A custom, more useful, and much cooler MITRE-CTI-CLIENT.
```bash
cargo package manager#
#
$> cargo install mitre-assistant
```
You got 3 ways to start using this bad-boy:
1. You can go to the releases section, download the pre-compiled binary for your os. Note: I only provide Debian on Linux
2. If you already have rust stable toolchain installed, then simply use cargo install mitre-assistant
3. Or, if you just love building from source, follow the instructions in the build from source section below.
Head over to the releases section and download the binary for your OS. However, note, I am only supporting binaries for 64 bit versions of:
If you use a different Linux distro, install the rust toolchain, preferably the stable channel, and follow these steps:
bash
$> git clone https://github.com/dfirence/mitre-assistant.git
bash
$> cd mitre-assistant
bash
$> cargo build --release
In this step, if you wanna call the executable from anywhere, add it to your system path or executable path - i.e., /usr/bin
bash
$> sudo mv /target/release/mitre-assistant /usr/bin
I work in the Security industry for a provider, my work hinges a lot on this resource from The Mitre Corporation. At some point, if you are like me, you will observe the poor and ridiculous amount of time that is needed to create custom datasets from that resource and collaborate across teams to get into serious work. This helps me not waste time on silly things - i.e., clicking on some website, or asking important questions so I can incorporate the matrix into some form of tactical plans to defend my network, or support new strategies while working with others.
I have seen them, used them, and appreciate those that are writing their own. In the end, I am not gonna wait for anyone to do things the way I need them.
This is a modular tool. The main concept of using this tool is:
```text
(1) (2) (3)
| | |
| | |
[ Extract ]-------------[ Transform ]---------------[ Load ]
| | |
| | |
| | |
v v v
Download A Matrix Baseline The Matrix Search - Ask your question
```
Building from the above concept, let's get into using this bad-boy.
```bash cdiaz@[mitre-assistant]
./target/release/mitre-assistant -h
mitre-assistant v.0.0.1 carlos diaz | @dfirence
Mitre Attack Assistant
A more useful utility for the ATT&CK Matrix
USAGE: mitre-assistant [SUBCOMMAND]
FLAGS: -h, --help Prints help information -V, --version Prints version information
SUBCOMMANDS:
baseline Parse a Matrix into comprehensive insights
download Download a Matrix From The Mitre CTI Repo
help Prints this message or the help of the given subcommand(s)
search Search The Baseline
```
Use the download subcommand to get started, you can specific which matrix to download by using any of the keywords: enterprise or mobile or pre-attack
```bash
enterprise matrix# $> mitre-assistant download -m enterprise
Downlading Matrix : enterprise Downloading From : https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json
===========================================================================================
|__(+) New File To Be Created: /Users/alice/.mitre-assistant/matrixes/enterprise.json
```
Use the baseline subcommand after you download your matrix to create the custom database that is required before you conduct your searches.
You baseline a matrix with any of the keywords: enterprise or mobile or pre-attack
```bash $> mitre-assistant baseline -m enterprise
/Users/alice/.mitre-assistant/matrixes/enterprise.json
|__(+) New File To Be Created: /Users/alice/.mitre-assistant/baselines/baseline-enterprise.json
```
Now you are ready to search your matrix.
You have to tell the search subcommand which matrix it is going to work with by using:
-m parameter followed by the name of the matrix -t parameter to provide your search term.
|TERM|MATRIX|PURPOSE|
|----|------|-------|
|datasources|enterprise|Returns all datasources from the matrix|
|platforms|enterprise|Returns all the platforms (operating systems) from the matrix|
|nodatasources|enterprise|Returns all techniques without datasources|
|nosub|enterprise|Returns all the active techniques which do not have/use subtechniques|
|revoked|enterprise|Returns all of the technique id & name references revoked by Mitre|
|stats|enterprise|Returns an overview of uniq counts and total counts of key data elements|
|subtechniques|enterprise|Returns all subtechniques from the matrix|
|techniques|enterprise|Returns all techniques from the matrix|
You use the keyword stats in your search term, like this
```bash
#
$> mitre-assistant search -m enterprise -t "stats"
```
|UNIQUES & TOTALS|
|-----------------|
|
|
| TECHNIQUES | SUBTECHNIQUES|
|------------|--------------|
|
|
|
```bash
#
$> mitre-assistant search -m enterprise -t "t1021"
```
Cool, now you just have to add a comma , in your term and launch it again, dead-simple!
```bash
# $> mitre-assistant search -m enterprise -t "t1021,t1048"
```
Another cool thing here is display the subtechniques for your query by using:
-s flag after your query```bash
$> mitre-assistant search -m enterprise -t "t1021" -s
```
Revoked techniques seem to be those that are discontinued and re-arranged now into subtechniques. You can search for the ones revoked in the matrix by using a keyword in your search term:
-t parameters with the term revoked```bash
#
$> mitre-assistant search -m enterprise -t "revoked"
```
```text Protip:
Example:
Mitre currently has these two datasources, what does this mean?
To me in the security Space, there's only one source, not two.
```
Datasources are a non-concrete description by Mitre that seems to suggest the context of evidence needed to be successful at pursuing visibility or detection capabilities for the given technique. This query gets you the datasources as provided by Mitre in their CTI github
-t parameters with the term datasources```bash
# $> mitre-assistant -m enterprise -t "datasources" ```
Platforms are the relevant operating systems where a technique is exercised or abused by an adversary. To get the platforms in the enterprise matrix use the keyword platforms.
-t parameters with the term platforms```bash
# $> mitre-assistant -m enterprise -t "platforms" ```
This is the edge-case that drove to create this tool for myself. I found someone's tool incorrectly parsed the matrix and I needed to report to my management the plan of action based on data sources. This is very important for practitioners who leverage the matrix for real world tactical operations.
Reference this example: NODATASOURCE_SAMPLE
Use the keyword nodatasources to obtain a list of active techniques that may not have an assigned datasource by Mitre.
-t parameters with the term nodatasources```bash
# $> mitre-assistant -m enterprise -t "nodatasources" ```
As I mentioned, my work with this matrix is at the provider level, I have to devise coverage plans, or brainstorming workshops with my fellow blue-teamers to understand what an emulation plan means in terms of effort, engineering for new content and consequently sizing our systems to increase our visibility and detection needs.
These experiments were very useful to me a couple of years ago as I started learning about the Mitre ATT&CK matrixes.
Many super kudos, to the amazing RUST Community, for their warm embrace of everyone that wants the journey. Seemingly, to all of the super creators of loved tools from python being ported into rust.