2", "technique_version": "2.8", "change_policy": "Review after ATT&CK, telemetry, analytic or validation changes." }, "references": [ { "title": "MITRE ATT&CK T1190 Exploit Public-Facing Application", "url": "https://attack.mitre.org/techniques/T1190" }, { "title": "MITRE ATT&CK DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)", "url": "https://attack.mitre.org/detectionstrategies/DET0080" } ] }, { "id": "HXD-T1204.001-CANDIDATE", "technique_id": "T1204.001", "title": "Malicious Link detection engineering candidate", "status": "engineering-candidate", "starter": true, "scope": { "platforms": [ "Linux", "Windows", "macOS" ], "behaviour": "Use when a person follows an adversary-controlled link. Message delivery and URL presence are not user execution; preserve click, browser and downstream outcome as separate claims.", "not_covered": [ "A deployable product query", "Proof that the required telemetry exists locally", "Validation against the organisation's benign baseline" ] }, "hypothesis": "Use when a person follows an adversary-controlled link. Message delivery and URL presence are not user execution; preserve click, browser and downstream outcome as separate claims.", "official_detection": { "strategy_id": "DET0066", "strategy_name": "User Execution – Malicious Link (click → suspicious egress → download/write → follow-on activity)", "url": "https://attack.mitre.org/detectionstrategies/DET0066", "analytic_id": "Local analytic design required", "description": "Use the official ATT&CK detection relationship as source context, then translate the behaviour and evidence requirements into the local event model.", "platforms": [ "Linux", "Windows", "macOS" ], "log_sources": [ { "component_id": "LOCAL-01", "component": "Telemetry requirement 1", "source": "Mail, SMS or collaboration platform delivery and click records", "channel": "Map to local schema" }, { "component_id": "LOCAL-02", "component": "Telemetry requirement 2", "source": "Secure web gateway, DNS and browser navigation history", "channel": "Map to local schema" }, { "component_id": "LOCAL-03", "component": "Telemetry requirement 3", "source": "Identity, endpoint and proxy events after the navigation", "channel": "Map to local schema" } ], "mutable_elements": [ "Event schema and field names", "Correlation window", "Environment baseline", "Severity and suppression policy" ] }, "data_requirements": [ { "source": "Primary behaviour telemetry", "acceptable_sensors": [ "Mail, SMS or collaboration platform delivery and click records" ], "required_fields": [ "Original message or defensible delivery record", "Downstream authentication, download or execution outcome" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Identity and execution context", "acceptable_sensors": [ "Secure web gateway, DNS and browser navigation history" ], "required_fields": [ "Normalised URL and redirect chain" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Corroborating outcome telemetry", "acceptable_sensors": [ "Identity, endpoint and proxy events after the navigation" ], "required_fields": [ "Click or browser-navigation evidence tied to an identity" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] } ], "analytic_logic": { "required": [ "Original message or defensible delivery record", "Normalised URL and redirect chain", "Click or browser-navigation evidence tied to an identity", "Downstream authentication, download or execution outcome" ], "elevating_context": [ "Expand redirects and preserve every hostname", "Scope recipients and clickers separately", "Correlate browser activity with downloads, sign-ins and token events", "Search page templates, certificates and infrastructure reuse" ], "lowering_context": [ "Legitimate marketing and tracking redirects", "Security-awareness simulations", "Normal external links shared through collaboration tools" ], "decision": "Require the smallest defensible combination that separates the adversary-relevant claim from documented benign overlap. Keep weaker signals available for hunting." }, "benign_baseline": [ "Legitimate marketing and tracking redirects", "Security-awareness simulations", "Normal external links shared through collaboration tools" ], "known_blind_spots": [ "Required events or join fields are unavailable", "A vendor field is assumed equivalent without schema validation", "Testing covers only one positive path" ], "safe_validation_cases": [ { "id": "T1204001-P01", "class": "positive", "title": "Representative approved behaviour", "procedure": "Use an isolated test system or approved simulation to reproduce the smallest harmless behaviour satisfying the hypothesis.", "expected": [ "Required events and fields are present", "The intended relationships survive ingestion", "The result contains enough context for triage" ] }, { "id": "T1204001-N01", "class": "negative", "title": "Documented benign overlap", "procedure": "Exercise or replay a representative benign case such as: Legitimate marketing and tracking redirects.", "expected": [ "Telemetry remains available for hunting", "The analytic does not create unjustified severity", "Any suppression is narrow and documented" ] }, { "id": "T1204001-R01", "class": "resilience", "title": "Missing or degraded context", "procedure": "Repeat validation with one required field or related event unavailable.", "expected": [ "The failure mode is visible", "The result does not silently become confirmed coverage", "The gap receives an owner" ] } ], "acceptance_criteria": [ "Required telemetry and fields are measured in the intended scope", "Positive and benign cases behave as expected", "An analyst can explain the result", "Ownership, review date and response path are recorded" ], "triage": [ "Expand redirects and preserve every hostname", "Scope recipients and clickers separately", "Correlate browser activity with downloads, sign-ins and token events", "Search page templates, certificates and infrastructure reuse" ], "response": [ "Preserve the message and complete redirect chain", "Revoke affected sessions when credential capture is supported", "Block confirmed infrastructure with an expiry and review owner" ], "lifecycle": { "package_owner": "Local detection team", "package_status": "engineering candidate", "created": "2026-08-20", "last_reviewed": "Not independently reviewed", "review_due": "Set during local implementation", "attack_version": "19.2", "technique_version": "1.2", "change_policy": "Review after ATT&CK, telemetry, analytic or validation changes." }, "references": [ { "title": "MITRE ATT&CK T1204.001 Malicious Link", "url": "https://attack.mitre.org/techniques/T1204/001" }, { "title": "MITRE ATT&CK DET0066 User Execution – Malicious Link (click → suspicious egress → download/write → follow-on activity)", "url": "https://attack.mitre.org/detectionstrategies/DET0066" } ] }, { "id": "HXD-T1204.002-CANDIDATE", "technique_id": "T1204.002", "title": "Malicious File detection engineering candidate", "status": "engineering-candidate", "starter": true, "scope": { "platforms": [ "Linux", "Windows", "macOS" ], "behaviour": "Use when a person opens or executes a delivered file. File presence is not execution; require process, document-reader or operating-system evidence of the user-triggered action.", "not_covered": [ "A deployable product query", "Proof that the required telemetry exists locally", "Validation against the organisation's benign baseline" ] }, "hypothesis": "Use when a person opens or executes a delivered file. File presence is not execution; require process, document-reader or operating-system evidence of the user-triggered action.", "official_detection": { "strategy_id": "DET0294", "strategy_name": "User Execution – Malicious File via download/open → spawn chain (T1204.002)", "url": "https://attack.mitre.org/detectionstrategies/DET0294", "analytic_id": "Local analytic design required", "description": "Use the official ATT&CK detection relationship as source context, then translate the behaviour and evidence requirements into the local event model.", "platforms": [ "Linux", "Windows", "macOS" ], "log_sources": [ { "component_id": "LOCAL-01", "component": "Telemetry requirement 1", "source": "Endpoint file creation and process telemetry", "channel": "Map to local schema" }, { "component_id": "LOCAL-02", "component": "Telemetry requirement 2", "source": "Document-reader, archive utility and script-interpreter events", "channel": "Map to local schema" }, { "component_id": "LOCAL-03", "component": "Telemetry requirement 3", "source": "Mail, browser or collaboration delivery metadata", "channel": "Map to local schema" } ], "mutable_elements": [ "Event schema and field names", "Correlation window", "Environment baseline", "Severity and suppression policy" ] }, "data_requirements": [ { "source": "Primary behaviour telemetry", "acceptable_sensors": [ "Endpoint file creation and process telemetry" ], "required_fields": [ "Original file, hash and collection context", "Process lineage or application evidence showing the action" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Identity and execution context", "acceptable_sensors": [ "Document-reader, archive utility and script-interpreter events" ], "required_fields": [ "User and host associated with the file" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Corroborating outcome telemetry", "acceptable_sensors": [ "Mail, browser or collaboration delivery metadata" ], "required_fields": [ "Open or execution timestamp" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] } ], "analytic_logic": { "required": [ "Original file, hash and collection context", "User and host associated with the file", "Open or execution timestamp", "Process lineage or application evidence showing the action" ], "elevating_context": [ "Scope the hash, filename and signer across hosts", "Trace the parent process and delivery application", "Inspect child processes, network activity and persistence", "Compare execution with recipients who only received the file" ], "lowering_context": [ "Expected business documents and installers", "Approved software deployment", "Sandbox or security-team detonation" ], "decision": "Require the smallest defensible combination that separates the adversary-relevant claim from documented benign overlap. Keep weaker signals available for hunting." }, "benign_baseline": [ "Expected business documents and installers", "Approved software deployment", "Sandbox or security-team detonation" ], "known_blind_spots": [ "Required events or join fields are unavailable", "A vendor field is assumed equivalent without schema validation", "Testing covers only one positive path" ], "safe_validation_cases": [ { "id": "T1204002-P01", "class": "positive", "title": "Representative approved behaviour", "procedure": "Use an isolated test system or approved simulation to reproduce the smallest harmless behaviour satisfying the hypothesis.", "expected": [ "Required events and fields are present", "The intended relationships survive ingestion", "The result contains enough context for triage" ] }, { "id": "T1204002-N01", "class": "negative", "title": "Documented benign overlap", "procedure": "Exercise or replay a representative benign case such as: Expected business documents and installers.", "expected": [ "Telemetry remains available for hunting", "The analytic does not create unjustified severity", "Any suppression is narrow and documented" ] }, { "id": "T1204002-R01", "class": "resilience", "title": "Missing or degraded context", "procedure": "Repeat validation with one required field or related event unavailable.", "expected": [ "The failure mode is visible", "The result does not silently become confirmed coverage", "The gap receives an owner" ] } ], "acceptance_criteria": [ "Required telemetry and fields are measured in the intended scope", "Positive and benign cases behave as expected", "An analyst can explain the result", "Ownership, review date and response path are recorded" ], "triage": [ "Scope the hash, filename and signer across hosts", "Trace the parent process and delivery application", "Inspect child processes, network activity and persistence", "Compare execution with recipients who only received the file" ], "response": [ "Preserve the original file before quarantine", "Contain systems where harmful execution is supported", "Scope all recipients and execution outcomes" ], "lifecycle": { "package_owner": "Local detection team", "package_status": "engineering candidate", "created": "2026-08-20", "last_reviewed": "Not independently reviewed", "review_due": "Set during local implementation", "attack_version": "19.2", "technique_version": "1.6", "change_policy": "Review after ATT&CK, telemetry, analytic or validation changes." }, "references": [ { "title": "MITRE ATT&CK T1204.002 Malicious File", "url": "https://attack.mitre.org/techniques/T1204/002" }, { "title": "MITRE ATT&CK DET0294 User Execution – Malicious File via download/open → spawn chain (T1204.002)", "url": "https://attack.mitre.org/detectionstrategies/DET0294" } ] }, { "id": "HXD-T1486-CANDIDATE", "technique_id": "T1486", "title": "Data Encrypted for Impact detection engineering candidate", "status": "engineering-candidate", "starter": true, "scope": { "platforms": [ "ESXi", "IaaS", "Linux", "Windows", "macOS" ], "behaviour": "Use when data is encrypted to interrupt availability. A ransom note or extension is supporting context; require evidence of the process, affected objects and operational impact.", "not_covered": [ "A deployable product query", "Proof that the required telemetry exists locally", "Validation against the organisation's benign baseline" ] }, "hypothesis": "Use when data is encrypted to interrupt availability. A ransom note or extension is supporting context; require evidence of the process, affected objects and operational impact.", "official_detection": { "strategy_id": "DET0215", "strategy_name": "Detection of Multi-Platform File Encryption for Impact", "url": "https://attack.mitre.org/detectionstrategies/DET0215", "analytic_id": "Local analytic design required", "description": "Use the official ATT&CK detection relationship as source context, then translate the behaviour and evidence requirements into the local event model.", "platforms": [ "ESXi", "IaaS", "Linux", "Windows", "macOS" ], "log_sources": [ { "component_id": "LOCAL-01", "component": "Telemetry requirement 1", "source": "Endpoint file and process telemetry", "channel": "Map to local schema" }, { "component_id": "LOCAL-02", "component": "Telemetry requirement 2", "source": "File-server, storage and cloud audit logs", "channel": "Map to local schema" }, { "component_id": "LOCAL-03", "component": "Telemetry requirement 3", "source": "Backup, identity and remote-access activity", "channel": "Map to local schema" } ], "mutable_elements": [ "Event schema and field names", "Correlation window", "Environment baseline", "Severity and suppression policy" ] }, "data_requirements": [ { "source": "Primary behaviour telemetry", "acceptable_sensors": [ "Endpoint file and process telemetry" ], "required_fields": [ "Initiating process or account", "Recovery, backup and business-impact context" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Identity and execution context", "acceptable_sensors": [ "File-server, storage and cloud audit logs" ], "required_fields": [ "Affected files, shares or storage objects" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Corroborating outcome telemetry", "acceptable_sensors": [ "Backup, identity and remote-access activity" ], "required_fields": [ "Rate and timing of modifications" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] } ], "analytic_logic": { "required": [ "Initiating process or account", "Affected files, shares or storage objects", "Rate and timing of modifications", "Recovery, backup and business-impact context" ], "elevating_context": [ "Identify the first affected host and account", "Trace lateral access to shares and hypervisors", "Search precursor discovery, credential and recovery-inhibition activity", "Measure unaffected recovery sources" ], "lowering_context": [ "Approved encryption and migration", "Backup, compression and archival jobs", "Large developer or media workflows" ], "decision": "Require the smallest defensible combination that separates the adversary-relevant claim from documented benign overlap. Keep weaker signals available for hunting." }, "benign_baseline": [ "Approved encryption and migration", "Backup, compression and archival jobs", "Large developer or media workflows" ], "known_blind_spots": [ "Required events or join fields are unavailable", "A vendor field is assumed equivalent without schema validation", "Testing covers only one positive path" ], "safe_validation_cases": [ { "id": "T1486-P01", "class": "positive", "title": "Representative approved behaviour", "procedure": "Use an isolated test system or approved simulation to reproduce the smallest harmless behaviour satisfying the hypothesis.", "expected": [ "Required events and fields are present", "The intended relationships survive ingestion", "The result contains enough context for triage" ] }, { "id": "T1486-N01", "class": "negative", "title": "Documented benign overlap", "procedure": "Exercise or replay a representative benign case such as: Approved encryption and migration.", "expected": [ "Telemetry remains available for hunting", "The analytic does not create unjustified severity", "Any suppression is narrow and documented" ] }, { "id": "T1486-R01", "class": "resilience", "title": "Missing or degraded context", "procedure": "Repeat validation with one required field or related event unavailable.", "expected": [ "The failure mode is visible", "The result does not silently become confirmed coverage", "The gap receives an owner" ] } ], "acceptance_criteria": [ "Required telemetry and fields are measured in the intended scope", "Positive and benign cases behave as expected", "An analyst can explain the result", "Ownership, review date and response path are recorded" ], "triage": [ "Identify the first affected host and account", "Trace lateral access to shares and hypervisors", "Search precursor discovery, credential and recovery-inhibition activity", "Measure unaffected recovery sources" ], "response": [ "Prioritise containment of active encryption and shared access", "Preserve evidence before rebuilding", "Validate recovery paths independently of attacker-controlled systems" ], "lifecycle": { "package_owner": "Local detection team", "package_status": "engineering candidate", "created": "2026-08-20", "last_reviewed": "Not independently reviewed", "review_due": "Set during local implementation", "attack_version": "19.2", "technique_version": "1.5", "change_policy": "Review after ATT&CK, telemetry, analytic or validation changes." }, "references": [ { "title": "MITRE ATT&CK T1486 Data Encrypted for Impact", "url": "https://attack.mitre.org/techniques/T1486" }, { "title": "MITRE ATT&CK DET0215 Detection of Multi-Platform File Encryption for Impact", "url": "https://attack.mitre.org/detectionstrategies/DET0215" } ] }, { "id": "HXD-T1505.003-CANDIDATE", "technique_id": "T1505.003", "title": "Web Shell detection engineering candidate", "status": "engineering-candidate", "starter": true, "scope": { "platforms": [ "Linux", "Network Devices", "Windows", "macOS" ], "behaviour": "Use when a script placed on a web server provides persistent remote access or command execution. A suspicious server-side script should be tied to request and execution behaviour where possible.", "not_covered": [ "A deployable product query", "Proof that the required telemetry exists locally", "Validation against the organisation's benign baseline" ] }, "hypothesis": "Use when a script placed on a web server provides persistent remote access or command execution. A suspicious server-side script should be tied to request and execution behaviour where possible.", "official_detection": { "strategy_id": "DET0394", "strategy_name": "Web Shell Detection via Server Behavior and File Execution Chains", "url": "https://attack.mitre.org/detectionstrategies/DET0394", "analytic_id": "Local analytic design required", "description": "Use the official ATT&CK detection relationship as source context, then translate the behaviour and evidence requirements into the local event model.", "platforms": [ "Linux", "Network Devices", "Windows", "macOS" ], "log_sources": [ { "component_id": "LOCAL-01", "component": "Telemetry requirement 1", "source": "Web access and error logs", "channel": "Map to local schema" }, { "component_id": "LOCAL-02", "component": "Telemetry requirement 2", "source": "File-integrity or EDR file events", "channel": "Map to local schema" }, { "component_id": "LOCAL-03", "component": "Telemetry requirement 3", "source": "Web-worker process lineage", "channel": "Map to local schema" }, { "component_id": "LOCAL-04", "component": "Telemetry requirement 4", "source": "Reverse-proxy, WAF and network telemetry", "channel": "Map to local schema" } ], "mutable_elements": [ "Event schema and field names", "Correlation window", "Environment baseline", "Severity and suppression policy" ] }, "data_requirements": [ { "source": "Primary behaviour telemetry", "acceptable_sensors": [ "Web access and error logs" ], "required_fields": [ "Server-side file, hash, path and timestamps", "Initial write or exploitation evidence" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Identity and execution context", "acceptable_sensors": [ "File-integrity or EDR file events" ], "required_fields": [ "Web requests reaching the file" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Corroborating outcome telemetry", "acceptable_sensors": [ "Web-worker process lineage" ], "required_fields": [ "Web-worker child process or command execution" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] } ], "analytic_logic": { "required": [ "Server-side file, hash, path and timestamps", "Web requests reaching the file", "Web-worker child process or command execution", "Initial write or exploitation evidence" ], "elevating_context": [ "Search URI, hash and code fragments across servers", "Trace web-worker child processes and outbound connections", "Identify the file-write origin and vulnerable application", "Inspect commands, accounts and lateral movement after access" ], "lowering_context": [ "Administrative web tools", "Application deployment artefacts", "Diagnostic scripts" ], "decision": "Require the smallest defensible combination that separates the adversary-relevant claim from documented benign overlap. Keep weaker signals available for hunting." }, "benign_baseline": [ "Administrative web tools", "Application deployment artefacts", "Diagnostic scripts" ], "known_blind_spots": [ "Required events or join fields are unavailable", "A vendor field is assumed equivalent without schema validation", "Testing covers only one positive path" ], "safe_validation_cases": [ { "id": "T1505003-P01", "class": "positive", "title": "Representative approved behaviour", "procedure": "Use an isolated test system or approved simulation to reproduce the smallest harmless behaviour satisfying the hypothesis.", "expected": [ "Required events and fields are present", "The intended relationships survive ingestion", "The result contains enough context for triage" ] }, { "id": "T1505003-N01", "class": "negative", "title": "Documented benign overlap", "procedure": "Exercise or replay a representative benign case such as: Administrative web tools.", "expected": [ "Telemetry remains available for hunting", "The analytic does not create unjustified severity", "Any suppression is narrow and documented" ] }, { "id": "T1505003-R01", "class": "resilience", "title": "Missing or degraded context", "procedure": "Repeat validation with one required field or related event unavailable.", "expected": [ "The failure mode is visible", "The result does not silently become confirmed coverage", "The gap receives an owner" ] } ], "acceptance_criteria": [ "Required telemetry and fields are measured in the intended scope", "Positive and benign cases behave as expected", "An analyst can explain the result", "Ownership, review date and response path are recorded" ], "triage": [ "Search URI, hash and code fragments across servers", "Trace web-worker child processes and outbound connections", "Identify the file-write origin and vulnerable application", "Inspect commands, accounts and lateral movement after access" ], "response": [ "Preserve file and web logs before removal", "Isolate or remove the exposed service from rotation", "Treat the server as compromised beyond deleting the shell" ], "lifecycle": { "package_owner": "Local detection team", "package_status": "engineering candidate", "created": "2026-08-20", "last_reviewed": "Not independently reviewed", "review_due": "Set during local implementation", "attack_version": "19.2", "technique_version": "1.5", "change_policy": "Review after ATT&CK, telemetry, analytic or validation changes." }, "references": [ { "title": "MITRE ATT&CK T1505.003 Web Shell", "url": "https://attack.mitre.org/techniques/T1505/003" }, { "title": "MITRE ATT&CK DET0394 Web Shell Detection via Server Behavior and File Execution Chains", "url": "https://attack.mitre.org/detectionstrategies/DET0394" } ] }, { "id": "HXD-T1528-CANDIDATE", "technique_id": "T1528", "title": "Steal Application Access Token detection engineering candidate", "status": "engineering-candidate", "starter": true, "scope": { "platforms": [ "Containers", "IaaS", "Identity Provider", "Office Suite", "SaaS" ], "behaviour": "Use when an adversary obtains an application access token. Distinguish token issuance, token theft and later token use; an OAuth URL by itself proves none of them.", "not_covered": [ "A deployable product query", "Proof that the required telemetry exists locally", "Validation against the organisation's benign baseline" ] }, "hypothesis": "Use when an adversary obtains an application access token. Distinguish token issuance, token theft and later token use; an OAuth URL by itself proves none of them.", "official_detection": { "strategy_id": "DET0515", "strategy_name": "Detection Strategy for T1528 - Steal Application Access Token", "url": "https://attack.mitre.org/detectionstrategies/DET0515", "analytic_id": "Local analytic design required", "description": "Use the official ATT&CK detection relationship as source context, then translate the behaviour and evidence requirements into the local event model.", "platforms": [ "Containers", "IaaS", "Identity Provider", "Office Suite", "SaaS" ], "log_sources": [ { "component_id": "LOCAL-01", "component": "Telemetry requirement 1", "source": "Identity-provider sign-in and audit logs", "channel": "Map to local schema" }, { "component_id": "LOCAL-02", "component": "Telemetry requirement 2", "source": "OAuth consent, service-principal and application events", "channel": "Map to local schema" }, { "component_id": "LOCAL-03", "component": "Telemetry requirement 3", "source": "Cloud application access logs", "channel": "Map to local schema" }, { "component_id": "LOCAL-04", "component": "Telemetry requirement 4", "source": "Mailbox and file-access audit records", "channel": "Map to local schema" } ], "mutable_elements": [ "Event schema and field names", "Correlation window", "Environment baseline", "Severity and suppression policy" ] }, "data_requirements": [ { "source": "Primary behaviour telemetry", "acceptable_sensors": [ "Identity-provider sign-in and audit logs" ], "required_fields": [ "Identity-provider audit event for consent or token activity", "Evidence of token use or protected-resource access" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Identity and execution context", "acceptable_sensors": [ "OAuth consent, service-principal and application events" ], "required_fields": [ "Application/client ID and requested scopes" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Corroborating outcome telemetry", "acceptable_sensors": [ "Cloud application access logs" ], "required_fields": [ "Account, source, timestamp and authentication context" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] } ], "analytic_logic": { "required": [ "Identity-provider audit event for consent or token activity", "Application/client ID and requested scopes", "Account, source, timestamp and authentication context", "Evidence of token use or protected-resource access" ], "elevating_context": [ "Review scopes, publisher verification and tenant consent", "Trace token use across IPs and applications", "Identify mailbox, file or directory access after issuance", "Hunt for other users authorising the same application" ], "lowering_context": [ "Legitimate application consent", "Device-code authentication", "Administrative application onboarding" ], "decision": "Require the smallest defensible combination that separates the adversary-relevant claim from documented benign overlap. Keep weaker signals available for hunting." }, "benign_baseline": [ "Legitimate application consent", "Device-code authentication", "Administrative application onboarding" ], "known_blind_spots": [ "Required events or join fields are unavailable", "A vendor field is assumed equivalent without schema validation", "Testing covers only one positive path" ], "safe_validation_cases": [ { "id": "T1528-P01", "class": "positive", "title": "Representative approved behaviour", "procedure": "Use an isolated test system or approved simulation to reproduce the smallest harmless behaviour satisfying the hypothesis.", "expected": [ "Required events and fields are present", "The intended relationships survive ingestion", "The result contains enough context for triage" ] }, { "id": "T1528-N01", "class": "negative", "title": "Documented benign overlap", "procedure": "Exercise or replay a representative benign case such as: Legitimate application consent.", "expected": [ "Telemetry remains available for hunting", "The analytic does not create unjustified severity", "Any suppression is narrow and documented" ] }, { "id": "T1528-R01", "class": "resilience", "title": "Missing or degraded context", "procedure": "Repeat validation with one required field or related event unavailable.", "expected": [ "The failure mode is visible", "The result does not silently become confirmed coverage", "The gap receives an owner" ] } ], "acceptance_criteria": [ "Required telemetry and fields are measured in the intended scope", "Positive and benign cases behave as expected", "An analyst can explain the result", "Ownership, review date and response path are recorded" ], "triage": [ "Review scopes, publisher verification and tenant consent", "Trace token use across IPs and applications", "Identify mailbox, file or directory access after issuance", "Hunt for other users authorising the same application" ], "response": [ "Revoke affected tokens and sessions", "Remove malicious consent and service-principal grants", "Preserve identity audit records and investigate accessed resources" ], "lifecycle": { "package_owner": "Local detection team", "package_status": "engineering candidate", "created": "2026-08-20", "last_reviewed": "Not independently reviewed", "review_due": "Set during local implementation", "attack_version": "19.2", "technique_version": "1.5", "change_policy": "Review after ATT&CK, telemetry, analytic or validation changes." }, "references": [ { "title": "MITRE ATT&CK T1528 Steal Application Access Token", "url": "https://attack.mitre.org/techniques/T1528" }, { "title": "MITRE ATT&CK DET0515 Detection Strategy for T1528 - Steal Application Access Token", "url": "https://attack.mitre.org/detectionstrategies/DET0515" } ] }, { "id": "HXD-T1566.001-CANDIDATE", "technique_id": "T1566.001", "title": "Spearphishing Attachment detection engineering candidate", "status": "engineering-candidate", "starter": true, "scope": { "platforms": [ "Linux", "Windows", "macOS" ], "behaviour": "Use when a phishing message delivers a file intended to enable access or execution. Delivery alone does not prove that the recipient opened the file or that execution succeeded.", "not_covered": [ "A deployable product query", "Proof that the required telemetry exists locally", "Validation against the organisation's benign baseline" ] }, "hypothesis": "Use when a phishing message delivers a file intended to enable access or execution. Delivery alone does not prove that the recipient opened the file or that execution succeeded.", "official_detection": { "strategy_id": "DET0236", "strategy_name": "Detection Strategy for Spearphishing Attachment across OS Platforms", "url": "https://attack.mitre.org/detectionstrategies/DET0236", "analytic_id": "Local analytic design required", "description": "Use the official ATT&CK detection relationship as source context, then translate the behaviour and evidence requirements into the local event model.", "platforms": [ "Linux", "Windows", "macOS" ], "log_sources": [ { "component_id": "LOCAL-01", "component": "Telemetry requirement 1", "source": "Mail gateway: message ID, sender, recipient, URLs, attachments and verdicts", "channel": "Map to local schema" }, { "component_id": "LOCAL-02", "component": "Telemetry requirement 2", "source": "Endpoint: file creation, process lineage and document-reader child processes", "channel": "Map to local schema" }, { "component_id": "LOCAL-03", "component": "Telemetry requirement 3", "source": "Sandbox or static analysis: document relationships, macros and embedded objects", "channel": "Map to local schema" } ], "mutable_elements": [ "Event schema and field names", "Correlation window", "Environment baseline", "Severity and suppression policy" ] }, "data_requirements": [ { "source": "Primary behaviour telemetry", "acceptable_sensors": [ "Mail gateway: message ID, sender, recipient, URLs, attachments and verdicts" ], "required_fields": [ "Original message or defensible mail-gateway record", "Evidence separating delivery from open or execution" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Identity and execution context", "acceptable_sensors": [ "Endpoint: file creation, process lineage and document-reader child processes" ], "required_fields": [ "Attachment name, hash and MIME/file type" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Corroborating outcome telemetry", "acceptable_sensors": [ "Sandbox or static analysis: document relationships, macros and embedded objects" ], "required_fields": [ "Sender, recipient and delivery timestamp" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] } ], "analytic_logic": { "required": [ "Original message or defensible mail-gateway record", "Attachment name, hash and MIME/file type", "Sender, recipient and delivery timestamp", "Evidence separating delivery from open or execution" ], "elevating_context": [ "Search the attachment hash and filename across recipients", "Correlate document-reader processes with script interpreters or LOLBins", "Resolve embedded URLs and template relationships safely", "Identify mailbox rules or follow-on messages" ], "lowering_context": [ "Legitimate business attachments", "Automated invoice and document workflows", "Security-test messages" ], "decision": "Require the smallest defensible combination that separates the adversary-relevant claim from documented benign overlap. Keep weaker signals available for hunting." }, "benign_baseline": [ "Legitimate business attachments", "Automated invoice and document workflows", "Security-test messages" ], "known_blind_spots": [ "Required events or join fields are unavailable", "A vendor field is assumed equivalent without schema validation", "Testing covers only one positive path" ], "safe_validation_cases": [ { "id": "T1566001-P01", "class": "positive", "title": "Representative approved behaviour", "procedure": "Use an isolated test system or approved simulation to reproduce the smallest harmless behaviour satisfying the hypothesis.", "expected": [ "Required events and fields are present", "The intended relationships survive ingestion", "The result contains enough context for triage" ] }, { "id": "T1566001-N01", "class": "negative", "title": "Documented benign overlap", "procedure": "Exercise or replay a representative benign case such as: Legitimate business attachments.", "expected": [ "Telemetry remains available for hunting", "The analytic does not create unjustified severity", "Any suppression is narrow and documented" ] }, { "id": "T1566001-R01", "class": "resilience", "title": "Missing or degraded context", "procedure": "Repeat validation with one required field or related event unavailable.", "expected": [ "The failure mode is visible", "The result does not silently become confirmed coverage", "The gap receives an owner" ] } ], "acceptance_criteria": [ "Required telemetry and fields are measured in the intended scope", "Positive and benign cases behave as expected", "An analyst can explain the result", "Ownership, review date and response path are recorded" ], "triage": [ "Search the attachment hash and filename across recipients", "Correlate document-reader processes with script interpreters or LOLBins", "Resolve embedded URLs and template relationships safely", "Identify mailbox rules or follow-on messages" ], "response": [ "Preserve the original message and attachment", "Scope all recipients before deleting messages", "Contain endpoints only when execution or harmful follow-on activity is supported" ], "lifecycle": { "package_owner": "Local detection team", "package_status": "engineering candidate", "created": "2026-08-20", "last_reviewed": "Not independently reviewed", "review_due": "Set during local implementation", "attack_version": "19.2", "technique_version": "2.2", "change_policy": "Review after ATT&CK, telemetry, analytic or validation changes." }, "references": [ { "title": "MITRE ATT&CK T1566.001 Spearphishing Attachment", "url": "https://attack.mitre.org/techniques/T1566/001" }, { "title": "MITRE ATT&CK DET0236 Detection Strategy for Spearphishing Attachment across OS Platforms", "url": "https://attack.mitre.org/detectionstrategies/DET0236" } ] }, { "id": "HXD-T1566.002-CANDIDATE", "technique_id": "T1566.002", "title": "Spearphishing Link detection engineering candidate", "status": "engineering-candidate", "starter": true, "scope": { "platforms": [ "Identity Provider", "Linux", "Office Suite", "SaaS", "Windows", "macOS" ], "behaviour": "Use when a phishing message contains a link intended to produce access, credential theft or execution. Keep message delivery, link traversal and downstream outcome as separate claims.", "not_covered": [ "A deployable product query", "Proof that the required telemetry exists locally", "Validation against the organisation's benign baseline" ] }, "hypothesis": "Use when a phishing message contains a link intended to produce access, credential theft or execution. Keep message delivery, link traversal and downstream outcome as separate claims.", "official_detection": { "strategy_id": "DET0107", "strategy_name": "Detection Strategy for Spearphishing Links", "url": "https://attack.mitre.org/detectionstrategies/DET0107", "analytic_id": "Local analytic design required", "description": "Use the official ATT&CK detection relationship as source context, then translate the behaviour and evidence requirements into the local event model.", "platforms": [ "Identity Provider", "Linux", "Office Suite", "SaaS", "Windows", "macOS" ], "log_sources": [ { "component_id": "LOCAL-01", "component": "Telemetry requirement 1", "source": "Mail/SMS provider metadata and message identifiers", "channel": "Map to local schema" }, { "component_id": "LOCAL-02", "component": "Telemetry requirement 2", "source": "Secure web gateway, DNS and browser history", "channel": "Map to local schema" }, { "component_id": "LOCAL-03", "component": "Telemetry requirement 3", "source": "Identity-provider sign-in, consent and token events", "channel": "Map to local schema" }, { "component_id": "LOCAL-04", "component": "Telemetry requirement 4", "source": "Endpoint process/network lineage for downloaded payloads", "channel": "Map to local schema" } ], "mutable_elements": [ "Event schema and field names", "Correlation window", "Environment baseline", "Severity and suppression policy" ] }, "data_requirements": [ { "source": "Primary behaviour telemetry", "acceptable_sensors": [ "Mail/SMS provider metadata and message identifiers" ], "required_fields": [ "Message or provider record containing the URL", "Browser, proxy or identity evidence showing whether the URL was visited" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Identity and execution context", "acceptable_sensors": [ "Secure web gateway, DNS and browser history" ], "required_fields": [ "Complete URL and redirect chain" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Corroborating outcome telemetry", "acceptable_sensors": [ "Identity-provider sign-in, consent and token events" ], "required_fields": [ "Recipient and delivery time" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] } ], "analytic_logic": { "required": [ "Message or provider record containing the URL", "Complete URL and redirect chain", "Recipient and delivery time", "Browser, proxy or identity evidence showing whether the URL was visited" ], "elevating_context": [ "Expand redirects without submitting credentials", "Cluster domains, certificates, paths and page assets", "Correlate click time with sign-ins, downloads and process creation", "Search for other recipients and matching lure text" ], "lowering_context": [ "Marketing and tracking redirects", "Legitimate URL shorteners", "Security-awareness simulations" ], "decision": "Require the smallest defensible combination that separates the adversary-relevant claim from documented benign overlap. Keep weaker signals available for hunting." }, "benign_baseline": [ "Marketing and tracking redirects", "Legitimate URL shorteners", "Security-awareness simulations" ], "known_blind_spots": [ "Required events or join fields are unavailable", "A vendor field is assumed equivalent without schema validation", "Testing covers only one positive path" ], "safe_validation_cases": [ { "id": "T1566002-P01", "class": "positive", "title": "Representative approved behaviour", "procedure": "Use an isolated test system or approved simulation to reproduce the smallest harmless behaviour satisfying the hypothesis.", "expected": [ "Required events and fields are present", "The intended relationships survive ingestion", "The result contains enough context for triage" ] }, { "id": "T1566002-N01", "class": "negative", "title": "Documented benign overlap", "procedure": "Exercise or replay a representative benign case such as: Marketing and tracking redirects.", "expected": [ "Telemetry remains available for hunting", "The analytic does not create unjustified severity", "Any suppression is narrow and documented" ] }, { "id": "T1566002-R01", "class": "resilience", "title": "Missing or degraded context", "procedure": "Repeat validation with one required field or related event unavailable.", "expected": [ "The failure mode is visible", "The result does not silently become confirmed coverage", "The gap receives an owner" ] } ], "acceptance_criteria": [ "Required telemetry and fields are measured in the intended scope", "Positive and benign cases behave as expected", "An analyst can explain the result", "Ownership, review date and response path are recorded" ], "triage": [ "Expand redirects without submitting credentials", "Cluster domains, certificates, paths and page assets", "Correlate click time with sign-ins, downloads and process creation", "Search for other recipients and matching lure text" ], "response": [ "Block confirmed malicious destinations at appropriate controls", "Revoke sessions or reset credentials only when exposure is supported", "Preserve message, redirect and identity evidence before remediation" ], "lifecycle": { "package_owner": "Local detection team", "package_status": "engineering candidate", "created": "2026-08-20", "last_reviewed": "Not independently reviewed", "review_due": "Set during local implementation", "attack_version": "19.2", "technique_version": "2.8", "change_policy": "Review after ATT&CK, telemetry, analytic or validation changes." }, "references": [ { "title": "MITRE ATT&CK T1566.002 Spearphishing Link", "url": "https://attack.mitre.org/techniques/T1566/002" }, { "title": "MITRE ATT&CK DET0107 Detection Strategy for Spearphishing Links", "url": "https://attack.mitre.org/detectionstrategies/DET0107" } ] }, { "id": "HXD-T1685-CANDIDATE", "technique_id": "T1685", "title": "Disable or Modify Tools detection engineering candidate", "status": "engineering-candidate", "starter": true, "scope": { "platforms": [ "Containers", "ESXi", "IaaS", "Linux", "Network Devices", "Windows", "macOS" ], "behaviour": "Use when an adversary disables or modifies security tooling or its configuration. A sensor outage is not automatically tampering; distinguish administrative change, failure and adversary action.", "not_covered": [ "A deployable product query", "Proof that the required telemetry exists locally", "Validation against the organisation's benign baseline" ] }, "hypothesis": "Use when an adversary disables or modifies security tooling or its configuration. A sensor outage is not automatically tampering; distinguish administrative change, failure and adversary action.", "official_detection": { "strategy_id": "DET0497", "strategy_name": "Detection of Defense Impairment through Disabled or Modified Tools across OS Platforms.", "url": "https://attack.mitre.org/detectionstrategies/DET0497", "analytic_id": "Local analytic design required", "description": "Use the official ATT&CK detection relationship as source context, then translate the behaviour and evidence requirements into the local event model.", "platforms": [ "Containers", "ESXi", "IaaS", "Linux", "Network Devices", "Windows", "macOS" ], "log_sources": [ { "component_id": "LOCAL-01", "component": "Telemetry requirement 1", "source": "Security-product health and tamper events", "channel": "Map to local schema" }, { "component_id": "LOCAL-02", "component": "Telemetry requirement 2", "source": "Service, process, registry and policy changes", "channel": "Map to local schema" }, { "component_id": "LOCAL-03", "component": "Telemetry requirement 3", "source": "Administrative audit and endpoint process telemetry", "channel": "Map to local schema" } ], "mutable_elements": [ "Event schema and field names", "Correlation window", "Environment baseline", "Severity and suppression policy" ] }, "data_requirements": [ { "source": "Primary behaviour telemetry", "acceptable_sensors": [ "Security-product health and tamper events" ], "required_fields": [ "Security control, service or configuration affected", "Related execution or privilege context" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Identity and execution context", "acceptable_sensors": [ "Service, process, registry and policy changes" ], "required_fields": [ "Initiating identity and process" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] }, { "source": "Corroborating outcome telemetry", "acceptable_sensors": [ "Administrative audit and endpoint process telemetry" ], "required_fields": [ "Before-and-after state with timestamp" ], "quality_checks": [ "Measure field population and ingestion delay in the intended scope", "Confirm timestamps, identities and asset identifiers can be correlated", "Document blind spots instead of treating missing data as a negative result" ] } ], "analytic_logic": { "required": [ "Security control, service or configuration affected", "Initiating identity and process", "Before-and-after state with timestamp", "Related execution or privilege context" ], "elevating_context": [ "Scope the same change across hosts", "Correlate with privilege escalation and tool execution", "Compare against approved change records", "Measure missing telemetry during the impaired interval" ], "lowering_context": [ "Approved upgrades and troubleshooting", "Device decommissioning", "Temporary service failure or policy rollout" ], "decision": "Require the smallest defensible combination that separates the adversary-relevant claim from documented benign overlap. Keep weaker signals available for hunting." }, "benign_baseline": [ "Approved upgrades and troubleshooting", "Device decommissioning", "Temporary service failure or policy rollout" ], "known_blind_spots": [ "Required events or join fields are unavailable", "A vendor field is assumed equivalent without schema validation", "Testing covers only one positive path" ], "safe_validation_cases": [ { "id": "T1685-P01", "class": "positive", "title": "Representative approved behaviour", "procedure": "Use an isolated test system or approved simulation to reproduce the smallest harmless behaviour satisfying the hypothesis.", "expected": [ "Required events and fields are present", "The intended relationships survive ingestion", "The result contains enough context for triage" ] }, { "id": "T1685-N01", "class": "negative", "title": "Documented benign overlap", "procedure": "Exercise or replay a representative benign case such as: Approved upgrades and troubleshooting.", "expected": [ "Telemetry remains available for hunting", "The analytic does not create unjustified severity", "Any suppression is narrow and documented" ] }, { "id": "T1685-R01", "class": "resilience", "title": "Missing or degraded context", "procedure": "Repeat validation with one required field or related event unavailable.", "expected": [ "The failure mode is visible", "The result does not silently become confirmed coverage", "The gap receives an owner" ] } ], "acceptance_criteria": [ "Required telemetry and fields are measured in the intended scope", "Positive and benign cases behave as expected", "An analyst can explain the result", "Ownership, review date and response path are recorded" ], "triage": [ "Scope the same change across hosts", "Correlate with privilege escalation and tool execution", "Compare against approved change records", "Measure missing telemetry during the impaired interval" ], "response": [ "Restore trustworthy collection before declaring containment", "Isolate systems when deliberate impairment is supported", "Record visibility gaps created by the event" ], "lifecycle": { "package_owner": "Local detection team", "package_status": "engineering candidate", "created": "2026-08-20", "last_reviewed": "Not independently reviewed", "review_due": "Set during local implementation", "attack_version": "19.2", "technique_version": "1.0", "change_policy": "Review after ATT&CK, telemetry, analytic or validation changes." }, "references": [ { "title": "MITRE ATT&CK T1685 Disable or Modify Tools", "url": "https://attack.mitre.org/techniques/T1685" }, { "title": "MITRE ATT&CK DET0497 Detection of Defense Impairment through Disabled or Modified Tools across OS Platforms.", "url": "https://attack.mitre.org/detectionstrategies/DET0497" } ] } ] }