add additional MITRE ATT&CK and MBC mappings (#611)

nursery/decrypt-data-using-rsa.yml

@@ -5,6 +5,12 @@ rule:
     authors:
       - michael.hunhoff@mandiant.com
     scope: function
+    att&ck:
+      - Defense Evasion::Deobfuscate/Decode Files or Information [T1140]
+    mbc:
+      - Cryptography::Decrypt Data::RSA [C0031.010]
+    references:
+      - https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.rsacryptoserviceprovider.decrypt
   features:
     - or:
       - api: System.Security.Cryptography.RSACryptoServiceProvider::Decrypt

nursery/encrypt-data-using-rsa.yml

@@ -5,6 +5,13 @@ rule:
     authors:
       - michael.hunhoff@mandiant.com
     scope: function
+    att&ck:
+      - Defense Evasion::Obfuscated Files or Information [T1027]
+    mbc:
+      - Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05]
+      - Cryptography::Encrypt Data::RSA [C0027.011]
+    references:
+      - https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.rsacryptoserviceprovider.encrypt
   features:
     - or:
       - api: System.Security.Cryptography.RSACryptoServiceProvider::Encrypt

nursery/get-os-information-via-kuser_shared_data.yml

@@ -6,6 +6,8 @@ rule:
     authors:
       - "@mr-tz"
     scope: function
+    att&ck:
+      - Discovery::System Information Discovery [T1082]
     references:
       - https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/ntexapi_x/kuser_shared_data/index.htm
   features:

nursery/get-system-web-proxy.yml

@@ -5,6 +5,10 @@ rule:
     authors:
       - michael.hunhoff@mandiant.com
     scope: function
+    att&ck:
+      - Discovery::System Network Configuration Discovery [T1016]
+    references:
+      - https://docs.microsoft.com/en-us/dotnet/api/system.net.webrequest.getsystemwebproxy
   features:
     - and:
       - api: System.Net.WebRequest::GetSystemWebProxy

nursery/send-request-in-dotnet.yml

@@ -5,6 +5,8 @@ rule:
     authors:
       - anushka.virgaonakr@mandiant.com
     scope: function
+    att&ck:
+      - Command and Control::Application Layer Protocol::Web Protocols [T1071.001]
     mbc:
       - Communication::HTTP Communication::Send Request [C0002.003]
   features:

nursery/set-http-cookie.yml

@@ -5,6 +5,10 @@ rule:
     authors:
       - michael.hunhoff@mandiant.com
     scope: function
+    att&ck:
+      - Command and Control::Application Layer Protocol::Web Protocols [T1071.001]
+    references:
+      - https://docs.microsoft.com/en-us/dotnet/api/system.net.cookiecontainer.setcookies
   features:
     - and:
       - api: System.Net.CookieContainer::SetCookies