diff --git a/notebooks/cisa_commonalities_notebook.ipynb b/notebooks/cisa_commonalities_notebook.ipynb new file mode 100644 index 0000000000..2948a4b7f7 --- /dev/null +++ b/notebooks/cisa_commonalities_notebook.ipynb @@ -0,0 +1,13049 @@ +{ + "cells": [ + { + "cell_type": "markdown", + "id": "8aae63e7-6918-4035-9617-92110e462324", + "metadata": {}, + "source": [ + "### Description\n", + "\n", + "a simple jupyter notebook that helps Splunk Threat Research Team see the data connections, commonalities and differences of security content stories or threat families.This helps us to look for visualizing the common TTP’s and tooling used by adversaries or threat actors based on the Security content analytics we developed in each analytic story.\n" + ] + }, + { + "cell_type": "code", + "execution_count": 1, + "id": "78b65762-08c4-4100-bdd8-dcf162b09e73", + "metadata": {}, + "outputs": [], + "source": [ + "__author__ = \"Teoderick Contreras STRT\"\n", + "import os\n", + "import argparse\n", + "from pathlib import Path\n", + "import json\n", + "import csv\n", + "import yaml\n", + "from collections import defaultdict\n", + "import pandas as pd\n", + "import numpy as np\n", + "from IPython.display import display, HTML" + ] + }, + { + "cell_type": "code", + "execution_count": 2, + "id": "1e73c539-8e4e-40be-973a-72d7d1f3a93e", + "metadata": {}, + "outputs": [], + "source": [ + "SECURITY_CONTENT_PATH = \"~/security_content/detections/\"\n", + "sec_content_name_and_story = defaultdict(list)\n", + "mitre_attack_id_info_dict = defaultdict(list)\n", + "mitre_attack_tid_dict = defaultdict(list)\n", + "mitre_attack_fn_dict = defaultdict(list)\n", + "mitre_attack_story_dict = defaultdict(list)\n", + "mitre_attack_tid_name_dict = defaultdict(list)\n", + "home_path = Path.home()\n", + "story_detection_list = []" + ] + }, + { + "cell_type": "code", + "execution_count": 3, + "id": "bf35a8ba-2f3f-4983-85c8-e7a1ba4c3802", + "metadata": { + "tags": [] + }, + "outputs": [], + "source": [ + "def display_side_by_side(dfs:list, captions:list):\n", + " \"\"\"Display tables side by side to save vertical space\n", + " Input:\n", + " dfs: list of pandas.DataFrame\n", + " captions: list of table captions\n", + " \"\"\"\n", + " output = \"\"\n", + " combined = dict(zip(captions, dfs))\n", + " for caption, df in combined.items():\n", + " output += df.style.set_table_attributes(\"style='display:inline'\").set_caption(caption)._repr_html_()\n", + " output += \"\\xa0\\xa0\\xa0\"\n", + " display(HTML(output))\n", + "\n", + "def expand_path(file_path):\n", + " if \"~\" in file_path:\n", + " return str(file_path).replace(\"~\", str(home_path))\n", + " else:\n", + " return file_path\n", + "\n", + "def generate_name_and_story_dict(sec_content_path, story):\n", + " \n", + " for roots, dirs, files in os.walk(sec_content_path):\n", + " temp_file_name = \"\"\n", + " #print(\"[+] enumerating yml files in: {0}\".format(roots))\n", + " detection_base_dir_name = os.path.basename(roots)\n", + " \n", + " for f in files:\n", + " temp_file_name = os.path.join(detection_base_dir_name, f)\n", + " file_path = os.path.join(roots, f)\n", + " if file_path.endswith(\".yml\"):\n", + " parse_yml_file(file_path, temp_file_name, story)\n", + " print(\"[+] total detection found: {0}\".format(len(story_detection_list)))\n", + " return\n", + " \n", + "def parse_yml_file(file_path, base_file_name, story):\n", + " file_name = os.path.basename(base_file_name)\n", + " mitre_tid = \"\"\n", + " tid_json_obj = load_attack_id_json()\n", + " with open(file_path, \"r\") as f:\n", + " yml_buff = yaml.safe_load(f)\n", + " \n", + " for s in story:\n", + " s = s.strip()\n", + " if s in yml_buff['tags']['analytic_story']:\n", + "\n", + " sec_content_name_and_story[s].append(file_name)\n", + " print(\" [{0}] : {1}\".format(s, base_file_name))\n", + " story_detection_list.append(base_file_name)\n", + " #f_name = \"-\".join(yml_buff['tags'][\"mitre_attack_id\"]) + \":\" + file_name \n", + " f_name = file_name\n", + "\n", + "\n", + " mitre_attack_id_info_dict[f_name].append(s)\n", + " for m in yml_buff['tags'][\"mitre_attack_id\"]:\n", + "\n", + " mitre_attack_tid_dict[m].append(s)\n", + " mitre_attack_tid_dict[m] = sorted(list(set(mitre_attack_tid_dict[m])))\n", + " \n", + " mitre_attack_fn_dict[m].append(s + \":\" +file_name)\n", + " mitre_attack_fn_dict[m] = sorted(list(set(mitre_attack_fn_dict[m])))\n", + " \n", + "\n", + " mitre_attack_story_dict[s].append(m)\n", + " mitre_attack_story_dict[s] = sorted(list(set(mitre_attack_story_dict[s])))\n", + " \n", + " new_key = m + \"-\" + tid_json_obj[m].replace(\" \", \"_\")\n", + " mitre_attack_tid_name_dict[new_key].append(s)\n", + " mitre_attack_tid_name_dict[new_key] = sorted(list(set(mitre_attack_tid_name_dict[new_key])))\n", + " #logger.info(self.mitre_attack_id_info_dict[file_name])\n", + " #for mitre_tid in yml_buff['tags']['mitre_attack_id']:\n", + " # self.mitre_attack_tid_dict[mitre_tid].append(s)\n", + " \n", + " return\n", + "\n", + "def load_attack_id_json():\n", + " template_path = os.path.join(os.getcwd(), \"templates\")\n", + " tid_json_path = os.path.join(template_path, \"tid.json\")\n", + " with open(tid_json_path, \"r\") as f:\n", + " tid_json_obj = json.load(f)\n", + " return tid_json_obj\n", + "\n", + "def process_sec_content(story_list):\n", + " debug = 0\n", + " print(\" [+] story coverage needed: {0}\".format(story_list))\n", + " normalized_security_content_path = expand_path(SECURITY_CONTENT_PATH)\n", + " generate_name_and_story_dict(normalized_security_content_path, story_list)\n", + " if debug == 1:\n", + " print(\"\\n-----------------------------\\n[-] detection name vs analytic story - mitre_attack_id_info_dict \\n-----------------------------\\n\")\n", + " for k, v in mitre_attack_id_info_dict.items():\n", + " print(\"[{0}] detection name: {1} related story: {2}\".format(len(v), k, v)) \n", + " print(\"\\n-----------------------------\\n[-] mitre attack id vs analytic story - mitre_attack_tid_dict \\n-----------------------------\\n\")\n", + " for k, v in mitre_attack_tid_dict.items():\n", + " print(\"[{0}] {1} {2}\".format(len(list(set(v))), k, list(set(v))))\n", + " print(\"\\n-----------------------------\\n[-] mitre attack id vs story:detectioname - mitre_attack_fn_dict \\n-----------------------------\\n\")\n", + " for k, v in mitre_attack_fn_dict.items():\n", + " print(\"[{0}] {1} {2}\".format(len(list(set(v))), k, list(set(v)))) \n", + " print(\"\\n-----------------------------\\n[-] story vs id - mitre_attack_story_dict \\n-----------------------------\\n\")\n", + " for k, v in mitre_attack_story_dict.items():\n", + " print(\"[{0}] {1} {2}\".format(len(list(set(v))), k, list(set(v)))) \n", + " \n", + "def highlight_cells_5(val):\n", + " color= \"\"\n", + " for k ,v in mitre_attack_tid_dict.items():\n", + " if val == k and len(v) == 5:\n", + " color = 'yellow'\n", + " return 'background-color: {}'.format(color)\n", + "\n", + "def highlight_cells_4(val):\n", + " color= \"\"\n", + " for k ,v in mitre_attack_tid_dict.items():\n", + " if val == k and len(v) == 4:\n", + " color = 'orange'\n", + " return 'background-color: {}'.format(color)\n", + " \n", + "def highlight_cells_3(val):\n", + " color= \"\"\n", + " for k ,v in mitre_attack_tid_dict.items():\n", + " if val == k and len(v) == 3:\n", + " color = 'lightgreen'\n", + " return 'background-color: {}'.format(color)\n", + "\n", + "def highlight_cells_2(val):\n", + " color= \"\"\n", + " for k ,v in mitre_attack_tid_dict.items():\n", + " if val == k and len(v) == 2:\n", + " color = 'lightblue'\n", + " return 'background-color: {}'.format(color)\n", + "\n", + "def highlight_cells_1(val):\n", + " color= \"\"\n", + " for k ,v in mitre_attack_tid_dict.items():\n", + " if val == k and len(v) == 1:\n", + " color = 'lightgray'\n", + " return 'background-color: {}'.format(color)\n", + "\n", + "def summary_table_of_id(dict_name, det_len): \n", + " temp_dict = {} \n", + " for k, v in dict_name.items():\n", + " if len(v) == det_len:\n", + " temp_dict[k] = v \n", + " return temp_dict\n", + "\n", + "def detection_list_by_count(det_table_dict): \n", + " detection_count_by_id = {}\n", + " for k, det_dict in det_table_dict.items():\n", + " t = {}\n", + " for s_, d in det_dict.items():\n", + " t[s_] = \"(\" + str(len(d)) + \")-detection count\"\n", + " detection_count_by_id[k] = t \n", + " return pd.DataFrame.from_dict(detection_count_by_id, orient='index')\n", + "\n", + "def detection_list_by_id(temp_dict): \n", + " det_table_dict = {}\n", + " for k, v in temp_dict.items():\n", + " temp_d = defaultdict(list)\n", + " for fn in mitre_attack_fn_dict[k]:\n", + " s_,d = fn.split(\":\")\n", + " temp_d[s_].append(d)\n", + " det_table_dict[k] = temp_d\n", + " \n", + " return det_table_dict\n", + "\n", + "\n", + "def highlight_cells(val):\n", + " color= \"\"\n", + " for k ,v in mitre_attack_tid_dict.items():\n", + " if val == k and len(v) == 5:\n", + " color = 'yellow'\n", + " return 'background-color: {}'.format(color)\n", + " elif val == k and len(v) == 4:\n", + " color = 'orange'\n", + " return 'background-color: {}'.format(color)\n", + " elif val == k and len(v) == 3:\n", + " color = 'lightgreen'\n", + " return 'background-color: {}'.format(color)\n", + " elif val == k and len(v) == 2:\n", + " color = 'lightblue'\n", + " return 'background-color: {}'.format(color)\n", + " elif val == k and len(v) == 1:\n", + " color = 'lightgray' \n", + " return 'background-color: {}'.format(color)\n", + "\n", + "def highlight_legend(val):\n", + " color= \"\"\n", + " if val == \"yellow\":\n", + " color = 'yellow'\n", + " return 'background-color: {}'.format(color)\n", + " elif val == 'orange':\n", + " color = 'orange'\n", + " return 'background-color: {}'.format(color)\n", + " elif val == 'lightgreen':\n", + " color = 'lightgreen'\n", + " return 'background-color: {}'.format(color)\n", + " elif val == 'lightblue':\n", + " color = 'lightblue'\n", + " return 'background-color: {}'.format(color)\n", + " elif val == \"lightgray\":\n", + " color = 'lightgray' \n", + " return 'background-color: {}'.format(color)\n", + "\n", + "def highlight_nan(val):\n", + " color= \"\"\n", + " if val == \"NaN\":\n", + " color = 'black'\n", + " return 'background-color: {}'.format(color)\n", + " \n", + "def show_legend():\n", + " color_dict = {\"5 malware coverage\":\"yellow\", \"4 malware coverage\":\"orange\", \"3 malware coverage\":\"lightgreen\", \"2 malware coverage\":\"lightblue\", \"1 malware coverage\":\"lightgray\"}\n", + " cf = pd.DataFrame.from_dict(color_dict, orient='index')\n", + " \n", + " return cf.style.applymap(highlight_legend)" + ] + }, + { + "cell_type": "code", + "execution_count": 4, + "id": "293bd920-aeac-405e-8a4a-4291fe6abbbe", + "metadata": {}, + "outputs": [], + "source": [ + "def main():\n", + " \n", + " pd.options.display.max_colwidth = 1000\n", + " pd.set_option('display.max_rows', 500)\n", + " story_list = [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\"]\n", + " process_sec_content(story_list)\n", + " \n", + " return" + ] + }, + { + "cell_type": "markdown", + "id": "74a4cf30-31a9-4cb1-9a26-a4f88cdc5605", + "metadata": {}, + "source": [ + "### Scan Detections\n", + "Scanning Splunk Security Content Analytic Detections related to the 5 CISA Malware family that STRT worked on." + ] + }, + { + "cell_type": "code", + "execution_count": 5, + "id": "926af3fd-3b64-4d3f-8bb7-f839e5aaf45a", + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + " [+] story coverage needed: ['Qakbot', 'Azorult', 'Remcos', 'Trickbot', 'AgentTesla']\n", + " [Remcos] : endpoint/powershell_windows_defender_exclusion_commands.yml\n", + " [AgentTesla] : endpoint/powershell_windows_defender_exclusion_commands.yml\n", + " [Remcos] : endpoint/vbscript_execution_using_wscript_app.yml\n", + " [Azorult] : endpoint/windows_remote_service_rdpwinst_tool_execution.yml\n", + " [Azorult] : endpoint/excessive_attempt_to_disable_services.yml\n", + " [Qakbot] : endpoint/windows_process_injection_remote_thread.yml\n", + " [Azorult] : endpoint/windows_remote_access_software_rms_registry.yml\n", + " [Azorult] : endpoint/windows_remote_services_allow_remote_assistance.yml\n", + " [Qakbot] : endpoint/system_user_discovery_with_whoami.yml\n", + " [Trickbot] : endpoint/wermgr_process_create_executable_file.yml\n", + " [Qakbot] : endpoint/windows_iso_lnk_file_creation.yml\n", + " [Azorult] : endpoint/windows_iso_lnk_file_creation.yml\n", + " [Remcos] : endpoint/windows_iso_lnk_file_creation.yml\n", + " [AgentTesla] : endpoint/windows_iso_lnk_file_creation.yml\n", + " [Qakbot] : endpoint/windows_system_discovery_using_qwinsta.yml\n", + " [Azorult] : endpoint/windows_impair_defense_add_xml_applocker_rules.yml\n", + " [Qakbot] : endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n", + " [Trickbot] : endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n", + " [Remcos] : endpoint/remcos_rat_file_creation_in_remcos_folder.yml\n", + " [Azorult] : endpoint/hide_user_account_from_sign_in_screen.yml\n", + " [Trickbot] : endpoint/wermgr_process_connecting_to_ip_check_web_services.yml\n", + " [Azorult] : endpoint/processes_launching_netsh.yml\n", + " [Azorult] : endpoint/icacls_deny_command.yml\n", + " [Remcos] : endpoint/suspicious_process_dns_query_known_abuse_web_services.yml\n", + " [Azorult] : endpoint/excessive_usage_of_taskkill.yml\n", + " [AgentTesla] : endpoint/excessive_usage_of_taskkill.yml\n", + " [Azorult] : endpoint/windows_remote_services_allow_rdp_in_firewall.yml\n", + " [Azorult] : endpoint/allow_operation_with_consent_admin.yml\n", + " [Remcos] : endpoint/suspicious_wav_file_in_appdata_folder.yml\n", + " [Azorult] : endpoint/windows_remote_services_rdp_enable.yml\n", + " [Qakbot] : endpoint/network_connection_discovery_netstat.yml\n", + " [AgentTesla] : endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml\n", + " [Azorult] : endpoint/windows_modify_registry_regedit_silent_reg_import.yml\n", + " [Qakbot] : endpoint/cmdline_tool_not_executed_in_cmd_shell.yml\n", + " [Qakbot] : endpoint/windows_wmi_process_call_create.yml\n", + " [Qakbot] : endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n", + " [Remcos] : endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n", + " [Qakbot] : endpoint/windows_masquerading_explorer_as_child_process.yml\n", + " [Qakbot] : endpoint/schtasks_run_task_on_demand.yml\n", + " [Qakbot] : endpoint/network_connection_discovery_arp.yml\n", + " [Qakbot] : endpoint/create_remote_thread_in_shell_application.yml\n", + " [Azorult] : endpoint/disable_windows_behavior_monitoring.yml\n", + " [Azorult] : endpoint/excessive_usage_of_cacls_app.yml\n", + " [Remcos] : endpoint/loading_of_dynwrapx_module.yml\n", + " [Remcos] : endpoint/possible_browser_pass_view_parameter.yml\n", + " [Qakbot] : endpoint/network_discovery_using_route_windows_app.yml\n", + " [Trickbot] : endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n", + " [Qakbot] : endpoint/malicious_powershell_process___encoded_command.yml\n", + " [AgentTesla] : endpoint/windows_drivers_loaded_by_signature.yml\n", + " [Qakbot] : endpoint/suspicious_regsvr32_register_suspicious_path.yml\n", + " [Qakbot] : endpoint/recon_avproduct_through_pwh_or_wmi.yml\n", + " [Azorult] : endpoint/suspicious_scheduled_task_from_public_directory.yml\n", + " [AgentTesla] : endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n", + " [Remcos] : endpoint/remcos_client_registry_install_entry.yml\n", + " [Qakbot] : endpoint/windows_dll_side_loading_in_calc.yml\n", + " [Qakbot] : endpoint/office_product_spawn_cmd_process.yml\n", + " [Azorult] : endpoint/office_product_spawn_cmd_process.yml\n", + " [Remcos] : endpoint/office_product_spawn_cmd_process.yml\n", + " [Trickbot] : endpoint/office_product_spawn_cmd_process.yml\n", + " [AgentTesla] : endpoint/office_product_spawn_cmd_process.yml\n", + " [Trickbot] : endpoint/cobalt_strike_named_pipes.yml\n", + " [Remcos] : endpoint/suspicious_image_creation_in_appdata_folder.yml\n", + " [Azorult] : endpoint/create_local_admin_accounts_using_net_exe.yml\n", + " [Qakbot] : endpoint/disable_defender_spynet_reporting.yml\n", + " [Azorult] : endpoint/disable_defender_spynet_reporting.yml\n", + " [Remcos] : endpoint/office_product_spawning_windows_script_host.yml\n", + " [Remcos] : endpoint/process_deleting_its_process_file_path.yml\n", + " [Qakbot] : endpoint/cmd_carry_out_string_command_parameter.yml\n", + " [Azorult] : endpoint/cmd_carry_out_string_command_parameter.yml\n", + " [Trickbot] : endpoint/office_application_spawn_rundll32_process.yml\n", + " [AgentTesla] : endpoint/office_application_spawn_rundll32_process.yml\n", + " [Azorult] : endpoint/excessive_usage_of_net_app.yml\n", + " [Azorult] : endpoint/disabling_remote_user_account_control.yml\n", + " [Remcos] : endpoint/disabling_remote_user_account_control.yml\n", + " [AgentTesla] : endpoint/disabling_remote_user_account_control.yml\n", + " [Qakbot] : endpoint/windows_command_shell_fetch_env_variables.yml\n", + " [Azorult] : endpoint/firewall_allowed_program_enable.yml\n", + " [Qakbot] : endpoint/recon_using_wmi_class.yml\n", + " [Qakbot] : endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml\n", + " [Qakbot] : endpoint/windows_system_discovery_using_ldap_nslookup.yml\n", + " [Qakbot] : endpoint/windows_service_created_with_suspicious_service_path.yml\n", + " [Trickbot] : endpoint/trickbot_named_pipe.yml\n", + " [Qakbot] : endpoint/system_processes_run_from_unexpected_locations.yml\n", + " [AgentTesla] : endpoint/suspicious_driver_loaded_path.yml\n", + " [Azorult] : endpoint/windows_disableantispyware_reg.yml\n", + " [Azorult] : endpoint/office_product_spawning_mshta.yml\n", + " [Azorult] : endpoint/network_connection_discovery_net.yml\n", + " [Qakbot] : endpoint/windows_process_injection_wermgr_child_process.yml\n", + " [Azorult] : endpoint/sc_exe_manipulating_windows_services.yml\n", + " [Qakbot] : endpoint/suspicious_process_file_path.yml\n", + " [Azorult] : endpoint/suspicious_process_file_path.yml\n", + " [Remcos] : endpoint/suspicious_process_file_path.yml\n", + " [Trickbot] : endpoint/suspicious_process_file_path.yml\n", + " [AgentTesla] : endpoint/suspicious_process_file_path.yml\n", + " [Qakbot] : endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml\n", + " [AgentTesla] : endpoint/windows_multi_hop_proxy_tor_website_query.yml\n", + " [Remcos] : endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n", + " [Azorult] : endpoint/non_firefox_process_access_firefox_profile_dir.yml\n", + " [Remcos] : endpoint/non_firefox_process_access_firefox_profile_dir.yml\n", + " [AgentTesla] : endpoint/non_firefox_process_access_firefox_profile_dir.yml\n", + " [Azorult] : endpoint/windows_service_stop_by_deletion.yml\n", + " [Trickbot] : endpoint/schedule_task_with_rundll32_command_trigger.yml\n", + " [Remcos] : endpoint/jscript_execution_using_cscript_app.yml\n", + " [Qakbot] : endpoint/services_exe_lolbas_execution_process_spawn.yml\n", + " [Azorult] : endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml\n", + " [Qakbot] : endpoint/windows_regsvr32_renamed_binary.yml\n", + " [Remcos] : endpoint/winhlp32_spawning_a_process.yml\n", + " [Azorult] : endpoint/attempt_to_stop_security_service.yml\n", + " [Trickbot] : endpoint/attempt_to_stop_security_service.yml\n", + " [Azorult] : endpoint/excessive_usage_of_sc_service_utility.yml\n", + " [Remcos] : endpoint/non_chrome_process_accessing_chrome_default_dir.yml\n", + " [AgentTesla] : endpoint/non_chrome_process_accessing_chrome_default_dir.yml\n", + " [Azorult] : endpoint/chcp_command_execution.yml\n", + " [Qakbot] : endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n", + " [Azorult] : endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n", + " [Trickbot] : endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n", + " [AgentTesla] : endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n", + " [Azorult] : endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml\n", + " [Trickbot] : endpoint/account_discovery_with_net_app.yml\n", + " [Trickbot] : endpoint/suspicious_rundll32_startw.yml\n", + " [Azorult] : endpoint/windows_modify_registry_disallow_windows_app.yml\n", + " [AgentTesla] : endpoint/detect_html_help_spawn_child_process.yml\n", + " [Qakbot] : endpoint/suspicious_copy_on_system32.yml\n", + " [Azorult] : endpoint/disable_defender_submit_samples_consent_feature.yml\n", + " [Azorult] : endpoint/windows_powershell_import_applocker_policy.yml\n", + " [Trickbot] : endpoint/executable_file_written_in_administrative_smb_share.yml\n", + " [Azorult] : endpoint/wmic_noninteractive_app_uninstallation.yml\n", + " [Qakbot] : endpoint/office_document_executing_macro_code.yml\n", + " [Azorult] : endpoint/office_document_executing_macro_code.yml\n", + " [Remcos] : endpoint/office_document_executing_macro_code.yml\n", + " [Trickbot] : endpoint/office_document_executing_macro_code.yml\n", + " [AgentTesla] : endpoint/office_document_executing_macro_code.yml\n", + " [Azorult] : endpoint/disable_show_hidden_files.yml\n", + " [Azorult] : endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n", + " [Azorult] : endpoint/windows_valid_account_with_never_expires_password.yml\n", + " [Qakbot] : endpoint/winevent_windows_task_scheduler_event_action_started.yml\n", + " [AgentTesla] : endpoint/windows_mail_protocol_in_non_common_process_path.yml\n", + " [Remcos] : endpoint/system_info_gathering_using_dxdiag_application.yml\n", + " [Remcos] : endpoint/process_writing_dynamicwrapperx.yml\n", + " [Qakbot] : endpoint/windows_process_injection_of_wermgr_to_known_browser.yml\n", + " [Remcos] : endpoint/add_or_set_windows_defender_exclusion.yml\n", + " [AgentTesla] : endpoint/add_or_set_windows_defender_exclusion.yml\n", + " [Trickbot] : endpoint/powershell_remote_thread_to_known_windows_process.yml\n", + " [Azorult] : endpoint/disable_defender_enhanced_notification.yml\n", + " [Azorult] : endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n", + " [Trickbot] : endpoint/office_product_spawning_certutil.yml\n", + " [AgentTesla] : endpoint/office_product_spawning_certutil.yml\n", + " [AgentTesla] : endpoint/office_application_drop_executable.yml\n", + " [Qakbot] : endpoint/process_creating_lnk_file_in_suspicious_location.yml\n", + " [Qakbot] : endpoint/executables_or_script_creation_in_suspicious_path.yml\n", + " [Azorult] : endpoint/executables_or_script_creation_in_suspicious_path.yml\n", + " [Remcos] : endpoint/executables_or_script_creation_in_suspicious_path.yml\n", + " [Trickbot] : endpoint/executables_or_script_creation_in_suspicious_path.yml\n", + " [AgentTesla] : endpoint/executables_or_script_creation_in_suspicious_path.yml\n", + " [Azorult] : endpoint/windows_modify_registry_suppress_win_defender_notif.yml\n", + " [Qakbot] : endpoint/nltest_domain_trust_discovery.yml\n", + " [Qakbot] : endpoint/windows_modify_registry_qakbot_binary_data_registry.yml\n", + " [Qakbot] : endpoint/windows_defender_exclusion_registry_entry.yml\n", + " [Azorult] : endpoint/windows_defender_exclusion_registry_entry.yml\n", + " [Remcos] : endpoint/windows_defender_exclusion_registry_entry.yml\n", + " [Qakbot] : endpoint/office_application_spawn_regsvr32_process.yml\n", + " [Qakbot] : endpoint/windows_wmi_impersonate_token.yml\n", + " [Azorult] : endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml\n", + " [Azorult] : endpoint/windows_modify_registry_disable_windows_security_center_notif.yml\n", + " [Azorult] : endpoint/windows_modify_registry_disable_toast_notifications.yml\n", + " [Azorult] : endpoint/hiding_files_and_directories_with_attrib_exe.yml\n", + " [Remcos] : endpoint/wscript_or_cscript_suspicious_child_process.yml\n", + " [AgentTesla] : endpoint/powershell___connect_to_internet_with_hidden_window.yml\n", + " [Azorult] : endpoint/disable_defender_blockatfirstseen_feature.yml\n", + " [Qakbot] : endpoint/windows_phishing_recent_iso_exec_registry.yml\n", + " [Azorult] : endpoint/windows_phishing_recent_iso_exec_registry.yml\n", + " [Remcos] : endpoint/windows_phishing_recent_iso_exec_registry.yml\n", + " [AgentTesla] : endpoint/windows_phishing_recent_iso_exec_registry.yml\n", + " [Qakbot] : endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml\n", + " [Azorult] : endpoint/net_localgroup_discovery.yml\n", + " [Azorult] : endpoint/windows_modify_registry_disabling_wer_settings.yml\n", + " [Qakbot] : endpoint/windows_dll_side_loading_process_child_of_calc.yml\n", + " [Qakbot] : endpoint/registry_keys_used_for_persistence.yml\n", + " [Azorult] : endpoint/registry_keys_used_for_persistence.yml\n", + " [Remcos] : endpoint/registry_keys_used_for_persistence.yml\n", + " [Azorult] : endpoint/windows_impair_defense_deny_security_software_with_applocker.yml\n", + " [AgentTesla] : endpoint/windows_driver_load_non_standard_path.yml\n", + " [Qakbot] : endpoint/windows_schtasks_create_run_as_system.yml\n", + " [Remcos] : endpoint/malicious_inprocserver32_modification.yml\n", + "[+] total detection found: 184\n" + ] + } + ], + "source": [ + "if __name__ == \"__main__\":\n", + " main()" + ] + }, + { + "cell_type": "code", + "execution_count": 6, + "id": "74eef86f-b203-447d-96e0-231744aa1c66", + "metadata": { + "tags": [] + }, + "outputs": [ + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
RemcosAgentTeslaAzorultQakbotTrickbot
0T1036T1014T1021T1016T1021
1T1055T1036T1021.001T1016.001T1021.002
2T1055.001T1053T1036T1027T1027
3T1059T1053.005T1049T1033T1036
4T1059.005T1059T1053T1036T1053
5T1059.007T1059.001T1053.005T1036.003T1053.005
6T1070T1068T1059T1047T1055
7T1112T1071T1059.001T1049T1059
8T1113T1071.003T1059.003T1053T1087
9T1134T1204T1069T1053.005T1087.002
10T1134.004T1204.001T1069.001T1055T1218
11T1204T1218T1071T1055.001T1218.005
12T1204.001T1218.001T1112T1055.002T1218.011
13T1218T1543T1136T1059T1543
14T1218.010T1543.003T1136.001T1059.001T1562
15T1543T1548T1204T1059.003T1562.001
16T1547T1548.002T1204.001T1059.007T1566
17T1547.001T1555T1219T1071T1566.001
18T1548T1555.003T1222T1112T1590
19T1548.002T1562T1222.001T1204T1590.005
20T1555T1562.001T1489T1204.001NaN
21T1555.003T1566T1531T1218NaN
22T1559.001T1566.001T1543T1218.010NaN
23T1562NaNT1543.003T1482NaN
24T1562.001NaNT1547T1543NaN
25T1566NaNT1547.001T1543.003NaN
26T1566.001NaNT1548T1547NaN
27T1592NaNT1548.002T1547.001NaN
28NaNNaNT1555T1562NaN
29NaNNaNT1555.003T1562.001NaN
30NaNNaNT1562T1566NaN
31NaNNaNT1562.001T1566.001NaN
32NaNNaNT1562.004T1566.002NaN
33NaNNaNT1564T1569NaN
34NaNNaNT1564.001T1569.002NaN
35NaNNaNT1566T1574NaN
36NaNNaNT1566.001T1574.001NaN
37NaNNaNT1569T1574.002NaN
38NaNNaNT1569.002T1592NaN
39NaNNaNT1590NaNNaN
40NaNNaNT1590.005NaNNaN
\n", + "
" + ], + "text/plain": [ + " Remcos AgentTesla Azorult Qakbot Trickbot\n", + "0 T1036 T1014 T1021 T1016 T1021\n", + "1 T1055 T1036 T1021.001 T1016.001 T1021.002\n", + "2 T1055.001 T1053 T1036 T1027 T1027\n", + "3 T1059 T1053.005 T1049 T1033 T1036\n", + "4 T1059.005 T1059 T1053 T1036 T1053\n", + "5 T1059.007 T1059.001 T1053.005 T1036.003 T1053.005\n", + "6 T1070 T1068 T1059 T1047 T1055\n", + "7 T1112 T1071 T1059.001 T1049 T1059\n", + "8 T1113 T1071.003 T1059.003 T1053 T1087\n", + "9 T1134 T1204 T1069 T1053.005 T1087.002\n", + "10 T1134.004 T1204.001 T1069.001 T1055 T1218\n", + "11 T1204 T1218 T1071 T1055.001 T1218.005\n", + "12 T1204.001 T1218.001 T1112 T1055.002 T1218.011\n", + "13 T1218 T1543 T1136 T1059 T1543\n", + "14 T1218.010 T1543.003 T1136.001 T1059.001 T1562\n", + "15 T1543 T1548 T1204 T1059.003 T1562.001\n", + "16 T1547 T1548.002 T1204.001 T1059.007 T1566\n", + "17 T1547.001 T1555 T1219 T1071 T1566.001\n", + "18 T1548 T1555.003 T1222 T1112 T1590\n", + "19 T1548.002 T1562 T1222.001 T1204 T1590.005\n", + "20 T1555 T1562.001 T1489 T1204.001 NaN\n", + "21 T1555.003 T1566 T1531 T1218 NaN\n", + "22 T1559.001 T1566.001 T1543 T1218.010 NaN\n", + "23 T1562 NaN T1543.003 T1482 NaN\n", + "24 T1562.001 NaN T1547 T1543 NaN\n", + "25 T1566 NaN T1547.001 T1543.003 NaN\n", + "26 T1566.001 NaN T1548 T1547 NaN\n", + "27 T1592 NaN T1548.002 T1547.001 NaN\n", + "28 NaN NaN T1555 T1562 NaN\n", + "29 NaN NaN T1555.003 T1562.001 NaN\n", + "30 NaN NaN T1562 T1566 NaN\n", + "31 NaN NaN T1562.001 T1566.001 NaN\n", + "32 NaN NaN T1562.004 T1566.002 NaN\n", + "33 NaN NaN T1564 T1569 NaN\n", + "34 NaN NaN T1564.001 T1569.002 NaN\n", + "35 NaN NaN T1566 T1574 NaN\n", + "36 NaN NaN T1566.001 T1574.001 NaN\n", + "37 NaN NaN T1569 T1574.002 NaN\n", + "38 NaN NaN T1569.002 T1592 NaN\n", + "39 NaN NaN T1590 NaN NaN\n", + "40 NaN NaN T1590.005 NaN NaN" + ] + }, + "execution_count": 6, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "df = pd.DataFrame({ key:pd.Series(value) for key, value in mitre_attack_story_dict.items() })\n", + "df = df.sort_values(by =[\"Remcos\", \"Azorult\", \"Qakbot\", \"Trickbot\", \"AgentTesla\"])\n", + "df\n", + " " + ] + }, + { + "cell_type": "markdown", + "id": "e1325b00-3932-4ba3-92ad-25d9d382354b", + "metadata": { + "tags": [] + }, + "source": [ + "## Security Content mitre attack id Coverage for [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\"]" + ] + }, + { + "cell_type": "code", + "execution_count": 7, + "id": "2fb85a5d-d498-43c1-97a5-08da5c0f6c32", + "metadata": {}, + "outputs": [ + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 0
5 malware coverageyellow
4 malware coverageorange
3 malware coveragelightgreen
2 malware coveragelightblue
1 malware coveragelightgray
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 7, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "show_legend()\n" + ] + }, + { + "cell_type": "code", + "execution_count": 8, + "id": "0868588f-3ab0-4065-be94-b6632544a204", + "metadata": {}, + "outputs": [ + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 RemcosAgentTeslaAzorultQakbotTrickbot
0T1036T1014T1021T1016T1021
1T1055T1036T1021.001T1016.001T1021.002
2T1055.001T1053T1036T1027T1027
3T1059T1053.005T1049T1033T1036
4T1059.005T1059T1053T1036T1053
5T1059.007T1059.001T1053.005T1036.003T1053.005
6T1070T1068T1059T1047T1055
7T1112T1071T1059.001T1049T1059
8T1113T1071.003T1059.003T1053T1087
9T1134T1204T1069T1053.005T1087.002
10T1134.004T1204.001T1069.001T1055T1218
11T1204T1218T1071T1055.001T1218.005
12T1204.001T1218.001T1112T1055.002T1218.011
13T1218T1543T1136T1059T1543
14T1218.010T1543.003T1136.001T1059.001T1562
15T1543T1548T1204T1059.003T1562.001
16T1547T1548.002T1204.001T1059.007T1566
17T1547.001T1555T1219T1071T1566.001
18T1548T1555.003T1222T1112T1590
19T1548.002T1562T1222.001T1204T1590.005
20T1555T1562.001T1489T1204.001nan
21T1555.003T1566T1531T1218nan
22T1559.001T1566.001T1543T1218.010nan
23T1562nanT1543.003T1482nan
24T1562.001nanT1547T1543nan
25T1566nanT1547.001T1543.003nan
26T1566.001nanT1548T1547nan
27T1592nanT1548.002T1547.001nan
28nannanT1555T1562nan
29nannanT1555.003T1562.001nan
30nannanT1562T1566nan
31nannanT1562.001T1566.001nan
32nannanT1562.004T1566.002nan
33nannanT1564T1569nan
34nannanT1564.001T1569.002nan
35nannanT1566T1574nan
36nannanT1566.001T1574.001nan
37nannanT1569T1574.002nan
38nannanT1569.002T1592nan
39nannanT1590nannan
40nannanT1590.005nannan
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 8, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "\n", + "df.style.applymap(highlight_cells)" + ] + }, + { + "cell_type": "markdown", + "id": "a7510444-c411-443e-b8b5-de788fb940c2", + "metadata": { + "tags": [] + }, + "source": [ + "### Highlight Mitre Attack ID that detects all [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\"]" + ] + }, + { + "cell_type": "code", + "execution_count": 9, + "id": "fcc9a6f6-cd1d-4150-8896-ec1e12b50e68", + "metadata": {}, + "outputs": [ + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 0
5 malware coverageyellow
4 malware coverageorange
3 malware coveragelightgreen
2 malware coveragelightblue
1 malware coveragelightgray
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 9, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "show_legend()" + ] + }, + { + "cell_type": "code", + "execution_count": 10, + "id": "29cb6e5d-8929-4620-8707-917886b3107c", + "metadata": {}, + "outputs": [ + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 RemcosAgentTeslaAzorultQakbotTrickbot
0T1036T1014T1021T1016T1021
1T1055T1036T1021.001T1016.001T1021.002
2T1055.001T1053T1036T1027T1027
3T1059T1053.005T1049T1033T1036
4T1059.005T1059T1053T1036T1053
5T1059.007T1059.001T1053.005T1036.003T1053.005
6T1070T1068T1059T1047T1055
7T1112T1071T1059.001T1049T1059
8T1113T1071.003T1059.003T1053T1087
9T1134T1204T1069T1053.005T1087.002
10T1134.004T1204.001T1069.001T1055T1218
11T1204T1218T1071T1055.001T1218.005
12T1204.001T1218.001T1112T1055.002T1218.011
13T1218T1543T1136T1059T1543
14T1218.010T1543.003T1136.001T1059.001T1562
15T1543T1548T1204T1059.003T1562.001
16T1547T1548.002T1204.001T1059.007T1566
17T1547.001T1555T1219T1071T1566.001
18T1548T1555.003T1222T1112T1590
19T1548.002T1562T1222.001T1204T1590.005
20T1555T1562.001T1489T1204.001nan
21T1555.003T1566T1531T1218nan
22T1559.001T1566.001T1543T1218.010nan
23T1562nanT1543.003T1482nan
24T1562.001nanT1547T1543nan
25T1566nanT1547.001T1543.003nan
26T1566.001nanT1548T1547nan
27T1592nanT1548.002T1547.001nan
28nannanT1555T1562nan
29nannanT1555.003T1562.001nan
30nannanT1562T1566nan
31nannanT1562.001T1566.001nan
32nannanT1562.004T1566.002nan
33nannanT1564T1569nan
34nannanT1564.001T1569.002nan
35nannanT1566T1574nan
36nannanT1566.001T1574.001nan
37nannanT1569T1574.002nan
38nannanT1569.002T1592nan
39nannanT1590nannan
40nannanT1590.005nannan
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 10, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "df.style.applymap(highlight_cells_5)" + ] + }, + { + "cell_type": "markdown", + "id": "c30e6a45-7728-4e91-aa34-88242a623b0c", + "metadata": {}, + "source": [ + "### Summary of Mitre Attack ID that detects all [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\"]" + ] + }, + { + "cell_type": "code", + "execution_count": 11, + "id": "91f6821c-20ed-4c4d-968a-267cdf9bea36", + "metadata": {}, + "outputs": [ + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
01234
T1562.001AgentTeslaAzorultQakbotRemcosTrickbot
T1562AgentTeslaAzorultQakbotRemcosTrickbot
T1059AgentTeslaAzorultQakbotRemcosTrickbot
T1566.001AgentTeslaAzorultQakbotRemcosTrickbot
T1566AgentTeslaAzorultQakbotRemcosTrickbot
T1036AgentTeslaAzorultQakbotRemcosTrickbot
T1543AgentTeslaAzorultQakbotRemcosTrickbot
\n", + "
" + ], + "text/plain": [ + " 0 1 2 3 4\n", + "T1562.001 AgentTesla Azorult Qakbot Remcos Trickbot\n", + "T1562 AgentTesla Azorult Qakbot Remcos Trickbot\n", + "T1059 AgentTesla Azorult Qakbot Remcos Trickbot\n", + "T1566.001 AgentTesla Azorult Qakbot Remcos Trickbot\n", + "T1566 AgentTesla Azorult Qakbot Remcos Trickbot\n", + "T1036 AgentTesla Azorult Qakbot Remcos Trickbot\n", + "T1543 AgentTesla Azorult Qakbot Remcos Trickbot" + ] + }, + "execution_count": 11, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "\n", + "temp_dict = summary_table_of_id(mitre_attack_tid_dict, 5)\n", + "tdf = pd.DataFrame.from_dict(temp_dict, orient='index')\n", + "tdf" + ] + }, + { + "cell_type": "markdown", + "id": "77c29341-1e19-404b-acd6-7cc20cccc1dc", + "metadata": {}, + "source": [ + "### detection list for Mitre Attack ID that detects all [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\"]" + ] + }, + { + "cell_type": "code", + "execution_count": 12, + "id": "05d30039-ae22-4ea1-b381-064d8826cb57", + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "(7, 5)\n" + ] + }, + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
AgentTeslaAzorultQakbotRemcosTrickbot
T1562.001[add_or_set_windows_defender_exclusion.yml, excessive_usage_of_taskkill.yml, powershell_windows_defender_exclusion_commands.yml][attempt_to_stop_security_service.yml, disable_defender_blockatfirstseen_feature.yml, disable_defender_enhanced_notification.yml, disable_defender_spynet_reporting.yml, disable_defender_submit_samples_consent_feature.yml, disable_show_hidden_files.yml, disable_windows_behavior_monitoring.yml, excessive_usage_of_taskkill.yml, hide_user_account_from_sign_in_screen.yml, windows_defender_exclusion_registry_entry.yml, windows_disableantispyware_reg.yml, windows_impair_defense_add_xml_applocker_rules.yml, windows_impair_defense_deny_security_software_with_applocker.yml, wmic_noninteractive_app_uninstallation.yml][disable_defender_spynet_reporting.yml, windows_defender_exclusion_registry_entry.yml][add_or_set_windows_defender_exclusion.yml, powershell_windows_defender_exclusion_commands.yml, windows_defender_exclusion_registry_entry.yml][attempt_to_stop_security_service.yml]
T1562[add_or_set_windows_defender_exclusion.yml, excessive_usage_of_taskkill.yml, powershell_windows_defender_exclusion_commands.yml][attempt_to_stop_security_service.yml, disable_defender_blockatfirstseen_feature.yml, disable_defender_enhanced_notification.yml, disable_defender_spynet_reporting.yml, disable_defender_submit_samples_consent_feature.yml, disable_show_hidden_files.yml, disable_windows_behavior_monitoring.yml, excessive_usage_of_taskkill.yml, firewall_allowed_program_enable.yml, hide_user_account_from_sign_in_screen.yml, processes_launching_netsh.yml, windows_defender_exclusion_registry_entry.yml, windows_disableantispyware_reg.yml, windows_impair_defense_add_xml_applocker_rules.yml, windows_impair_defense_deny_security_software_with_applocker.yml, wmic_noninteractive_app_uninstallation.yml][disable_defender_spynet_reporting.yml, windows_defender_exclusion_registry_entry.yml][add_or_set_windows_defender_exclusion.yml, powershell_windows_defender_exclusion_commands.yml, windows_defender_exclusion_registry_entry.yml][attempt_to_stop_security_service.yml]
T1059[powershell___connect_to_internet_with_hidden_window.yml, powershell_loading_dotnet_into_memory_via_reflection.yml][chcp_command_execution.yml, cmd_carry_out_string_command_parameter.yml, detect_use_of_cmd_exe_to_launch_script_interpreters.yml][cmd_carry_out_string_command_parameter.yml, cmdline_tool_not_executed_in_cmd_shell.yml, wermgr_process_spawned_cmd_or_powershell_process.yml][jscript_execution_using_cscript_app.yml, process_writing_dynamicwrapperx.yml, suspicious_process_dns_query_known_abuse_web_services.yml, vbscript_execution_using_wscript_app.yml][wermgr_process_spawned_cmd_or_powershell_process.yml]
T1566.001[office_application_drop_executable.yml, office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml][office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_mshta.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml][office_application_spawn_regsvr32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml][office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_windows_script_host.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml][office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml]
T1566[office_application_drop_executable.yml, office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml][office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_mshta.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml][office_application_spawn_regsvr32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, process_creating_lnk_file_in_suspicious_location.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml][office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_windows_script_host.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml][office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml]
T1036[executables_or_script_creation_in_suspicious_path.yml][executables_or_script_creation_in_suspicious_path.yml][executables_or_script_creation_in_suspicious_path.yml, suspicious_copy_on_system32.yml, system_processes_run_from_unexpected_locations.yml][executables_or_script_creation_in_suspicious_path.yml][executables_or_script_creation_in_suspicious_path.yml]
T1543[suspicious_driver_loaded_path.yml, suspicious_process_file_path.yml][sc_exe_manipulating_windows_services.yml, suspicious_process_file_path.yml][services_exe_lolbas_execution_process_spawn.yml, suspicious_process_file_path.yml][suspicious_process_file_path.yml, wscript_or_cscript_suspicious_child_process.yml][suspicious_process_file_path.yml]
\n", + "
" + ], + "text/plain": [ + " AgentTesla \\\n", + "T1562.001 [add_or_set_windows_defender_exclusion.yml, excessive_usage_of_taskkill.yml, powershell_windows_defender_exclusion_commands.yml] \n", + "T1562 [add_or_set_windows_defender_exclusion.yml, excessive_usage_of_taskkill.yml, powershell_windows_defender_exclusion_commands.yml] \n", + "T1059 [powershell___connect_to_internet_with_hidden_window.yml, powershell_loading_dotnet_into_memory_via_reflection.yml] \n", + "T1566.001 [office_application_drop_executable.yml, office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml] \n", + "T1566 [office_application_drop_executable.yml, office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml] \n", + "T1036 [executables_or_script_creation_in_suspicious_path.yml] \n", + "T1543 [suspicious_driver_loaded_path.yml, suspicious_process_file_path.yml] \n", + "\n", + " Azorult \\\n", + "T1562.001 [attempt_to_stop_security_service.yml, disable_defender_blockatfirstseen_feature.yml, disable_defender_enhanced_notification.yml, disable_defender_spynet_reporting.yml, disable_defender_submit_samples_consent_feature.yml, disable_show_hidden_files.yml, disable_windows_behavior_monitoring.yml, excessive_usage_of_taskkill.yml, hide_user_account_from_sign_in_screen.yml, windows_defender_exclusion_registry_entry.yml, windows_disableantispyware_reg.yml, windows_impair_defense_add_xml_applocker_rules.yml, windows_impair_defense_deny_security_software_with_applocker.yml, wmic_noninteractive_app_uninstallation.yml] \n", + "T1562 [attempt_to_stop_security_service.yml, disable_defender_blockatfirstseen_feature.yml, disable_defender_enhanced_notification.yml, disable_defender_spynet_reporting.yml, disable_defender_submit_samples_consent_feature.yml, disable_show_hidden_files.yml, disable_windows_behavior_monitoring.yml, excessive_usage_of_taskkill.yml, firewall_allowed_program_enable.yml, hide_user_account_from_sign_in_screen.yml, processes_launching_netsh.yml, windows_defender_exclusion_registry_entry.yml, windows_disableantispyware_reg.yml, windows_impair_defense_add_xml_applocker_rules.yml, windows_impair_defense_deny_security_software_with_applocker.yml, wmic_noninteractive_app_uninstallation.yml] \n", + "T1059 [chcp_command_execution.yml, cmd_carry_out_string_command_parameter.yml, detect_use_of_cmd_exe_to_launch_script_interpreters.yml] \n", + "T1566.001 [office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_mshta.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml] \n", + "T1566 [office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_mshta.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml] \n", + "T1036 [executables_or_script_creation_in_suspicious_path.yml] \n", + "T1543 [sc_exe_manipulating_windows_services.yml, suspicious_process_file_path.yml] \n", + "\n", + " Qakbot \\\n", + "T1562.001 [disable_defender_spynet_reporting.yml, windows_defender_exclusion_registry_entry.yml] \n", + "T1562 [disable_defender_spynet_reporting.yml, windows_defender_exclusion_registry_entry.yml] \n", + "T1059 [cmd_carry_out_string_command_parameter.yml, cmdline_tool_not_executed_in_cmd_shell.yml, wermgr_process_spawned_cmd_or_powershell_process.yml] \n", + "T1566.001 [office_application_spawn_regsvr32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml] \n", + "T1566 [office_application_spawn_regsvr32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, process_creating_lnk_file_in_suspicious_location.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml] \n", + "T1036 [executables_or_script_creation_in_suspicious_path.yml, suspicious_copy_on_system32.yml, system_processes_run_from_unexpected_locations.yml] \n", + "T1543 [services_exe_lolbas_execution_process_spawn.yml, suspicious_process_file_path.yml] \n", + "\n", + " Remcos \\\n", + "T1562.001 [add_or_set_windows_defender_exclusion.yml, powershell_windows_defender_exclusion_commands.yml, windows_defender_exclusion_registry_entry.yml] \n", + "T1562 [add_or_set_windows_defender_exclusion.yml, powershell_windows_defender_exclusion_commands.yml, windows_defender_exclusion_registry_entry.yml] \n", + "T1059 [jscript_execution_using_cscript_app.yml, process_writing_dynamicwrapperx.yml, suspicious_process_dns_query_known_abuse_web_services.yml, vbscript_execution_using_wscript_app.yml] \n", + "T1566.001 [office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_windows_script_host.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml] \n", + "T1566 [office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_windows_script_host.yml, windows_iso_lnk_file_creation.yml, windows_phishing_recent_iso_exec_registry.yml] \n", + "T1036 [executables_or_script_creation_in_suspicious_path.yml] \n", + "T1543 [suspicious_process_file_path.yml, wscript_or_cscript_suspicious_child_process.yml] \n", + "\n", + " Trickbot \n", + "T1562.001 [attempt_to_stop_security_service.yml] \n", + "T1562 [attempt_to_stop_security_service.yml] \n", + "T1059 [wermgr_process_spawned_cmd_or_powershell_process.yml] \n", + "T1566.001 [office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml] \n", + "T1566 [office_application_spawn_rundll32_process.yml, office_document_executing_macro_code.yml, office_product_spawn_cmd_process.yml, office_product_spawning_certutil.yml] \n", + "T1036 [executables_or_script_creation_in_suspicious_path.yml] \n", + "T1543 [suspicious_process_file_path.yml] " + ] + }, + "execution_count": 12, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "det_table_dict = detection_list_by_id(temp_dict)\n", + "tdf = pd.DataFrame.from_dict(det_table_dict, orient='index')\n", + "print(tdf.shape)\n", + "tdf " + ] + }, + { + "cell_type": "markdown", + "id": "2f50a79c-075e-46ea-a00e-c535f01f304f", + "metadata": {}, + "source": [ + "### detection count per mitre attack id in each malware family" + ] + }, + { + "cell_type": "code", + "execution_count": 13, + "id": "bd5233dd-a4fd-49bf-86ff-f46cbb6f9ce9", + "metadata": {}, + "outputs": [ + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
AgentTeslaAzorultQakbotRemcosTrickbot
T1562.001(3)-detection count(14)-detection count(2)-detection count(3)-detection count(1)-detection count
T1562(3)-detection count(16)-detection count(2)-detection count(3)-detection count(1)-detection count
T1059(2)-detection count(3)-detection count(3)-detection count(4)-detection count(1)-detection count
T1566.001(7)-detection count(5)-detection count(5)-detection count(5)-detection count(4)-detection count
T1566(7)-detection count(5)-detection count(6)-detection count(5)-detection count(4)-detection count
T1036(1)-detection count(1)-detection count(3)-detection count(1)-detection count(1)-detection count
T1543(2)-detection count(2)-detection count(2)-detection count(2)-detection count(1)-detection count
\n", + "
" + ], + "text/plain": [ + " AgentTesla Azorult Qakbot \\\n", + "T1562.001 (3)-detection count (14)-detection count (2)-detection count \n", + "T1562 (3)-detection count (16)-detection count (2)-detection count \n", + "T1059 (2)-detection count (3)-detection count (3)-detection count \n", + "T1566.001 (7)-detection count (5)-detection count (5)-detection count \n", + "T1566 (7)-detection count (5)-detection count (6)-detection count \n", + "T1036 (1)-detection count (1)-detection count (3)-detection count \n", + "T1543 (2)-detection count (2)-detection count (2)-detection count \n", + "\n", + " Remcos Trickbot \n", + "T1562.001 (3)-detection count (1)-detection count \n", + "T1562 (3)-detection count (1)-detection count \n", + "T1059 (4)-detection count (1)-detection count \n", + "T1566.001 (5)-detection count (4)-detection count \n", + "T1566 (5)-detection count (4)-detection count \n", + "T1036 (1)-detection count (1)-detection count \n", + "T1543 (2)-detection count (1)-detection count " + ] + }, + "execution_count": 13, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "detection_list_by_count(det_table_dict)" + ] + }, + { + "cell_type": "markdown", + "id": "a7cbd7a7-46d2-464d-9af7-d1a65c87b822", + "metadata": {}, + "source": [ + "### Highlight Mitre Attack ID that detects 4/5 malware family" + ] + }, + { + "cell_type": "code", + "execution_count": 14, + "id": "2a32699e-442b-458f-9b24-bb753efc5325", + "metadata": { + "tags": [] + }, + "outputs": [ + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 0
5 malware coverageyellow
4 malware coverageorange
3 malware coveragelightgreen
2 malware coveragelightblue
1 malware coveragelightgray
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 14, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "show_legend()" + ] + }, + { + "cell_type": "code", + "execution_count": 15, + "id": "cdad9857-37ff-40a5-8cbd-532cb23f6373", + "metadata": {}, + "outputs": [ + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 RemcosAgentTeslaAzorultQakbotTrickbot
0T1036T1014T1021T1016T1021
1T1055T1036T1021.001T1016.001T1021.002
2T1055.001T1053T1036T1027T1027
3T1059T1053.005T1049T1033T1036
4T1059.005T1059T1053T1036T1053
5T1059.007T1059.001T1053.005T1036.003T1053.005
6T1070T1068T1059T1047T1055
7T1112T1071T1059.001T1049T1059
8T1113T1071.003T1059.003T1053T1087
9T1134T1204T1069T1053.005T1087.002
10T1134.004T1204.001T1069.001T1055T1218
11T1204T1218T1071T1055.001T1218.005
12T1204.001T1218.001T1112T1055.002T1218.011
13T1218T1543T1136T1059T1543
14T1218.010T1543.003T1136.001T1059.001T1562
15T1543T1548T1204T1059.003T1562.001
16T1547T1548.002T1204.001T1059.007T1566
17T1547.001T1555T1219T1071T1566.001
18T1548T1555.003T1222T1112T1590
19T1548.002T1562T1222.001T1204T1590.005
20T1555T1562.001T1489T1204.001nan
21T1555.003T1566T1531T1218nan
22T1559.001T1566.001T1543T1218.010nan
23T1562nanT1543.003T1482nan
24T1562.001nanT1547T1543nan
25T1566nanT1547.001T1543.003nan
26T1566.001nanT1548T1547nan
27T1592nanT1548.002T1547.001nan
28nannanT1555T1562nan
29nannanT1555.003T1562.001nan
30nannanT1562T1566nan
31nannanT1562.001T1566.001nan
32nannanT1562.004T1566.002nan
33nannanT1564T1569nan
34nannanT1564.001T1569.002nan
35nannanT1566T1574nan
36nannanT1566.001T1574.001nan
37nannanT1569T1574.002nan
38nannanT1569.002T1592nan
39nannanT1590nannan
40nannanT1590.005nannan
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 15, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "df.style.applymap(highlight_cells_4)" + ] + }, + { + "cell_type": "markdown", + "id": "49b139b0-a8b6-4b5a-88cb-6c009047519d", + "metadata": {}, + "source": [ + "### Summary of Mitre Attack ID that detects 4/5 malware family" + ] + }, + { + "cell_type": "code", + "execution_count": 16, + "id": "1dbccecb-9411-4087-8760-f16ba681d310", + "metadata": {}, + "outputs": [ + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
0123
T1204.001AgentTeslaAzorultQakbotRemcos
T1204AgentTeslaAzorultQakbotRemcos
T1053AgentTeslaAzorultQakbotTrickbot
T1053.005AgentTeslaAzorultQakbotTrickbot
T1218AgentTeslaQakbotRemcosTrickbot
\n", + "
" + ], + "text/plain": [ + " 0 1 2 3\n", + "T1204.001 AgentTesla Azorult Qakbot Remcos\n", + "T1204 AgentTesla Azorult Qakbot Remcos\n", + "T1053 AgentTesla Azorult Qakbot Trickbot\n", + "T1053.005 AgentTesla Azorult Qakbot Trickbot\n", + "T1218 AgentTesla Qakbot Remcos Trickbot" + ] + }, + "execution_count": 16, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "temp_dict = summary_table_of_id(mitre_attack_tid_dict, 4)\n", + "tdf = pd.DataFrame.from_dict(temp_dict, orient='index')\n", + "tdf = tdf.sort_values(by=[0,1,2,3])\n", + "tdf" + ] + }, + { + "cell_type": "markdown", + "id": "4deb3bef-e9b9-4e98-a44f-7b8162a74d92", + "metadata": {}, + "source": [ + "### detection list for Mitre Attack ID that detects 4/5 malware families" + ] + }, + { + "cell_type": "code", + "execution_count": 17, + "id": "874c8687-477a-4f0f-8e79-abf8643ab128", + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "(5, 5)\n" + ] + }, + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
AgentTeslaAzorultQakbotRemcosTrickbot
T1204.001[windows_iso_lnk_file_creation.yml][windows_iso_lnk_file_creation.yml][windows_iso_lnk_file_creation.yml][windows_iso_lnk_file_creation.yml]NaN
T1204[windows_iso_lnk_file_creation.yml][windows_iso_lnk_file_creation.yml][windows_iso_lnk_file_creation.yml][windows_iso_lnk_file_creation.yml]NaN
T1218[detect_html_help_spawn_child_process.yml]NaN[regsvr32_with_known_silent_switch_cmdline.yml, suspicious_regsvr32_register_suspicious_path.yml, windows_regsvr32_renamed_binary.yml][regsvr32_silent_and_install_param_dll_loading.yml, regsvr32_with_known_silent_switch_cmdline.yml][mshta_spawning_rundll32_or_regsvr32_process.yml, suspicious_rundll32_startw.yml]
T1053[scheduled_task_deleted_or_created_via_cmd.yml][scheduled_task_deleted_or_created_via_cmd.yml, suspicious_scheduled_task_from_public_directory.yml][scheduled_task_deleted_or_created_via_cmd.yml, schtasks_run_task_on_demand.yml, windows_schtasks_create_run_as_system.yml]NaN[schedule_task_with_rundll32_command_trigger.yml, scheduled_task_deleted_or_created_via_cmd.yml]
T1053.005[scheduled_task_deleted_or_created_via_cmd.yml][scheduled_task_deleted_or_created_via_cmd.yml, suspicious_scheduled_task_from_public_directory.yml][scheduled_task_deleted_or_created_via_cmd.yml, windows_schtasks_create_run_as_system.yml, winevent_windows_task_scheduler_event_action_started.yml]NaN[scheduled_task_deleted_or_created_via_cmd.yml]
\n", + "
" + ], + "text/plain": [ + " AgentTesla \\\n", + "T1204.001 [windows_iso_lnk_file_creation.yml] \n", + "T1204 [windows_iso_lnk_file_creation.yml] \n", + "T1218 [detect_html_help_spawn_child_process.yml] \n", + "T1053 [scheduled_task_deleted_or_created_via_cmd.yml] \n", + "T1053.005 [scheduled_task_deleted_or_created_via_cmd.yml] \n", + "\n", + " Azorult \\\n", + "T1204.001 [windows_iso_lnk_file_creation.yml] \n", + "T1204 [windows_iso_lnk_file_creation.yml] \n", + "T1218 NaN \n", + "T1053 [scheduled_task_deleted_or_created_via_cmd.yml, suspicious_scheduled_task_from_public_directory.yml] \n", + "T1053.005 [scheduled_task_deleted_or_created_via_cmd.yml, suspicious_scheduled_task_from_public_directory.yml] \n", + "\n", + " Qakbot \\\n", + "T1204.001 [windows_iso_lnk_file_creation.yml] \n", + "T1204 [windows_iso_lnk_file_creation.yml] \n", + "T1218 [regsvr32_with_known_silent_switch_cmdline.yml, suspicious_regsvr32_register_suspicious_path.yml, windows_regsvr32_renamed_binary.yml] \n", + "T1053 [scheduled_task_deleted_or_created_via_cmd.yml, schtasks_run_task_on_demand.yml, windows_schtasks_create_run_as_system.yml] \n", + "T1053.005 [scheduled_task_deleted_or_created_via_cmd.yml, windows_schtasks_create_run_as_system.yml, winevent_windows_task_scheduler_event_action_started.yml] \n", + "\n", + " Remcos \\\n", + "T1204.001 [windows_iso_lnk_file_creation.yml] \n", + "T1204 [windows_iso_lnk_file_creation.yml] \n", + "T1218 [regsvr32_silent_and_install_param_dll_loading.yml, regsvr32_with_known_silent_switch_cmdline.yml] \n", + "T1053 NaN \n", + "T1053.005 NaN \n", + "\n", + " Trickbot \n", + "T1204.001 NaN \n", + "T1204 NaN \n", + "T1218 [mshta_spawning_rundll32_or_regsvr32_process.yml, suspicious_rundll32_startw.yml] \n", + "T1053 [schedule_task_with_rundll32_command_trigger.yml, scheduled_task_deleted_or_created_via_cmd.yml] \n", + "T1053.005 [scheduled_task_deleted_or_created_via_cmd.yml] " + ] + }, + "execution_count": 17, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "det_table_dict = detection_list_by_id(temp_dict)\n", + "tdf = pd.DataFrame.from_dict(det_table_dict, orient='index')\n", + "print(tdf.shape)\n", + "tdf " + ] + }, + { + "cell_type": "markdown", + "id": "a50a8933-f8ec-4dc2-b116-5761e97b7024", + "metadata": {}, + "source": [ + "### detection count per mitre attack id in each malware family" + ] + }, + { + "cell_type": "code", + "execution_count": 18, + "id": "54fb9a34-ac9a-48f2-a436-0cafaf16066c", + "metadata": {}, + "outputs": [ + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
AgentTeslaAzorultQakbotRemcosTrickbot
T1204.001(1)-detection count(1)-detection count(1)-detection count(1)-detection countNaN
T1204(1)-detection count(1)-detection count(1)-detection count(1)-detection countNaN
T1218(1)-detection countNaN(3)-detection count(2)-detection count(2)-detection count
T1053(1)-detection count(2)-detection count(3)-detection countNaN(2)-detection count
T1053.005(1)-detection count(2)-detection count(3)-detection countNaN(1)-detection count
\n", + "
" + ], + "text/plain": [ + " AgentTesla Azorult Qakbot \\\n", + "T1204.001 (1)-detection count (1)-detection count (1)-detection count \n", + "T1204 (1)-detection count (1)-detection count (1)-detection count \n", + "T1218 (1)-detection count NaN (3)-detection count \n", + "T1053 (1)-detection count (2)-detection count (3)-detection count \n", + "T1053.005 (1)-detection count (2)-detection count (3)-detection count \n", + "\n", + " Remcos Trickbot \n", + "T1204.001 (1)-detection count NaN \n", + "T1204 (1)-detection count NaN \n", + "T1218 (2)-detection count (2)-detection count \n", + "T1053 NaN (2)-detection count \n", + "T1053.005 NaN (1)-detection count " + ] + }, + "execution_count": 18, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "detection_list_by_count(det_table_dict)" + ] + }, + { + "cell_type": "markdown", + "id": "23f0dad6-7b39-4eeb-97b0-c5fecc08f5f2", + "metadata": {}, + "source": [ + "### Highlight Mitre Attack ID that detects 3/5 malware family" + ] + }, + { + "cell_type": "code", + "execution_count": 19, + "id": "1e1ad988-b482-4b75-b4ec-a1238e7e441e", + "metadata": {}, + "outputs": [ + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 0
5 malware coverageyellow
4 malware coverageorange
3 malware coveragelightgreen
2 malware coveragelightblue
1 malware coveragelightgray
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 19, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "show_legend()" + ] + }, + { + "cell_type": "code", + "execution_count": 20, + "id": "385f15e4-d000-4004-9a1c-8a762b3a3af7", + "metadata": { + "tags": [] + }, + "outputs": [ + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 RemcosAgentTeslaAzorultQakbotTrickbot
0T1036T1014T1021T1016T1021
1T1055T1036T1021.001T1016.001T1021.002
2T1055.001T1053T1036T1027T1027
3T1059T1053.005T1049T1033T1036
4T1059.005T1059T1053T1036T1053
5T1059.007T1059.001T1053.005T1036.003T1053.005
6T1070T1068T1059T1047T1055
7T1112T1071T1059.001T1049T1059
8T1113T1071.003T1059.003T1053T1087
9T1134T1204T1069T1053.005T1087.002
10T1134.004T1204.001T1069.001T1055T1218
11T1204T1218T1071T1055.001T1218.005
12T1204.001T1218.001T1112T1055.002T1218.011
13T1218T1543T1136T1059T1543
14T1218.010T1543.003T1136.001T1059.001T1562
15T1543T1548T1204T1059.003T1562.001
16T1547T1548.002T1204.001T1059.007T1566
17T1547.001T1555T1219T1071T1566.001
18T1548T1555.003T1222T1112T1590
19T1548.002T1562T1222.001T1204T1590.005
20T1555T1562.001T1489T1204.001nan
21T1555.003T1566T1531T1218nan
22T1559.001T1566.001T1543T1218.010nan
23T1562nanT1543.003T1482nan
24T1562.001nanT1547T1543nan
25T1566nanT1547.001T1543.003nan
26T1566.001nanT1548T1547nan
27T1592nanT1548.002T1547.001nan
28nannanT1555T1562nan
29nannanT1555.003T1562.001nan
30nannanT1562T1566nan
31nannanT1562.001T1566.001nan
32nannanT1562.004T1566.002nan
33nannanT1564T1569nan
34nannanT1564.001T1569.002nan
35nannanT1566T1574nan
36nannanT1566.001T1574.001nan
37nannanT1569T1574.002nan
38nannanT1569.002T1592nan
39nannanT1590nannan
40nannanT1590.005nannan
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 20, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "df.style.applymap(highlight_cells_3)" + ] + }, + { + "cell_type": "markdown", + "id": "d5b5a932-286d-4e02-b642-c02c40e4b454", + "metadata": {}, + "source": [ + "### Summary of Mitre Attack ID that detects 3/5 malware family" + ] + }, + { + "cell_type": "code", + "execution_count": 21, + "id": "00422f3c-2dc7-4fe2-b942-83c63535edd3", + "metadata": { + "tags": [] + }, + "outputs": [ + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
012
T1071AgentTeslaAzorultQakbot
T1059.001AgentTeslaAzorultQakbot
T1543.003AgentTeslaAzorultQakbot
T1548AgentTeslaAzorultRemcos
T1555.003AgentTeslaAzorultRemcos
T1555AgentTeslaAzorultRemcos
T1548.002AgentTeslaAzorultRemcos
T1112AzorultQakbotRemcos
T1547.001AzorultQakbotRemcos
T1547AzorultQakbotRemcos
T1055QakbotRemcosTrickbot
\n", + "
" + ], + "text/plain": [ + " 0 1 2\n", + "T1071 AgentTesla Azorult Qakbot\n", + "T1059.001 AgentTesla Azorult Qakbot\n", + "T1543.003 AgentTesla Azorult Qakbot\n", + "T1548 AgentTesla Azorult Remcos\n", + "T1555.003 AgentTesla Azorult Remcos\n", + "T1555 AgentTesla Azorult Remcos\n", + "T1548.002 AgentTesla Azorult Remcos\n", + "T1112 Azorult Qakbot Remcos\n", + "T1547.001 Azorult Qakbot Remcos\n", + "T1547 Azorult Qakbot Remcos\n", + "T1055 Qakbot Remcos Trickbot" + ] + }, + "execution_count": 21, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "\n", + "temp_dict = summary_table_of_id(mitre_attack_tid_dict, 3)\n", + "tdf = pd.DataFrame.from_dict(temp_dict, orient='index')\n", + "tdf = tdf.sort_values(by=[0,1,2])\n", + "tdf" + ] + }, + { + "cell_type": "markdown", + "id": "917b867f-73df-432d-ad61-f8288ed0bd17", + "metadata": {}, + "source": [ + "### detection list for Mitre Attack ID that detects 3/5 malware families" + ] + }, + { + "cell_type": "code", + "execution_count": 22, + "id": "4b5556a3-185b-4d09-9b11-8754f8a63668", + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "(11, 5)\n" + ] + }, + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
QakbotRemcosTrickbotAgentTeslaAzorult
T1055[create_remote_thread_in_shell_application.yml, windows_command_shell_fetch_env_variables.yml, windows_process_injection_of_wermgr_to_known_browser.yml, windows_process_injection_remote_thread.yml, windows_process_injection_wermgr_child_process.yml][loading_of_dynwrapx_module.yml, winhlp32_spawning_a_process.yml, wscript_or_cscript_suspicious_child_process.yml][cobalt_strike_named_pipes.yml, powershell_remote_thread_to_known_windows_process.yml, trickbot_named_pipe.yml]NaNNaN
T1071[windows_app_layer_protocol_qakbot_namedpipe.yml, windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml]NaNNaN[windows_file_transfer_protocol_in_non_common_process_path.yml, windows_mail_protocol_in_non_common_process_path.yml, windows_multi_hop_proxy_tor_website_query.yml][windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml]
T1112[windows_modify_registry_qakbot_binary_data_registry.yml][malicious_inprocserver32_modification.yml, remcos_client_registry_install_entry.yml]NaNNaN[windows_modify_registry_disable_toast_notifications.yml, windows_modify_registry_disable_win_defender_raw_write_notif.yml, windows_modify_registry_disable_windows_security_center_notif.yml, windows_modify_registry_disabling_wer_settings.yml, windows_modify_registry_disallow_windows_app.yml, windows_modify_registry_regedit_silent_reg_import.yml, windows_modify_registry_suppress_win_defender_notif.yml]
T1059.001[recon_using_wmi_class.yml]NaNNaN[powershell___connect_to_internet_with_hidden_window.yml, powershell_loading_dotnet_into_memory_via_reflection.yml][windows_powershell_import_applocker_policy.yml]
T1543.003[services_exe_lolbas_execution_process_spawn.yml]NaNNaN[suspicious_driver_loaded_path.yml][sc_exe_manipulating_windows_services.yml]
T1547.001[registry_keys_used_for_persistence.yml][registry_keys_used_for_persistence.yml]NaNNaN[registry_keys_used_for_persistence.yml]
T1547[registry_keys_used_for_persistence.yml][registry_keys_used_for_persistence.yml]NaNNaN[registry_keys_used_for_persistence.yml]
T1548NaN[disabling_remote_user_account_control.yml]NaN[disabling_remote_user_account_control.yml][allow_operation_with_consent_admin.yml, disabling_remote_user_account_control.yml]
T1555.003NaN[non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml, possible_browser_pass_view_parameter.yml]NaN[non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml][non_firefox_process_access_firefox_profile_dir.yml]
T1555NaN[non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml, possible_browser_pass_view_parameter.yml]NaN[non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml][non_firefox_process_access_firefox_profile_dir.yml]
T1548.002NaN[disabling_remote_user_account_control.yml]NaN[disabling_remote_user_account_control.yml][disabling_remote_user_account_control.yml]
\n", + "
" + ], + "text/plain": [ + " Qakbot \\\n", + "T1055 [create_remote_thread_in_shell_application.yml, windows_command_shell_fetch_env_variables.yml, windows_process_injection_of_wermgr_to_known_browser.yml, windows_process_injection_remote_thread.yml, windows_process_injection_wermgr_child_process.yml] \n", + "T1071 [windows_app_layer_protocol_qakbot_namedpipe.yml, windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml] \n", + "T1112 [windows_modify_registry_qakbot_binary_data_registry.yml] \n", + "T1059.001 [recon_using_wmi_class.yml] \n", + "T1543.003 [services_exe_lolbas_execution_process_spawn.yml] \n", + "T1547.001 [registry_keys_used_for_persistence.yml] \n", + "T1547 [registry_keys_used_for_persistence.yml] \n", + "T1548 NaN \n", + "T1555.003 NaN \n", + "T1555 NaN \n", + "T1548.002 NaN \n", + "\n", + " Remcos \\\n", + "T1055 [loading_of_dynwrapx_module.yml, winhlp32_spawning_a_process.yml, wscript_or_cscript_suspicious_child_process.yml] \n", + "T1071 NaN \n", + "T1112 [malicious_inprocserver32_modification.yml, remcos_client_registry_install_entry.yml] \n", + "T1059.001 NaN \n", + "T1543.003 NaN \n", + "T1547.001 [registry_keys_used_for_persistence.yml] \n", + "T1547 [registry_keys_used_for_persistence.yml] \n", + "T1548 [disabling_remote_user_account_control.yml] \n", + "T1555.003 [non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml, possible_browser_pass_view_parameter.yml] \n", + "T1555 [non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml, possible_browser_pass_view_parameter.yml] \n", + "T1548.002 [disabling_remote_user_account_control.yml] \n", + "\n", + " Trickbot \\\n", + "T1055 [cobalt_strike_named_pipes.yml, powershell_remote_thread_to_known_windows_process.yml, trickbot_named_pipe.yml] \n", + "T1071 NaN \n", + "T1112 NaN \n", + "T1059.001 NaN \n", + "T1543.003 NaN \n", + "T1547.001 NaN \n", + "T1547 NaN \n", + "T1548 NaN \n", + "T1555.003 NaN \n", + "T1555 NaN \n", + "T1548.002 NaN \n", + "\n", + " AgentTesla \\\n", + "T1055 NaN \n", + "T1071 [windows_file_transfer_protocol_in_non_common_process_path.yml, windows_mail_protocol_in_non_common_process_path.yml, windows_multi_hop_proxy_tor_website_query.yml] \n", + "T1112 NaN \n", + "T1059.001 [powershell___connect_to_internet_with_hidden_window.yml, powershell_loading_dotnet_into_memory_via_reflection.yml] \n", + "T1543.003 [suspicious_driver_loaded_path.yml] \n", + "T1547.001 NaN \n", + "T1547 NaN \n", + "T1548 [disabling_remote_user_account_control.yml] \n", + "T1555.003 [non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml] \n", + "T1555 [non_chrome_process_accessing_chrome_default_dir.yml, non_firefox_process_access_firefox_profile_dir.yml] \n", + "T1548.002 [disabling_remote_user_account_control.yml] \n", + "\n", + " Azorult \n", + "T1055 NaN \n", + "T1071 [windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml] \n", + "T1112 [windows_modify_registry_disable_toast_notifications.yml, windows_modify_registry_disable_win_defender_raw_write_notif.yml, windows_modify_registry_disable_windows_security_center_notif.yml, windows_modify_registry_disabling_wer_settings.yml, windows_modify_registry_disallow_windows_app.yml, windows_modify_registry_regedit_silent_reg_import.yml, windows_modify_registry_suppress_win_defender_notif.yml] \n", + "T1059.001 [windows_powershell_import_applocker_policy.yml] \n", + "T1543.003 [sc_exe_manipulating_windows_services.yml] \n", + "T1547.001 [registry_keys_used_for_persistence.yml] \n", + "T1547 [registry_keys_used_for_persistence.yml] \n", + "T1548 [allow_operation_with_consent_admin.yml, disabling_remote_user_account_control.yml] \n", + "T1555.003 [non_firefox_process_access_firefox_profile_dir.yml] \n", + "T1555 [non_firefox_process_access_firefox_profile_dir.yml] \n", + "T1548.002 [disabling_remote_user_account_control.yml] " + ] + }, + "execution_count": 22, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "det_table_dict = detection_list_by_id(temp_dict)\n", + "tdf = pd.DataFrame.from_dict(det_table_dict, orient='index')\n", + "print(tdf.shape)\n", + "tdf " + ] + }, + { + "cell_type": "markdown", + "id": "cb75a49c-d35f-47ee-bad3-bb31e7e7d041", + "metadata": {}, + "source": [ + "### detection count per mitre attack id in each malware family" + ] + }, + { + "cell_type": "code", + "execution_count": 23, + "id": "72b34254-fd19-4c37-a0e2-df5cb3934cb3", + "metadata": {}, + "outputs": [ + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
QakbotRemcosTrickbotAgentTeslaAzorult
T1055(5)-detection count(3)-detection count(3)-detection countNaNNaN
T1071(2)-detection countNaNNaN(3)-detection count(1)-detection count
T1112(1)-detection count(2)-detection countNaNNaN(7)-detection count
T1059.001(1)-detection countNaNNaN(2)-detection count(1)-detection count
T1543.003(1)-detection countNaNNaN(1)-detection count(1)-detection count
T1547.001(1)-detection count(1)-detection countNaNNaN(1)-detection count
T1547(1)-detection count(1)-detection countNaNNaN(1)-detection count
T1548NaN(1)-detection countNaN(1)-detection count(2)-detection count
T1555.003NaN(3)-detection countNaN(2)-detection count(1)-detection count
T1555NaN(3)-detection countNaN(2)-detection count(1)-detection count
T1548.002NaN(1)-detection countNaN(1)-detection count(1)-detection count
\n", + "
" + ], + "text/plain": [ + " Qakbot Remcos Trickbot \\\n", + "T1055 (5)-detection count (3)-detection count (3)-detection count \n", + "T1071 (2)-detection count NaN NaN \n", + "T1112 (1)-detection count (2)-detection count NaN \n", + "T1059.001 (1)-detection count NaN NaN \n", + "T1543.003 (1)-detection count NaN NaN \n", + "T1547.001 (1)-detection count (1)-detection count NaN \n", + "T1547 (1)-detection count (1)-detection count NaN \n", + "T1548 NaN (1)-detection count NaN \n", + "T1555.003 NaN (3)-detection count NaN \n", + "T1555 NaN (3)-detection count NaN \n", + "T1548.002 NaN (1)-detection count NaN \n", + "\n", + " AgentTesla Azorult \n", + "T1055 NaN NaN \n", + "T1071 (3)-detection count (1)-detection count \n", + "T1112 NaN (7)-detection count \n", + "T1059.001 (2)-detection count (1)-detection count \n", + "T1543.003 (1)-detection count (1)-detection count \n", + "T1547.001 NaN (1)-detection count \n", + "T1547 NaN (1)-detection count \n", + "T1548 (1)-detection count (2)-detection count \n", + "T1555.003 (2)-detection count (1)-detection count \n", + "T1555 (2)-detection count (1)-detection count \n", + "T1548.002 (1)-detection count (1)-detection count " + ] + }, + "execution_count": 23, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "detection_list_by_count(det_table_dict)" + ] + }, + { + "cell_type": "markdown", + "id": "4289037d-495e-4f38-8d3c-c724a2805a9c", + "metadata": {}, + "source": [ + "### Highlight Mitre Attack ID that detects 2/5 malware family" + ] + }, + { + "cell_type": "code", + "execution_count": 24, + "id": "45ebfd15-bdbe-4415-bcea-c94558ba6a7a", + "metadata": {}, + "outputs": [ + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 0
5 malware coverageyellow
4 malware coverageorange
3 malware coveragelightgreen
2 malware coveragelightblue
1 malware coveragelightgray
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 24, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "show_legend()" + ] + }, + { + "cell_type": "code", + "execution_count": 25, + "id": "d28d99e3-aab1-4a7a-8a04-ec88b390abfe", + "metadata": {}, + "outputs": [ + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 RemcosAgentTeslaAzorultQakbotTrickbot
0T1036T1014T1021T1016T1021
1T1055T1036T1021.001T1016.001T1021.002
2T1055.001T1053T1036T1027T1027
3T1059T1053.005T1049T1033T1036
4T1059.005T1059T1053T1036T1053
5T1059.007T1059.001T1053.005T1036.003T1053.005
6T1070T1068T1059T1047T1055
7T1112T1071T1059.001T1049T1059
8T1113T1071.003T1059.003T1053T1087
9T1134T1204T1069T1053.005T1087.002
10T1134.004T1204.001T1069.001T1055T1218
11T1204T1218T1071T1055.001T1218.005
12T1204.001T1218.001T1112T1055.002T1218.011
13T1218T1543T1136T1059T1543
14T1218.010T1543.003T1136.001T1059.001T1562
15T1543T1548T1204T1059.003T1562.001
16T1547T1548.002T1204.001T1059.007T1566
17T1547.001T1555T1219T1071T1566.001
18T1548T1555.003T1222T1112T1590
19T1548.002T1562T1222.001T1204T1590.005
20T1555T1562.001T1489T1204.001nan
21T1555.003T1566T1531T1218nan
22T1559.001T1566.001T1543T1218.010nan
23T1562nanT1543.003T1482nan
24T1562.001nanT1547T1543nan
25T1566nanT1547.001T1543.003nan
26T1566.001nanT1548T1547nan
27T1592nanT1548.002T1547.001nan
28nannanT1555T1562nan
29nannanT1555.003T1562.001nan
30nannanT1562T1566nan
31nannanT1562.001T1566.001nan
32nannanT1562.004T1566.002nan
33nannanT1564T1569nan
34nannanT1564.001T1569.002nan
35nannanT1566T1574nan
36nannanT1566.001T1574.001nan
37nannanT1569T1574.002nan
38nannanT1569.002T1592nan
39nannanT1590nannan
40nannanT1590.005nannan
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 25, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "df.style.applymap(highlight_cells_2)" + ] + }, + { + "cell_type": "markdown", + "id": "12972dd1-7e11-4097-b4fa-168c45a3ab2c", + "metadata": {}, + "source": [ + "### Summary of Mitre Attack ID that detects 2/5 malware family" + ] + }, + { + "cell_type": "code", + "execution_count": 26, + "id": "49b832b4-2436-4cef-98fe-997a2679d0c0", + "metadata": {}, + "outputs": [ + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
01
T1049AzorultQakbot
T1059.003AzorultQakbot
T1569AzorultQakbot
T1569.002AzorultQakbot
T1021AzorultTrickbot
T1590AzorultTrickbot
T1590.005AzorultTrickbot
T1059.007QakbotRemcos
T1218.010QakbotRemcos
T1055.001QakbotRemcos
T1592QakbotRemcos
T1027QakbotTrickbot
\n", + "
" + ], + "text/plain": [ + " 0 1\n", + "T1049 Azorult Qakbot\n", + "T1059.003 Azorult Qakbot\n", + "T1569 Azorult Qakbot\n", + "T1569.002 Azorult Qakbot\n", + "T1021 Azorult Trickbot\n", + "T1590 Azorult Trickbot\n", + "T1590.005 Azorult Trickbot\n", + "T1059.007 Qakbot Remcos\n", + "T1218.010 Qakbot Remcos\n", + "T1055.001 Qakbot Remcos\n", + "T1592 Qakbot Remcos\n", + "T1027 Qakbot Trickbot" + ] + }, + "execution_count": 26, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "temp_dict = summary_table_of_id(mitre_attack_tid_dict, 2)\n", + "tdf = pd.DataFrame.from_dict(temp_dict, orient='index')\n", + "tdf = tdf.sort_values(by=[0,1])\n", + "tdf" + ] + }, + { + "cell_type": "markdown", + "id": "02cb02d6-310e-44fa-a701-2dcdc0338a10", + "metadata": {}, + "source": [ + "### detection list for Mitre Attack ID that detects 2/5 malware families" + ] + }, + { + "cell_type": "code", + "execution_count": 27, + "id": "da26ea7f-7d62-47cc-a1e3-95442104d188", + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "(12, 4)\n" + ] + }, + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
AzorultTrickbotQakbotRemcos
T1021[allow_inbound_traffic_by_firewall_rule_registry.yml, windows_remote_service_rdpwinst_tool_execution.yml, windows_remote_services_allow_rdp_in_firewall.yml, windows_remote_services_allow_remote_assistance.yml, windows_remote_services_rdp_enable.yml][executable_file_written_in_administrative_smb_share.yml]NaNNaN
T1590[windows_gather_victim_network_info_through_ip_check_web_services.yml][wermgr_process_connecting_to_ip_check_web_services.yml]NaNNaN
T1590.005[windows_gather_victim_network_info_through_ip_check_web_services.yml][wermgr_process_connecting_to_ip_check_web_services.yml]NaNNaN
T1049[network_connection_discovery_net.yml]NaN[network_connection_discovery_arp.yml, network_connection_discovery_netstat.yml]NaN
T1059.003[cmd_carry_out_string_command_parameter.yml, detect_use_of_cmd_exe_to_launch_script_interpreters.yml]NaN[cmd_carry_out_string_command_parameter.yml]NaN
T1569[excessive_usage_of_sc_service_utility.yml]NaN[windows_service_created_with_suspicious_service_path.yml]NaN
T1569.002[excessive_usage_of_sc_service_utility.yml]NaN[windows_service_created_with_suspicious_service_path.yml]NaN
T1027NaN[wermgr_process_create_executable_file.yml][malicious_powershell_process___encoded_command.yml]NaN
T1059.007NaNNaN[cmdline_tool_not_executed_in_cmd_shell.yml][jscript_execution_using_cscript_app.yml]
T1218.010NaNNaN[regsvr32_with_known_silent_switch_cmdline.yml, suspicious_regsvr32_register_suspicious_path.yml, windows_regsvr32_renamed_binary.yml][malicious_inprocserver32_modification.yml, regsvr32_silent_and_install_param_dll_loading.yml, regsvr32_with_known_silent_switch_cmdline.yml]
T1055.001NaNNaN[windows_process_injection_of_wermgr_to_known_browser.yml][loading_of_dynwrapx_module.yml]
T1592NaNNaN[recon_avproduct_through_pwh_or_wmi.yml, recon_using_wmi_class.yml][system_info_gathering_using_dxdiag_application.yml]
\n", + "
" + ], + "text/plain": [ + " Azorult \\\n", + "T1021 [allow_inbound_traffic_by_firewall_rule_registry.yml, windows_remote_service_rdpwinst_tool_execution.yml, windows_remote_services_allow_rdp_in_firewall.yml, windows_remote_services_allow_remote_assistance.yml, windows_remote_services_rdp_enable.yml] \n", + "T1590 [windows_gather_victim_network_info_through_ip_check_web_services.yml] \n", + "T1590.005 [windows_gather_victim_network_info_through_ip_check_web_services.yml] \n", + "T1049 [network_connection_discovery_net.yml] \n", + "T1059.003 [cmd_carry_out_string_command_parameter.yml, detect_use_of_cmd_exe_to_launch_script_interpreters.yml] \n", + "T1569 [excessive_usage_of_sc_service_utility.yml] \n", + "T1569.002 [excessive_usage_of_sc_service_utility.yml] \n", + "T1027 NaN \n", + "T1059.007 NaN \n", + "T1218.010 NaN \n", + "T1055.001 NaN \n", + "T1592 NaN \n", + "\n", + " Trickbot \\\n", + "T1021 [executable_file_written_in_administrative_smb_share.yml] \n", + "T1590 [wermgr_process_connecting_to_ip_check_web_services.yml] \n", + "T1590.005 [wermgr_process_connecting_to_ip_check_web_services.yml] \n", + "T1049 NaN \n", + "T1059.003 NaN \n", + "T1569 NaN \n", + "T1569.002 NaN \n", + "T1027 [wermgr_process_create_executable_file.yml] \n", + "T1059.007 NaN \n", + "T1218.010 NaN \n", + "T1055.001 NaN \n", + "T1592 NaN \n", + "\n", + " Qakbot \\\n", + "T1021 NaN \n", + "T1590 NaN \n", + "T1590.005 NaN \n", + "T1049 [network_connection_discovery_arp.yml, network_connection_discovery_netstat.yml] \n", + "T1059.003 [cmd_carry_out_string_command_parameter.yml] \n", + "T1569 [windows_service_created_with_suspicious_service_path.yml] \n", + "T1569.002 [windows_service_created_with_suspicious_service_path.yml] \n", + "T1027 [malicious_powershell_process___encoded_command.yml] \n", + "T1059.007 [cmdline_tool_not_executed_in_cmd_shell.yml] \n", + "T1218.010 [regsvr32_with_known_silent_switch_cmdline.yml, suspicious_regsvr32_register_suspicious_path.yml, windows_regsvr32_renamed_binary.yml] \n", + "T1055.001 [windows_process_injection_of_wermgr_to_known_browser.yml] \n", + "T1592 [recon_avproduct_through_pwh_or_wmi.yml, recon_using_wmi_class.yml] \n", + "\n", + " Remcos \n", + "T1021 NaN \n", + "T1590 NaN \n", + "T1590.005 NaN \n", + "T1049 NaN \n", + "T1059.003 NaN \n", + "T1569 NaN \n", + "T1569.002 NaN \n", + "T1027 NaN \n", + "T1059.007 [jscript_execution_using_cscript_app.yml] \n", + "T1218.010 [malicious_inprocserver32_modification.yml, regsvr32_silent_and_install_param_dll_loading.yml, regsvr32_with_known_silent_switch_cmdline.yml] \n", + "T1055.001 [loading_of_dynwrapx_module.yml] \n", + "T1592 [system_info_gathering_using_dxdiag_application.yml] " + ] + }, + "execution_count": 27, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "det_table_dict = detection_list_by_id(temp_dict)\n", + "tdf = pd.DataFrame.from_dict(det_table_dict, orient='index')\n", + "print(tdf.shape)\n", + "tdf " + ] + }, + { + "cell_type": "markdown", + "id": "cc2bef38-a3e2-4081-a447-86c1e70d433f", + "metadata": {}, + "source": [ + "### detection count per mitre attack id in each malware family" + ] + }, + { + "cell_type": "code", + "execution_count": 28, + "id": "5863c606-ed0c-475d-b37d-1d4e8f9502a6", + "metadata": {}, + "outputs": [ + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
AzorultTrickbotQakbotRemcos
T1021(5)-detection count(1)-detection countNaNNaN
T1590(1)-detection count(1)-detection countNaNNaN
T1590.005(1)-detection count(1)-detection countNaNNaN
T1049(1)-detection countNaN(2)-detection countNaN
T1059.003(2)-detection countNaN(1)-detection countNaN
T1569(1)-detection countNaN(1)-detection countNaN
T1569.002(1)-detection countNaN(1)-detection countNaN
T1027NaN(1)-detection count(1)-detection countNaN
T1059.007NaNNaN(1)-detection count(1)-detection count
T1218.010NaNNaN(3)-detection count(3)-detection count
T1055.001NaNNaN(1)-detection count(1)-detection count
T1592NaNNaN(2)-detection count(1)-detection count
\n", + "
" + ], + "text/plain": [ + " Azorult Trickbot Qakbot \\\n", + "T1021 (5)-detection count (1)-detection count NaN \n", + "T1590 (1)-detection count (1)-detection count NaN \n", + "T1590.005 (1)-detection count (1)-detection count NaN \n", + "T1049 (1)-detection count NaN (2)-detection count \n", + "T1059.003 (2)-detection count NaN (1)-detection count \n", + "T1569 (1)-detection count NaN (1)-detection count \n", + "T1569.002 (1)-detection count NaN (1)-detection count \n", + "T1027 NaN (1)-detection count (1)-detection count \n", + "T1059.007 NaN NaN (1)-detection count \n", + "T1218.010 NaN NaN (3)-detection count \n", + "T1055.001 NaN NaN (1)-detection count \n", + "T1592 NaN NaN (2)-detection count \n", + "\n", + " Remcos \n", + "T1021 NaN \n", + "T1590 NaN \n", + "T1590.005 NaN \n", + "T1049 NaN \n", + "T1059.003 NaN \n", + "T1569 NaN \n", + "T1569.002 NaN \n", + "T1027 NaN \n", + "T1059.007 (1)-detection count \n", + "T1218.010 (3)-detection count \n", + "T1055.001 (1)-detection count \n", + "T1592 (1)-detection count " + ] + }, + "execution_count": 28, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "detection_list_by_count(det_table_dict)" + ] + }, + { + "cell_type": "markdown", + "id": "316697a7-1d08-442d-849d-72a17764495d", + "metadata": {}, + "source": [ + "### Highlight Mitre Attack ID that detects 1/5 malware family" + ] + }, + { + "cell_type": "code", + "execution_count": 29, + "id": "5805b5e1-679d-45b5-8e31-19cbc6edd390", + "metadata": {}, + "outputs": [ + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 0
5 malware coverageyellow
4 malware coverageorange
3 malware coveragelightgreen
2 malware coveragelightblue
1 malware coveragelightgray
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 29, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "show_legend()" + ] + }, + { + "cell_type": "code", + "execution_count": 30, + "id": "1ed5bbe5-d4e8-42f3-b086-9bc065f314ed", + "metadata": {}, + "outputs": [ + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 RemcosAgentTeslaAzorultQakbotTrickbot
0T1036T1014T1021T1016T1021
1T1055T1036T1021.001T1016.001T1021.002
2T1055.001T1053T1036T1027T1027
3T1059T1053.005T1049T1033T1036
4T1059.005T1059T1053T1036T1053
5T1059.007T1059.001T1053.005T1036.003T1053.005
6T1070T1068T1059T1047T1055
7T1112T1071T1059.001T1049T1059
8T1113T1071.003T1059.003T1053T1087
9T1134T1204T1069T1053.005T1087.002
10T1134.004T1204.001T1069.001T1055T1218
11T1204T1218T1071T1055.001T1218.005
12T1204.001T1218.001T1112T1055.002T1218.011
13T1218T1543T1136T1059T1543
14T1218.010T1543.003T1136.001T1059.001T1562
15T1543T1548T1204T1059.003T1562.001
16T1547T1548.002T1204.001T1059.007T1566
17T1547.001T1555T1219T1071T1566.001
18T1548T1555.003T1222T1112T1590
19T1548.002T1562T1222.001T1204T1590.005
20T1555T1562.001T1489T1204.001nan
21T1555.003T1566T1531T1218nan
22T1559.001T1566.001T1543T1218.010nan
23T1562nanT1543.003T1482nan
24T1562.001nanT1547T1543nan
25T1566nanT1547.001T1543.003nan
26T1566.001nanT1548T1547nan
27T1592nanT1548.002T1547.001nan
28nannanT1555T1562nan
29nannanT1555.003T1562.001nan
30nannanT1562T1566nan
31nannanT1562.001T1566.001nan
32nannanT1562.004T1566.002nan
33nannanT1564T1569nan
34nannanT1564.001T1569.002nan
35nannanT1566T1574nan
36nannanT1566.001T1574.001nan
37nannanT1569T1574.002nan
38nannanT1569.002T1592nan
39nannanT1590nannan
40nannanT1590.005nannan
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 30, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "df.style.applymap(highlight_cells_1)" + ] + }, + { + "cell_type": "markdown", + "id": "b55314eb-390a-4396-acf6-4532b0480482", + "metadata": {}, + "source": [ + "### Summary of Mitre Attack ID that detects 1/5 malware family" + ] + }, + { + "cell_type": "code", + "execution_count": 31, + "id": "04b58cd6-09ae-41df-bd11-e973b7954b95", + "metadata": {}, + "outputs": [ + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
0
T1218.001AgentTesla
T1068AgentTesla
T1071.003AgentTesla
T1014AgentTesla
T1136Azorult
T1222.001Azorult
T1564Azorult
T1564.001Azorult
T1531Azorult
T1069Azorult
T1136.001Azorult
T1069.001Azorult
T1489Azorult
T1219Azorult
T1222Azorult
T1562.004Azorult
T1021.001Azorult
T1566.002Qakbot
T1574.002Qakbot
T1482Qakbot
T1036.003Qakbot
T1574Qakbot
T1055.002Qakbot
T1047Qakbot
T1574.001Qakbot
T1016.001Qakbot
T1016Qakbot
T1033Qakbot
T1134Remcos
T1134.004Remcos
T1059.005Remcos
T1070Remcos
T1113Remcos
T1559.001Remcos
T1021.002Trickbot
T1087Trickbot
T1087.002Trickbot
T1218.005Trickbot
T1218.011Trickbot
\n", + "
" + ], + "text/plain": [ + " 0\n", + "T1218.001 AgentTesla\n", + "T1068 AgentTesla\n", + "T1071.003 AgentTesla\n", + "T1014 AgentTesla\n", + "T1136 Azorult\n", + "T1222.001 Azorult\n", + "T1564 Azorult\n", + "T1564.001 Azorult\n", + "T1531 Azorult\n", + "T1069 Azorult\n", + "T1136.001 Azorult\n", + "T1069.001 Azorult\n", + "T1489 Azorult\n", + "T1219 Azorult\n", + "T1222 Azorult\n", + "T1562.004 Azorult\n", + "T1021.001 Azorult\n", + "T1566.002 Qakbot\n", + "T1574.002 Qakbot\n", + "T1482 Qakbot\n", + "T1036.003 Qakbot\n", + "T1574 Qakbot\n", + "T1055.002 Qakbot\n", + "T1047 Qakbot\n", + "T1574.001 Qakbot\n", + "T1016.001 Qakbot\n", + "T1016 Qakbot\n", + "T1033 Qakbot\n", + "T1134 Remcos\n", + "T1134.004 Remcos\n", + "T1059.005 Remcos\n", + "T1070 Remcos\n", + "T1113 Remcos\n", + "T1559.001 Remcos\n", + "T1021.002 Trickbot\n", + "T1087 Trickbot\n", + "T1087.002 Trickbot\n", + "T1218.005 Trickbot\n", + "T1218.011 Trickbot" + ] + }, + "execution_count": 31, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "temp_dict = summary_table_of_id(mitre_attack_tid_dict, 1)\n", + "tdf = pd.DataFrame.from_dict(temp_dict, orient='index')\n", + "tdf = tdf.sort_values(by=[0])\n", + "tdf" + ] + }, + { + "cell_type": "markdown", + "id": "c74c33a6-86e8-4897-aa03-64b1a1085ddf", + "metadata": {}, + "source": [ + "### detection list for Mitre Attack ID that detects 1/5 malware families" + ] + }, + { + "cell_type": "code", + "execution_count": 32, + "id": "98f8eec2-b101-4cb2-b46d-182de0a7523c", + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "(39, 5)\n" + ] + }, + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
RemcosAzorultQakbotAgentTeslaTrickbot
T1059.005[suspicious_process_dns_query_known_abuse_web_services.yml, vbscript_execution_using_wscript_app.yml]NaNNaNNaNNaN
T1113[remcos_rat_file_creation_in_remcos_folder.yml, suspicious_image_creation_in_appdata_folder.yml, suspicious_wav_file_in_appdata_folder.yml]NaNNaNNaNNaN
T1070[process_deleting_its_process_file_path.yml]NaNNaNNaNNaN
T1559.001[process_writing_dynamicwrapperx.yml]NaNNaNNaNNaN
T1134.004[wscript_or_cscript_suspicious_child_process.yml]NaNNaNNaNNaN
T1134[wscript_or_cscript_suspicious_child_process.yml]NaNNaNNaNNaN
T1021.001NaN[allow_inbound_traffic_by_firewall_rule_registry.yml, windows_remote_service_rdpwinst_tool_execution.yml, windows_remote_services_allow_rdp_in_firewall.yml, windows_remote_services_allow_remote_assistance.yml, windows_remote_services_rdp_enable.yml]NaNNaNNaN
T1489NaN[excessive_attempt_to_disable_services.yml, windows_service_stop_by_deletion.yml, windows_valid_account_with_never_expires_password.yml]NaNNaNNaN
T1219NaN[windows_remote_access_software_rms_registry.yml]NaNNaNNaN
T1562.004NaN[firewall_allowed_program_enable.yml, processes_launching_netsh.yml]NaNNaNNaN
T1222NaN[excessive_usage_of_cacls_app.yml, hiding_files_and_directories_with_attrib_exe.yml, icacls_deny_command.yml]NaNNaNNaN
T1136.001NaN[create_local_admin_accounts_using_net_exe.yml]NaNNaNNaN
T1136NaN[create_local_admin_accounts_using_net_exe.yml]NaNNaNNaN
T1531NaN[excessive_usage_of_net_app.yml]NaNNaNNaN
T1564.001NaN[disable_show_hidden_files.yml]NaNNaNNaN
T1564NaN[disable_show_hidden_files.yml]NaNNaNNaN
T1222.001NaN[hiding_files_and_directories_with_attrib_exe.yml]NaNNaNNaN
T1069NaN[net_localgroup_discovery.yml]NaNNaNNaN
T1069.001NaN[net_localgroup_discovery.yml]NaNNaNNaN
T1055.002NaNNaN[windows_process_injection_remote_thread.yml]NaNNaN
T1033NaNNaN[system_user_discovery_with_whoami.yml, windows_system_discovery_using_ldap_nslookup.yml, windows_system_discovery_using_qwinsta.yml]NaNNaN
T1047NaNNaN[windows_wmi_impersonate_token.yml, windows_wmi_process_call_create.yml]NaNNaN
T1574.002NaNNaN[windows_dll_side_loading_in_calc.yml, windows_dll_side_loading_process_child_of_calc.yml, windows_masquerading_explorer_as_child_process.yml]NaNNaN
T1574NaNNaN[windows_dll_search_order_hijacking_hunt_with_sysmon.yml, windows_dll_side_loading_in_calc.yml, windows_dll_side_loading_process_child_of_calc.yml, windows_masquerading_explorer_as_child_process.yml]NaNNaN
T1016NaNNaN[network_discovery_using_route_windows_app.yml]NaNNaN
T1016.001NaNNaN[network_discovery_using_route_windows_app.yml]NaNNaN
T1036.003NaNNaN[suspicious_copy_on_system32.yml, system_processes_run_from_unexpected_locations.yml]NaNNaN
T1566.002NaNNaN[process_creating_lnk_file_in_suspicious_location.yml]NaNNaN
T1482NaNNaN[nltest_domain_trust_discovery.yml]NaNNaN
T1574.001NaNNaN[windows_dll_search_order_hijacking_hunt_with_sysmon.yml]NaNNaN
T1071.003NaNNaNNaN[windows_file_transfer_protocol_in_non_common_process_path.yml, windows_mail_protocol_in_non_common_process_path.yml, windows_multi_hop_proxy_tor_website_query.yml]NaN
T1014NaNNaNNaN[windows_driver_load_non_standard_path.yml, windows_drivers_loaded_by_signature.yml]NaN
T1068NaNNaNNaN[windows_drivers_loaded_by_signature.yml]NaN
T1218.001NaNNaNNaN[detect_html_help_spawn_child_process.yml]NaN
T1218.005NaNNaNNaNNaN[mshta_spawning_rundll32_or_regsvr32_process.yml]
T1087.002NaNNaNNaNNaN[account_discovery_with_net_app.yml]
T1087NaNNaNNaNNaN[account_discovery_with_net_app.yml]
T1218.011NaNNaNNaNNaN[suspicious_rundll32_startw.yml]
T1021.002NaNNaNNaNNaN[executable_file_written_in_administrative_smb_share.yml]
\n", + "
" + ], + "text/plain": [ + " Remcos \\\n", + "T1059.005 [suspicious_process_dns_query_known_abuse_web_services.yml, vbscript_execution_using_wscript_app.yml] \n", + "T1113 [remcos_rat_file_creation_in_remcos_folder.yml, suspicious_image_creation_in_appdata_folder.yml, suspicious_wav_file_in_appdata_folder.yml] \n", + "T1070 [process_deleting_its_process_file_path.yml] \n", + "T1559.001 [process_writing_dynamicwrapperx.yml] \n", + "T1134.004 [wscript_or_cscript_suspicious_child_process.yml] \n", + "T1134 [wscript_or_cscript_suspicious_child_process.yml] \n", + "T1021.001 NaN \n", + "T1489 NaN \n", + "T1219 NaN \n", + "T1562.004 NaN \n", + "T1222 NaN \n", + "T1136.001 NaN \n", + "T1136 NaN \n", + "T1531 NaN \n", + "T1564.001 NaN \n", + "T1564 NaN \n", + "T1222.001 NaN \n", + "T1069 NaN \n", + "T1069.001 NaN \n", + "T1055.002 NaN \n", + "T1033 NaN \n", + "T1047 NaN \n", + "T1574.002 NaN \n", + "T1574 NaN \n", + "T1016 NaN \n", + "T1016.001 NaN \n", + "T1036.003 NaN \n", + "T1566.002 NaN \n", + "T1482 NaN \n", + "T1574.001 NaN \n", + "T1071.003 NaN \n", + "T1014 NaN \n", + "T1068 NaN \n", + "T1218.001 NaN \n", + "T1218.005 NaN \n", + "T1087.002 NaN \n", + "T1087 NaN \n", + "T1218.011 NaN \n", + "T1021.002 NaN \n", + "\n", + " Azorult \\\n", + "T1059.005 NaN \n", + "T1113 NaN \n", + "T1070 NaN \n", + "T1559.001 NaN \n", + "T1134.004 NaN \n", + "T1134 NaN \n", + "T1021.001 [allow_inbound_traffic_by_firewall_rule_registry.yml, windows_remote_service_rdpwinst_tool_execution.yml, windows_remote_services_allow_rdp_in_firewall.yml, windows_remote_services_allow_remote_assistance.yml, windows_remote_services_rdp_enable.yml] \n", + "T1489 [excessive_attempt_to_disable_services.yml, windows_service_stop_by_deletion.yml, windows_valid_account_with_never_expires_password.yml] \n", + "T1219 [windows_remote_access_software_rms_registry.yml] \n", + "T1562.004 [firewall_allowed_program_enable.yml, processes_launching_netsh.yml] \n", + "T1222 [excessive_usage_of_cacls_app.yml, hiding_files_and_directories_with_attrib_exe.yml, icacls_deny_command.yml] \n", + "T1136.001 [create_local_admin_accounts_using_net_exe.yml] \n", + "T1136 [create_local_admin_accounts_using_net_exe.yml] \n", + "T1531 [excessive_usage_of_net_app.yml] \n", + "T1564.001 [disable_show_hidden_files.yml] \n", + "T1564 [disable_show_hidden_files.yml] \n", + "T1222.001 [hiding_files_and_directories_with_attrib_exe.yml] \n", + "T1069 [net_localgroup_discovery.yml] \n", + "T1069.001 [net_localgroup_discovery.yml] \n", + "T1055.002 NaN \n", + "T1033 NaN \n", + "T1047 NaN \n", + "T1574.002 NaN \n", + "T1574 NaN \n", + "T1016 NaN \n", + "T1016.001 NaN \n", + "T1036.003 NaN \n", + "T1566.002 NaN \n", + "T1482 NaN \n", + "T1574.001 NaN \n", + "T1071.003 NaN \n", + "T1014 NaN \n", + "T1068 NaN \n", + "T1218.001 NaN \n", + "T1218.005 NaN \n", + "T1087.002 NaN \n", + "T1087 NaN \n", + "T1218.011 NaN \n", + "T1021.002 NaN \n", + "\n", + " Qakbot \\\n", + "T1059.005 NaN \n", + "T1113 NaN \n", + "T1070 NaN \n", + "T1559.001 NaN \n", + "T1134.004 NaN \n", + "T1134 NaN \n", + "T1021.001 NaN \n", + "T1489 NaN \n", + "T1219 NaN \n", + "T1562.004 NaN \n", + "T1222 NaN \n", + "T1136.001 NaN \n", + "T1136 NaN \n", + "T1531 NaN \n", + "T1564.001 NaN \n", + "T1564 NaN \n", + "T1222.001 NaN \n", + "T1069 NaN \n", + "T1069.001 NaN \n", + "T1055.002 [windows_process_injection_remote_thread.yml] \n", + "T1033 [system_user_discovery_with_whoami.yml, windows_system_discovery_using_ldap_nslookup.yml, windows_system_discovery_using_qwinsta.yml] \n", + "T1047 [windows_wmi_impersonate_token.yml, windows_wmi_process_call_create.yml] \n", + "T1574.002 [windows_dll_side_loading_in_calc.yml, windows_dll_side_loading_process_child_of_calc.yml, windows_masquerading_explorer_as_child_process.yml] \n", + "T1574 [windows_dll_search_order_hijacking_hunt_with_sysmon.yml, windows_dll_side_loading_in_calc.yml, windows_dll_side_loading_process_child_of_calc.yml, windows_masquerading_explorer_as_child_process.yml] \n", + "T1016 [network_discovery_using_route_windows_app.yml] \n", + "T1016.001 [network_discovery_using_route_windows_app.yml] \n", + "T1036.003 [suspicious_copy_on_system32.yml, system_processes_run_from_unexpected_locations.yml] \n", + "T1566.002 [process_creating_lnk_file_in_suspicious_location.yml] \n", + "T1482 [nltest_domain_trust_discovery.yml] \n", + "T1574.001 [windows_dll_search_order_hijacking_hunt_with_sysmon.yml] \n", + "T1071.003 NaN \n", + "T1014 NaN \n", + "T1068 NaN \n", + "T1218.001 NaN \n", + "T1218.005 NaN \n", + "T1087.002 NaN \n", + "T1087 NaN \n", + "T1218.011 NaN \n", + "T1021.002 NaN \n", + "\n", + " AgentTesla \\\n", + "T1059.005 NaN \n", + "T1113 NaN \n", + "T1070 NaN \n", + "T1559.001 NaN \n", + "T1134.004 NaN \n", + "T1134 NaN \n", + "T1021.001 NaN \n", + "T1489 NaN \n", + "T1219 NaN \n", + "T1562.004 NaN \n", + "T1222 NaN \n", + "T1136.001 NaN \n", + "T1136 NaN \n", + "T1531 NaN \n", + "T1564.001 NaN \n", + "T1564 NaN \n", + "T1222.001 NaN \n", + "T1069 NaN \n", + "T1069.001 NaN \n", + "T1055.002 NaN \n", + "T1033 NaN \n", + "T1047 NaN \n", + "T1574.002 NaN \n", + "T1574 NaN \n", + "T1016 NaN \n", + "T1016.001 NaN \n", + "T1036.003 NaN \n", + "T1566.002 NaN \n", + "T1482 NaN \n", + "T1574.001 NaN \n", + "T1071.003 [windows_file_transfer_protocol_in_non_common_process_path.yml, windows_mail_protocol_in_non_common_process_path.yml, windows_multi_hop_proxy_tor_website_query.yml] \n", + "T1014 [windows_driver_load_non_standard_path.yml, windows_drivers_loaded_by_signature.yml] \n", + "T1068 [windows_drivers_loaded_by_signature.yml] \n", + "T1218.001 [detect_html_help_spawn_child_process.yml] \n", + "T1218.005 NaN \n", + "T1087.002 NaN \n", + "T1087 NaN \n", + "T1218.011 NaN \n", + "T1021.002 NaN \n", + "\n", + " Trickbot \n", + "T1059.005 NaN \n", + "T1113 NaN \n", + "T1070 NaN \n", + "T1559.001 NaN \n", + "T1134.004 NaN \n", + "T1134 NaN \n", + "T1021.001 NaN \n", + "T1489 NaN \n", + "T1219 NaN \n", + "T1562.004 NaN \n", + "T1222 NaN \n", + "T1136.001 NaN \n", + "T1136 NaN \n", + "T1531 NaN \n", + "T1564.001 NaN \n", + "T1564 NaN \n", + "T1222.001 NaN \n", + "T1069 NaN \n", + "T1069.001 NaN \n", + "T1055.002 NaN \n", + "T1033 NaN \n", + "T1047 NaN \n", + "T1574.002 NaN \n", + "T1574 NaN \n", + "T1016 NaN \n", + "T1016.001 NaN \n", + "T1036.003 NaN \n", + "T1566.002 NaN \n", + "T1482 NaN \n", + "T1574.001 NaN \n", + "T1071.003 NaN \n", + "T1014 NaN \n", + "T1068 NaN \n", + "T1218.001 NaN \n", + "T1218.005 [mshta_spawning_rundll32_or_regsvr32_process.yml] \n", + "T1087.002 [account_discovery_with_net_app.yml] \n", + "T1087 [account_discovery_with_net_app.yml] \n", + "T1218.011 [suspicious_rundll32_startw.yml] \n", + "T1021.002 [executable_file_written_in_administrative_smb_share.yml] " + ] + }, + "execution_count": 32, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "det_table_dict = detection_list_by_id(temp_dict)\n", + "tdf = pd.DataFrame.from_dict(det_table_dict, orient='index')\n", + "print(tdf.shape)\n", + "tdf " + ] + }, + { + "cell_type": "markdown", + "id": "9ad6099d-a1cf-464c-8678-50d013436254", + "metadata": {}, + "source": [ + "### detection count per mitre attack id in each malware family" + ] + }, + { + "cell_type": "code", + "execution_count": 33, + "id": "0f0abfc2-e6d8-4a42-b881-d4357b667a91", + "metadata": {}, + "outputs": [ + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
RemcosAzorultQakbotAgentTeslaTrickbot
T1059.005(2)-detection countNaNNaNNaNNaN
T1113(3)-detection countNaNNaNNaNNaN
T1070(1)-detection countNaNNaNNaNNaN
T1559.001(1)-detection countNaNNaNNaNNaN
T1134.004(1)-detection countNaNNaNNaNNaN
T1134(1)-detection countNaNNaNNaNNaN
T1021.001NaN(5)-detection countNaNNaNNaN
T1489NaN(3)-detection countNaNNaNNaN
T1219NaN(1)-detection countNaNNaNNaN
T1562.004NaN(2)-detection countNaNNaNNaN
T1222NaN(3)-detection countNaNNaNNaN
T1136.001NaN(1)-detection countNaNNaNNaN
T1136NaN(1)-detection countNaNNaNNaN
T1531NaN(1)-detection countNaNNaNNaN
T1564.001NaN(1)-detection countNaNNaNNaN
T1564NaN(1)-detection countNaNNaNNaN
T1222.001NaN(1)-detection countNaNNaNNaN
T1069NaN(1)-detection countNaNNaNNaN
T1069.001NaN(1)-detection countNaNNaNNaN
T1055.002NaNNaN(1)-detection countNaNNaN
T1033NaNNaN(3)-detection countNaNNaN
T1047NaNNaN(2)-detection countNaNNaN
T1574.002NaNNaN(3)-detection countNaNNaN
T1574NaNNaN(4)-detection countNaNNaN
T1016NaNNaN(1)-detection countNaNNaN
T1016.001NaNNaN(1)-detection countNaNNaN
T1036.003NaNNaN(2)-detection countNaNNaN
T1566.002NaNNaN(1)-detection countNaNNaN
T1482NaNNaN(1)-detection countNaNNaN
T1574.001NaNNaN(1)-detection countNaNNaN
T1071.003NaNNaNNaN(3)-detection countNaN
T1014NaNNaNNaN(2)-detection countNaN
T1068NaNNaNNaN(1)-detection countNaN
T1218.001NaNNaNNaN(1)-detection countNaN
T1218.005NaNNaNNaNNaN(1)-detection count
T1087.002NaNNaNNaNNaN(1)-detection count
T1087NaNNaNNaNNaN(1)-detection count
T1218.011NaNNaNNaNNaN(1)-detection count
T1021.002NaNNaNNaNNaN(1)-detection count
\n", + "
" + ], + "text/plain": [ + " Remcos Azorult Qakbot \\\n", + "T1059.005 (2)-detection count NaN NaN \n", + "T1113 (3)-detection count NaN NaN \n", + "T1070 (1)-detection count NaN NaN \n", + "T1559.001 (1)-detection count NaN NaN \n", + "T1134.004 (1)-detection count NaN NaN \n", + "T1134 (1)-detection count NaN NaN \n", + "T1021.001 NaN (5)-detection count NaN \n", + "T1489 NaN (3)-detection count NaN \n", + "T1219 NaN (1)-detection count NaN \n", + "T1562.004 NaN (2)-detection count NaN \n", + "T1222 NaN (3)-detection count NaN \n", + "T1136.001 NaN (1)-detection count NaN \n", + "T1136 NaN (1)-detection count NaN \n", + "T1531 NaN (1)-detection count NaN \n", + "T1564.001 NaN (1)-detection count NaN \n", + "T1564 NaN (1)-detection count NaN \n", + "T1222.001 NaN (1)-detection count NaN \n", + "T1069 NaN (1)-detection count NaN \n", + "T1069.001 NaN (1)-detection count NaN \n", + "T1055.002 NaN NaN (1)-detection count \n", + "T1033 NaN NaN (3)-detection count \n", + "T1047 NaN NaN (2)-detection count \n", + "T1574.002 NaN NaN (3)-detection count \n", + "T1574 NaN NaN (4)-detection count \n", + "T1016 NaN NaN (1)-detection count \n", + "T1016.001 NaN NaN (1)-detection count \n", + "T1036.003 NaN NaN (2)-detection count \n", + "T1566.002 NaN NaN (1)-detection count \n", + "T1482 NaN NaN (1)-detection count \n", + "T1574.001 NaN NaN (1)-detection count \n", + "T1071.003 NaN NaN NaN \n", + "T1014 NaN NaN NaN \n", + "T1068 NaN NaN NaN \n", + "T1218.001 NaN NaN NaN \n", + "T1218.005 NaN NaN NaN \n", + "T1087.002 NaN NaN NaN \n", + "T1087 NaN NaN NaN \n", + "T1218.011 NaN NaN NaN \n", + "T1021.002 NaN NaN NaN \n", + "\n", + " AgentTesla Trickbot \n", + "T1059.005 NaN NaN \n", + "T1113 NaN NaN \n", + "T1070 NaN NaN \n", + "T1559.001 NaN NaN \n", + "T1134.004 NaN NaN \n", + "T1134 NaN NaN \n", + "T1021.001 NaN NaN \n", + "T1489 NaN NaN \n", + "T1219 NaN NaN \n", + "T1562.004 NaN NaN \n", + "T1222 NaN NaN \n", + "T1136.001 NaN NaN \n", + "T1136 NaN NaN \n", + "T1531 NaN NaN \n", + "T1564.001 NaN NaN \n", + "T1564 NaN NaN \n", + "T1222.001 NaN NaN \n", + "T1069 NaN NaN \n", + "T1069.001 NaN NaN \n", + "T1055.002 NaN NaN \n", + "T1033 NaN NaN \n", + "T1047 NaN NaN \n", + "T1574.002 NaN NaN \n", + "T1574 NaN NaN \n", + "T1016 NaN NaN \n", + "T1016.001 NaN NaN \n", + "T1036.003 NaN NaN \n", + "T1566.002 NaN NaN \n", + "T1482 NaN NaN \n", + "T1574.001 NaN NaN \n", + "T1071.003 (3)-detection count NaN \n", + "T1014 (2)-detection count NaN \n", + "T1068 (1)-detection count NaN \n", + "T1218.001 (1)-detection count NaN \n", + "T1218.005 NaN (1)-detection count \n", + "T1087.002 NaN (1)-detection count \n", + "T1087 NaN (1)-detection count \n", + "T1218.011 NaN (1)-detection count \n", + "T1021.002 NaN (1)-detection count " + ] + }, + "execution_count": 33, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "detection_list_by_count(det_table_dict)" + ] + }, + { + "cell_type": "code", + "execution_count": 34, + "id": "9a275cc7-9c29-492e-a266-7e5e15ca0874", + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "['T1014', 'T1016', 'T1016.001', 'T1021', 'T1021.001', 'T1021.002', 'T1027', 'T1033', 'T1036', 'T1036.003', 'T1047', 'T1049', 'T1053', 'T1053.005', 'T1055', 'T1055.001', 'T1055.002', 'T1059', 'T1059.001', 'T1059.003', 'T1059.005', 'T1059.007', 'T1068', 'T1069', 'T1069.001', 'T1070', 'T1071', 'T1071.003', 'T1087', 'T1087.002', 'T1112', 'T1113', 'T1134', 'T1134.004', 'T1136', 'T1136.001', 'T1204', 'T1204.001', 'T1218', 'T1218.001', 'T1218.005', 'T1218.010', 'T1218.011', 'T1219', 'T1222', 'T1222.001', 'T1482', 'T1489', 'T1531', 'T1543', 'T1543.003', 'T1547', 'T1547.001', 'T1548', 'T1548.002', 'T1555', 'T1555.003', 'T1559.001', 'T1562', 'T1562.001', 'T1562.004', 'T1564', 'T1564.001', 'T1566', 'T1566.001', 'T1566.002', 'T1569', 'T1569.002', 'T1574', 'T1574.001', 'T1574.002', 'T1590', 'T1590.005', 'T1592']\n" + ] + } + ], + "source": [ + "detection_tid_list =[]\n", + "for k,v in mitre_attack_tid_dict.items():\n", + " detection_tid_list.append(k)\n", + "\n", + "print(sorted(detection_tid_list))" + ] + }, + { + "cell_type": "markdown", + "id": "e62ffc04-7445-479c-a5a8-751d0abd1b0f", + "metadata": {}, + "source": [ + "### truth table splunk detection name vs analytic story (malware family)" + ] + }, + { + "cell_type": "code", + "execution_count": 35, + "id": "31decfcb-ca16-479c-88cc-51b5a72422f6", + "metadata": { + "tags": [] + }, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "(140, 6)\n" + ] + }, + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 QakbotAzorultRemcosTrickbotAgentTeslatotal_coverage
office_document_executing_macro_code.ymlyesyesyesyesyes5
suspicious_process_file_path.ymlyesyesyesyesyes5
executables_or_script_creation_in_suspicious_path.ymlyesyesyesyesyes5
office_product_spawn_cmd_process.ymlyesyesyesyesyes5
windows_phishing_recent_iso_exec_registry.ymlyesyesyesnoyes4
windows_iso_lnk_file_creation.ymlyesyesyesnoyes4
scheduled_task_deleted_or_created_via_cmd.ymlyesyesnoyesyes4
registry_keys_used_for_persistence.ymlyesyesyesnono3
non_firefox_process_access_firefox_profile_dir.ymlnoyesyesnoyes3
windows_defender_exclusion_registry_entry.ymlyesyesyesnono3
disabling_remote_user_account_control.ymlnoyesyesnoyes3
add_or_set_windows_defender_exclusion.ymlnonoyesnoyes2
disable_defender_spynet_reporting.ymlyesyesnonono2
office_product_spawning_certutil.ymlnononoyesyes2
excessive_usage_of_taskkill.ymlnoyesnonoyes2
regsvr32_with_known_silent_switch_cmdline.ymlyesnoyesnono2
cmd_carry_out_string_command_parameter.ymlyesyesnonono2
office_application_spawn_rundll32_process.ymlnononoyesyes2
powershell_windows_defender_exclusion_commands.ymlnonoyesnoyes2
attempt_to_stop_security_service.ymlnoyesnoyesno2
wermgr_process_spawned_cmd_or_powershell_process.ymlyesnonoyesno2
non_chrome_process_accessing_chrome_default_dir.ymlnonoyesnoyes2
chcp_command_execution.ymlnoyesnonono1
jscript_execution_using_cscript_app.ymlnonoyesnono1
wmic_noninteractive_app_uninstallation.ymlnoyesnonono1
executable_file_written_in_administrative_smb_share.ymlnononoyesno1
windows_powershell_import_applocker_policy.ymlnoyesnonono1
windows_service_stop_by_deletion.ymlnoyesnonono1
disable_defender_submit_samples_consent_feature.ymlnoyesnonono1
schedule_task_with_rundll32_command_trigger.ymlnononoyesno1
suspicious_copy_on_system32.ymlyesnononono1
detect_html_help_spawn_child_process.ymlnonononoyes1
windows_modify_registry_disallow_windows_app.ymlnoyesnonono1
services_exe_lolbas_execution_process_spawn.ymlyesnononono1
windows_gather_victim_network_info_through_ip_check_web_services.ymlnoyesnonono1
suspicious_rundll32_startw.ymlnononoyesno1
windows_regsvr32_renamed_binary.ymlyesnononono1
winhlp32_spawning_a_process.ymlnonoyesnono1
account_discovery_with_net_app.ymlnononoyesno1
excessive_usage_of_sc_service_utility.ymlnoyesnonono1
disable_show_hidden_files.ymlnoyesnonono1
windows_modify_registry_disable_win_defender_raw_write_notif.ymlnoyesnonono1
process_writing_dynamicwrapperx.ymlnonoyesnono1
detect_use_of_cmd_exe_to_launch_script_interpreters.ymlnoyesnonono1
windows_valid_account_with_never_expires_password.ymlnoyesnonono1
windows_schtasks_create_run_as_system.ymlyesnononono1
windows_driver_load_non_standard_path.ymlnonononoyes1
windows_impair_defense_deny_security_software_with_applocker.ymlnoyesnonono1
windows_dll_side_loading_process_child_of_calc.ymlyesnononono1
windows_modify_registry_disabling_wer_settings.ymlnoyesnonono1
net_localgroup_discovery.ymlnoyesnonono1
windows_dll_search_order_hijacking_hunt_with_sysmon.ymlyesnononono1
disable_defender_blockatfirstseen_feature.ymlnoyesnonono1
powershell___connect_to_internet_with_hidden_window.ymlnonononoyes1
wscript_or_cscript_suspicious_child_process.ymlnonoyesnono1
hiding_files_and_directories_with_attrib_exe.ymlnoyesnonono1
windows_modify_registry_disable_toast_notifications.ymlnoyesnonono1
windows_modify_registry_disable_windows_security_center_notif.ymlnoyesnonono1
windows_application_layer_protocol_rms_radmin_tool_namedpipe.ymlnoyesnonono1
windows_wmi_impersonate_token.ymlyesnononono1
office_application_spawn_regsvr32_process.ymlyesnononono1
windows_modify_registry_qakbot_binary_data_registry.ymlyesnononono1
nltest_domain_trust_discovery.ymlyesnononono1
windows_modify_registry_suppress_win_defender_notif.ymlnoyesnonono1
process_creating_lnk_file_in_suspicious_location.ymlyesnononono1
office_application_drop_executable.ymlnonononoyes1
allow_inbound_traffic_by_firewall_rule_registry.ymlnoyesnonono1
disable_defender_enhanced_notification.ymlnoyesnonono1
powershell_remote_thread_to_known_windows_process.ymlnononoyesno1
windows_process_injection_of_wermgr_to_known_browser.ymlyesnononono1
windows_multi_hop_proxy_tor_website_query.ymlnonononoyes1
system_info_gathering_using_dxdiag_application.ymlnonoyesnono1
windows_mail_protocol_in_non_common_process_path.ymlnonononoyes1
winevent_windows_task_scheduler_event_action_started.ymlyesnononono1
regsvr32_silent_and_install_param_dll_loading.ymlnonoyesnono1
network_connection_discovery_net.ymlnoyesnonono1
windows_app_layer_protocol_wermgr_connect_to_namedpipe.ymlyesnononono1
sc_exe_manipulating_windows_services.ymlnoyesnonono1
disable_windows_behavior_monitoring.ymlnoyesnonono1
create_remote_thread_in_shell_application.ymlyesnononono1
network_connection_discovery_arp.ymlyesnononono1
schtasks_run_task_on_demand.ymlyesnononono1
windows_masquerading_explorer_as_child_process.ymlyesnononono1
windows_wmi_process_call_create.ymlyesnononono1
cmdline_tool_not_executed_in_cmd_shell.ymlyesnononono1
windows_modify_registry_regedit_silent_reg_import.ymlnoyesnonono1
windows_file_transfer_protocol_in_non_common_process_path.ymlnonononoyes1
network_connection_discovery_netstat.ymlyesnononono1
windows_remote_services_rdp_enable.ymlnoyesnonono1
suspicious_wav_file_in_appdata_folder.ymlnonoyesnono1
allow_operation_with_consent_admin.ymlnoyesnonono1
windows_remote_services_allow_rdp_in_firewall.ymlnoyesnonono1
suspicious_process_dns_query_known_abuse_web_services.ymlnonoyesnono1
icacls_deny_command.ymlnoyesnonono1
processes_launching_netsh.ymlnoyesnonono1
wermgr_process_connecting_to_ip_check_web_services.ymlnononoyesno1
hide_user_account_from_sign_in_screen.ymlnoyesnonono1
remcos_rat_file_creation_in_remcos_folder.ymlnonoyesnono1
windows_impair_defense_add_xml_applocker_rules.ymlnoyesnonono1
windows_system_discovery_using_qwinsta.ymlyesnononono1
wermgr_process_create_executable_file.ymlnononoyesno1
system_user_discovery_with_whoami.ymlyesnononono1
windows_remote_services_allow_remote_assistance.ymlnoyesnonono1
windows_remote_access_software_rms_registry.ymlnoyesnonono1
windows_process_injection_remote_thread.ymlyesnononono1
excessive_attempt_to_disable_services.ymlnoyesnonono1
windows_remote_service_rdpwinst_tool_execution.ymlnoyesnonono1
excessive_usage_of_cacls_app.ymlnoyesnonono1
loading_of_dynwrapx_module.ymlnonoyesnono1
possible_browser_pass_view_parameter.ymlnonoyesnono1
excessive_usage_of_net_app.ymlnoyesnonono1
windows_process_injection_wermgr_child_process.ymlyesnononono1
vbscript_execution_using_wscript_app.ymlnonoyesnono1
office_product_spawning_mshta.ymlnoyesnonono1
windows_disableantispyware_reg.ymlnoyesnonono1
suspicious_driver_loaded_path.ymlnonononoyes1
system_processes_run_from_unexpected_locations.ymlyesnononono1
trickbot_named_pipe.ymlnononoyesno1
windows_service_created_with_suspicious_service_path.ymlyesnononono1
windows_system_discovery_using_ldap_nslookup.ymlyesnononono1
windows_app_layer_protocol_qakbot_namedpipe.ymlyesnononono1
recon_using_wmi_class.ymlyesnononono1
firewall_allowed_program_enable.ymlnoyesnonono1
windows_command_shell_fetch_env_variables.ymlyesnononono1
process_deleting_its_process_file_path.ymlnonoyesnono1
network_discovery_using_route_windows_app.ymlyesnononono1
office_product_spawning_windows_script_host.ymlnonoyesnono1
create_local_admin_accounts_using_net_exe.ymlnoyesnonono1
suspicious_image_creation_in_appdata_folder.ymlnonoyesnono1
cobalt_strike_named_pipes.ymlnononoyesno1
windows_dll_side_loading_in_calc.ymlyesnononono1
remcos_client_registry_install_entry.ymlnonoyesnono1
powershell_loading_dotnet_into_memory_via_reflection.ymlnonononoyes1
suspicious_scheduled_task_from_public_directory.ymlnoyesnonono1
recon_avproduct_through_pwh_or_wmi.ymlyesnononono1
suspicious_regsvr32_register_suspicious_path.ymlyesnononono1
windows_drivers_loaded_by_signature.ymlnonononoyes1
malicious_powershell_process___encoded_command.ymlyesnononono1
mshta_spawning_rundll32_or_regsvr32_process.ymlnononoyesno1
malicious_inprocserver32_modification.ymlnonoyesnono1
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 35, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "def yes_no_table(dict_data, story_name_list):\n", + " det_by_analytics = defaultdict(list)\n", + "\n", + " for k, v in dict_data.items():\n", + " found_list = []\n", + " det_ctr = 0\n", + " for st in story_name_list:\n", + " if st in v:\n", + " found_list.append(\"yes\")\n", + " det_by_analytics[k].append(\"yes\")\n", + " det_ctr += 1\n", + " else:\n", + " found_list.append(\"no\")\n", + " det_by_analytics[k].append(\"no\")\n", + " det_by_analytics[k].append(det_ctr)\n", + "\n", + " return det_by_analytics\n", + "\n", + "def highlight_rows(x):\n", + " if x.total_coverage == 1:\n", + " return['background-color: lightgray'] * 6\n", + " elif x.total_coverage == 2:\n", + " return['background-color: lightblue'] * 6\n", + " elif x.total_coverage == 3:\n", + " return['background-color: lightgreen'] * 6 \n", + " elif x.total_coverage == 4:\n", + " return['background-color: orange'] * 6 \n", + " elif x.total_coverage == 5:\n", + " return['background-color: yellow'] * 6 \n", + "story_name_list = [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\"]\n", + "det_by_analytics = yes_no_table(mitre_attack_id_info_dict, story_name_list)\n", + "tdf = pd.DataFrame.from_dict(det_by_analytics, orient=\"index\")\n", + "tdf.columns = [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\", \"total_coverage\"]\n", + "print(tdf.shape)\n", + "tdf = tdf.sort_values(by=['total_coverage'], ascending = False)\n", + "tdf.style.apply(highlight_rows, axis=1)\n" + ] + }, + { + "cell_type": "markdown", + "id": "74485c0e-d4c0-4f26-9e7f-f13a2a9b6b98", + "metadata": {}, + "source": [ + "### breakdown of detection coverage for 5 malware family or story" + ] + }, + { + "cell_type": "code", + "execution_count": 36, + "id": "8d075f5c-818b-4fd6-8fdb-d6a3e75cbfb4", + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "(4, 6)\n" + ] + }, + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 QakbotAzorultRemcosTrickbotAgentTeslatotal_coverage
office_document_executing_macro_code.ymlyesyesyesyesyes5
suspicious_process_file_path.ymlyesyesyesyesyes5
executables_or_script_creation_in_suspicious_path.ymlyesyesyesyesyes5
office_product_spawn_cmd_process.ymlyesyesyesyesyes5
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 36, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "rslt_df = tdf[tdf['total_coverage'] == 5]\n", + "print(rslt_df.shape)\n", + "rslt_df.style.apply(highlight_rows, axis=1)\n" + ] + }, + { + "cell_type": "code", + "execution_count": 37, + "id": "7652ddc4-d9f8-4449-9f6a-d39900e9433f", + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "(3, 6)\n" + ] + }, + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 QakbotAzorultRemcosTrickbotAgentTeslatotal_coverage
windows_phishing_recent_iso_exec_registry.ymlyesyesyesnoyes4
windows_iso_lnk_file_creation.ymlyesyesyesnoyes4
scheduled_task_deleted_or_created_via_cmd.ymlyesyesnoyesyes4
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 37, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "rslt_df = tdf[tdf['total_coverage'] == 4]\n", + "print(rslt_df.shape)\n", + "rslt_df.style.apply(highlight_rows, axis=1)" + ] + }, + { + "cell_type": "code", + "execution_count": 38, + "id": "48201916-b89c-4934-bbb4-b1d02ccd7de1", + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "(4, 6)\n" + ] + }, + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 QakbotAzorultRemcosTrickbotAgentTeslatotal_coverage
registry_keys_used_for_persistence.ymlyesyesyesnono3
non_firefox_process_access_firefox_profile_dir.ymlnoyesyesnoyes3
windows_defender_exclusion_registry_entry.ymlyesyesyesnono3
disabling_remote_user_account_control.ymlnoyesyesnoyes3
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 38, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "rslt_df = tdf[tdf['total_coverage'] == 3]\n", + "print(rslt_df.shape)\n", + "rslt_df.style.apply(highlight_rows, axis=1)" + ] + }, + { + "cell_type": "code", + "execution_count": 39, + "id": "8ad5bd62-c881-4f72-8c84-c2f05729e271", + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "(11, 6)\n" + ] + }, + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 QakbotAzorultRemcosTrickbotAgentTeslatotal_coverage
add_or_set_windows_defender_exclusion.ymlnonoyesnoyes2
disable_defender_spynet_reporting.ymlyesyesnonono2
office_product_spawning_certutil.ymlnononoyesyes2
excessive_usage_of_taskkill.ymlnoyesnonoyes2
regsvr32_with_known_silent_switch_cmdline.ymlyesnoyesnono2
cmd_carry_out_string_command_parameter.ymlyesyesnonono2
office_application_spawn_rundll32_process.ymlnononoyesyes2
powershell_windows_defender_exclusion_commands.ymlnonoyesnoyes2
attempt_to_stop_security_service.ymlnoyesnoyesno2
wermgr_process_spawned_cmd_or_powershell_process.ymlyesnonoyesno2
non_chrome_process_accessing_chrome_default_dir.ymlnonoyesnoyes2
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 39, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "rslt_df = tdf[tdf['total_coverage'] == 2]\n", + "print(rslt_df.shape)\n", + "rslt_df.style.apply(highlight_rows, axis=1)" + ] + }, + { + "cell_type": "code", + "execution_count": 40, + "id": "24dec7b8-375d-40cb-9b57-84d44921b1e3", + "metadata": { + "tags": [] + }, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "(118, 6)\n" + ] + }, + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 QakbotAzorultRemcosTrickbotAgentTeslatotal_coverage
chcp_command_execution.ymlnoyesnonono1
jscript_execution_using_cscript_app.ymlnonoyesnono1
wmic_noninteractive_app_uninstallation.ymlnoyesnonono1
executable_file_written_in_administrative_smb_share.ymlnononoyesno1
windows_powershell_import_applocker_policy.ymlnoyesnonono1
windows_service_stop_by_deletion.ymlnoyesnonono1
disable_defender_submit_samples_consent_feature.ymlnoyesnonono1
schedule_task_with_rundll32_command_trigger.ymlnononoyesno1
suspicious_copy_on_system32.ymlyesnononono1
detect_html_help_spawn_child_process.ymlnonononoyes1
windows_modify_registry_disallow_windows_app.ymlnoyesnonono1
services_exe_lolbas_execution_process_spawn.ymlyesnononono1
windows_gather_victim_network_info_through_ip_check_web_services.ymlnoyesnonono1
suspicious_rundll32_startw.ymlnononoyesno1
windows_regsvr32_renamed_binary.ymlyesnononono1
winhlp32_spawning_a_process.ymlnonoyesnono1
account_discovery_with_net_app.ymlnononoyesno1
excessive_usage_of_sc_service_utility.ymlnoyesnonono1
disable_show_hidden_files.ymlnoyesnonono1
windows_modify_registry_disable_win_defender_raw_write_notif.ymlnoyesnonono1
process_writing_dynamicwrapperx.ymlnonoyesnono1
detect_use_of_cmd_exe_to_launch_script_interpreters.ymlnoyesnonono1
windows_valid_account_with_never_expires_password.ymlnoyesnonono1
windows_schtasks_create_run_as_system.ymlyesnononono1
windows_driver_load_non_standard_path.ymlnonononoyes1
windows_impair_defense_deny_security_software_with_applocker.ymlnoyesnonono1
windows_dll_side_loading_process_child_of_calc.ymlyesnononono1
windows_modify_registry_disabling_wer_settings.ymlnoyesnonono1
net_localgroup_discovery.ymlnoyesnonono1
windows_dll_search_order_hijacking_hunt_with_sysmon.ymlyesnononono1
disable_defender_blockatfirstseen_feature.ymlnoyesnonono1
powershell___connect_to_internet_with_hidden_window.ymlnonononoyes1
wscript_or_cscript_suspicious_child_process.ymlnonoyesnono1
hiding_files_and_directories_with_attrib_exe.ymlnoyesnonono1
windows_modify_registry_disable_toast_notifications.ymlnoyesnonono1
windows_modify_registry_disable_windows_security_center_notif.ymlnoyesnonono1
windows_application_layer_protocol_rms_radmin_tool_namedpipe.ymlnoyesnonono1
windows_wmi_impersonate_token.ymlyesnononono1
office_application_spawn_regsvr32_process.ymlyesnononono1
windows_modify_registry_qakbot_binary_data_registry.ymlyesnononono1
nltest_domain_trust_discovery.ymlyesnononono1
windows_modify_registry_suppress_win_defender_notif.ymlnoyesnonono1
process_creating_lnk_file_in_suspicious_location.ymlyesnononono1
office_application_drop_executable.ymlnonononoyes1
allow_inbound_traffic_by_firewall_rule_registry.ymlnoyesnonono1
disable_defender_enhanced_notification.ymlnoyesnonono1
powershell_remote_thread_to_known_windows_process.ymlnononoyesno1
windows_process_injection_of_wermgr_to_known_browser.ymlyesnononono1
windows_multi_hop_proxy_tor_website_query.ymlnonononoyes1
system_info_gathering_using_dxdiag_application.ymlnonoyesnono1
windows_mail_protocol_in_non_common_process_path.ymlnonononoyes1
winevent_windows_task_scheduler_event_action_started.ymlyesnononono1
regsvr32_silent_and_install_param_dll_loading.ymlnonoyesnono1
network_connection_discovery_net.ymlnoyesnonono1
windows_app_layer_protocol_wermgr_connect_to_namedpipe.ymlyesnononono1
sc_exe_manipulating_windows_services.ymlnoyesnonono1
disable_windows_behavior_monitoring.ymlnoyesnonono1
create_remote_thread_in_shell_application.ymlyesnononono1
network_connection_discovery_arp.ymlyesnononono1
schtasks_run_task_on_demand.ymlyesnononono1
windows_masquerading_explorer_as_child_process.ymlyesnononono1
windows_wmi_process_call_create.ymlyesnononono1
cmdline_tool_not_executed_in_cmd_shell.ymlyesnononono1
windows_modify_registry_regedit_silent_reg_import.ymlnoyesnonono1
windows_file_transfer_protocol_in_non_common_process_path.ymlnonononoyes1
network_connection_discovery_netstat.ymlyesnononono1
windows_remote_services_rdp_enable.ymlnoyesnonono1
suspicious_wav_file_in_appdata_folder.ymlnonoyesnono1
allow_operation_with_consent_admin.ymlnoyesnonono1
windows_remote_services_allow_rdp_in_firewall.ymlnoyesnonono1
suspicious_process_dns_query_known_abuse_web_services.ymlnonoyesnono1
icacls_deny_command.ymlnoyesnonono1
processes_launching_netsh.ymlnoyesnonono1
wermgr_process_connecting_to_ip_check_web_services.ymlnononoyesno1
hide_user_account_from_sign_in_screen.ymlnoyesnonono1
remcos_rat_file_creation_in_remcos_folder.ymlnonoyesnono1
windows_impair_defense_add_xml_applocker_rules.ymlnoyesnonono1
windows_system_discovery_using_qwinsta.ymlyesnononono1
wermgr_process_create_executable_file.ymlnononoyesno1
system_user_discovery_with_whoami.ymlyesnononono1
windows_remote_services_allow_remote_assistance.ymlnoyesnonono1
windows_remote_access_software_rms_registry.ymlnoyesnonono1
windows_process_injection_remote_thread.ymlyesnononono1
excessive_attempt_to_disable_services.ymlnoyesnonono1
windows_remote_service_rdpwinst_tool_execution.ymlnoyesnonono1
excessive_usage_of_cacls_app.ymlnoyesnonono1
loading_of_dynwrapx_module.ymlnonoyesnono1
possible_browser_pass_view_parameter.ymlnonoyesnono1
excessive_usage_of_net_app.ymlnoyesnonono1
windows_process_injection_wermgr_child_process.ymlyesnononono1
vbscript_execution_using_wscript_app.ymlnonoyesnono1
office_product_spawning_mshta.ymlnoyesnonono1
windows_disableantispyware_reg.ymlnoyesnonono1
suspicious_driver_loaded_path.ymlnonononoyes1
system_processes_run_from_unexpected_locations.ymlyesnononono1
trickbot_named_pipe.ymlnononoyesno1
windows_service_created_with_suspicious_service_path.ymlyesnononono1
windows_system_discovery_using_ldap_nslookup.ymlyesnononono1
windows_app_layer_protocol_qakbot_namedpipe.ymlyesnononono1
recon_using_wmi_class.ymlyesnononono1
firewall_allowed_program_enable.ymlnoyesnonono1
windows_command_shell_fetch_env_variables.ymlyesnononono1
process_deleting_its_process_file_path.ymlnonoyesnono1
network_discovery_using_route_windows_app.ymlyesnononono1
office_product_spawning_windows_script_host.ymlnonoyesnono1
create_local_admin_accounts_using_net_exe.ymlnoyesnonono1
suspicious_image_creation_in_appdata_folder.ymlnonoyesnono1
cobalt_strike_named_pipes.ymlnononoyesno1
windows_dll_side_loading_in_calc.ymlyesnononono1
remcos_client_registry_install_entry.ymlnonoyesnono1
powershell_loading_dotnet_into_memory_via_reflection.ymlnonononoyes1
suspicious_scheduled_task_from_public_directory.ymlnoyesnonono1
recon_avproduct_through_pwh_or_wmi.ymlyesnononono1
suspicious_regsvr32_register_suspicious_path.ymlyesnononono1
windows_drivers_loaded_by_signature.ymlnonononoyes1
malicious_powershell_process___encoded_command.ymlyesnononono1
mshta_spawning_rundll32_or_regsvr32_process.ymlnononoyesno1
malicious_inprocserver32_modification.ymlnonoyesnono1
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 40, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "rslt_df = tdf[tdf['total_coverage'] == 1]\n", + "print(rslt_df.shape)\n", + "rslt_df.style.apply(highlight_rows, axis=1)" + ] + }, + { + "cell_type": "markdown", + "id": "e144114f-2282-4169-a577-d690bfc6dbd9", + "metadata": {}, + "source": [ + "### truth table mitre attack id vs analytic story (malware family)" + ] + }, + { + "cell_type": "code", + "execution_count": 41, + "id": "ee827b0f-acff-4bf6-830e-4e0ec732b932", + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "(74, 6)\n" + ] + }, + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 QakbotAzorultRemcosTrickbotAgentTeslatotal_coverage
T1562.001yesyesyesyesyes5
T1036yesyesyesyesyes5
T1566yesyesyesyesyes5
T1566.001yesyesyesyesyes5
T1562yesyesyesyesyes5
T1543yesyesyesyesyes5
T1059yesyesyesyesyes5
T1053.005yesyesnoyesyes4
T1204.001yesyesyesnoyes4
T1204yesyesyesnoyes4
T1053yesyesnoyesyes4
T1218yesnoyesyesyes4
T1543.003yesyesnonoyes3
T1548.002noyesyesnoyes3
T1059.001yesyesnonoyes3
T1548noyesyesnoyes3
T1555noyesyesnoyes3
T1547.001yesyesyesnono3
T1555.003noyesyesnoyes3
T1112yesyesyesnono3
T1071yesyesnonoyes3
T1547yesyesyesnono3
T1055yesnoyesyesno3
T1049yesyesnonono2
T1592yesnoyesnono2
T1021noyesnoyesno2
T1027yesnonoyesno2
T1055.001yesnoyesnono2
T1590noyesnoyesno2
T1059.003yesyesnonono2
T1218.010yesnoyesnono2
T1590.005noyesnoyesno2
T1059.007yesnoyesnono2
T1569yesyesnonono2
T1569.002yesyesnonono2
T1087.002nononoyesno1
T1087nononoyesno1
T1218.011nononoyesno1
T1218.001nonononoyes1
T1021.002nononoyesno1
T1564.001noyesnonono1
T1482yesnononono1
T1564noyesnonono1
T1559.001nonoyesnono1
T1566.002yesnononono1
T1222.001noyesnonono1
T1134.004nonoyesnono1
T1134nonoyesnono1
T1574.001yesnononono1
T1069noyesnonono1
T1069.001noyesnonono1
T1059.005nonoyesnono1
T1021.001noyesnonono1
T1531noyesnonono1
T1036.003yesnononono1
T1489noyesnonono1
T1222noyesnonono1
T1562.004noyesnonono1
T1047yesnononono1
T1574.002yesnononono1
T1574yesnononono1
T1113nonoyesnono1
T1016yesnononono1
T1033yesnononono1
T1218.005nononoyesno1
T1014nonononoyes1
T1068nonononoyes1
T1219noyesnonono1
T1055.002yesnononono1
T1136.001noyesnonono1
T1136noyesnonono1
T1070nonoyesnono1
T1071.003nonononoyes1
T1016.001yesnononono1
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 41, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "\n", + "new_table = yes_no_table(mitre_attack_tid_dict, story_name_list)\n", + "tdf = pd.DataFrame.from_dict(new_table, orient=\"index\")\n", + "tdf.columns = [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\", \"total_coverage\"]\n", + "print(tdf.shape)\n", + "tdf = tdf.sort_values(by=['total_coverage'], ascending = False)\n", + "tdf.style.apply(highlight_rows, axis=1) \n" + ] + }, + { + "cell_type": "code", + "execution_count": 42, + "id": "2f2a22c4-4204-4673-8130-9fa9a99cfa12", + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "(7, 6)\n" + ] + }, + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 QakbotAzorultRemcosTrickbotAgentTeslatotal_coverage
T1562.001yesyesyesyesyes5
T1036yesyesyesyesyes5
T1566yesyesyesyesyes5
T1566.001yesyesyesyesyes5
T1562yesyesyesyesyes5
T1543yesyesyesyesyes5
T1059yesyesyesyesyes5
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 42, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "rslt_df = tdf[tdf['total_coverage'] == 5]\n", + "print(rslt_df.shape)\n", + "rslt_df.style.apply(highlight_rows, axis=1)" + ] + }, + { + "cell_type": "code", + "execution_count": 43, + "id": "e8d0e149-6e69-4a04-be98-51bac29a15af", + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "(5, 6)\n" + ] + }, + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 QakbotAzorultRemcosTrickbotAgentTeslatotal_coverage
T1053.005yesyesnoyesyes4
T1204.001yesyesyesnoyes4
T1204yesyesyesnoyes4
T1053yesyesnoyesyes4
T1218yesnoyesyesyes4
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 43, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "rslt_df = tdf[tdf['total_coverage'] == 4]\n", + "print(rslt_df.shape)\n", + "rslt_df.style.apply(highlight_rows, axis=1)" + ] + }, + { + "cell_type": "code", + "execution_count": 44, + "id": "9e5fa653-ce25-4616-8962-8350e858a6af", + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "(11, 6)\n" + ] + }, + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 QakbotAzorultRemcosTrickbotAgentTeslatotal_coverage
T1543.003yesyesnonoyes3
T1548.002noyesyesnoyes3
T1059.001yesyesnonoyes3
T1548noyesyesnoyes3
T1555noyesyesnoyes3
T1547.001yesyesyesnono3
T1555.003noyesyesnoyes3
T1112yesyesyesnono3
T1071yesyesnonoyes3
T1547yesyesyesnono3
T1055yesnoyesyesno3
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 44, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "rslt_df = tdf[tdf['total_coverage'] == 3]\n", + "print(rslt_df.shape)\n", + "rslt_df.style.apply(highlight_rows, axis=1)" + ] + }, + { + "cell_type": "code", + "execution_count": 45, + "id": "56b64501-cc50-4d5b-849b-2a0f917de6d0", + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "(12, 6)\n" + ] + }, + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 QakbotAzorultRemcosTrickbotAgentTeslatotal_coverage
T1049yesyesnonono2
T1592yesnoyesnono2
T1021noyesnoyesno2
T1027yesnonoyesno2
T1055.001yesnoyesnono2
T1590noyesnoyesno2
T1059.003yesyesnonono2
T1218.010yesnoyesnono2
T1590.005noyesnoyesno2
T1059.007yesnoyesnono2
T1569yesyesnonono2
T1569.002yesyesnonono2
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 45, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "rslt_df = tdf[tdf['total_coverage'] == 2]\n", + "print(rslt_df.shape)\n", + "rslt_df.style.apply(highlight_rows, axis=1)" + ] + }, + { + "cell_type": "code", + "execution_count": 46, + "id": "3f9a2ef2-1f38-40a7-98fa-e7e0b92a24da", + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "(39, 6)\n" + ] + }, + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 QakbotAzorultRemcosTrickbotAgentTeslatotal_coverage
T1087.002nononoyesno1
T1087nononoyesno1
T1218.011nononoyesno1
T1218.001nonononoyes1
T1021.002nononoyesno1
T1564.001noyesnonono1
T1482yesnononono1
T1564noyesnonono1
T1559.001nonoyesnono1
T1566.002yesnononono1
T1222.001noyesnonono1
T1134.004nonoyesnono1
T1134nonoyesnono1
T1574.001yesnononono1
T1069noyesnonono1
T1069.001noyesnonono1
T1059.005nonoyesnono1
T1021.001noyesnonono1
T1531noyesnonono1
T1036.003yesnononono1
T1489noyesnonono1
T1222noyesnonono1
T1562.004noyesnonono1
T1047yesnononono1
T1574.002yesnononono1
T1574yesnononono1
T1113nonoyesnono1
T1016yesnononono1
T1033yesnononono1
T1218.005nononoyesno1
T1014nonononoyes1
T1068nonononoyes1
T1219noyesnonono1
T1055.002yesnononono1
T1136.001noyesnonono1
T1136noyesnonono1
T1070nonoyesnono1
T1071.003nonononoyes1
T1016.001yesnononono1
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 46, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "rslt_df = tdf[tdf['total_coverage'] == 1]\n", + "print(rslt_df.shape)\n", + "rslt_df.style.apply(highlight_rows, axis=1)" + ] + }, + { + "cell_type": "markdown", + "id": "030119bf-4cef-4270-ba19-d9c9b2ea17f0", + "metadata": {}, + "source": [ + "### truth table mitre attack id 0technique vs analytic story(malware family)" + ] + }, + { + "cell_type": "code", + "execution_count": 47, + "id": "e6ccea82-34f5-49d5-b43d-82d29313e0ee", + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "(74, 6)\n" + ] + }, + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 QakbotAzorultRemcosTrickbotAgentTeslatotal_coverage
T1562.001-Disable_or_Modify_Toolsyesyesyesyesyes5
T1036-Masquerading (7)yesyesyesyesyes5
T1566-Phishing (3)yesyesyesyesyes5
T1566.001-Spearphishing_Attachmentyesyesyesyesyes5
T1562-Impair_Defenses (9)yesyesyesyesyes5
T1543-Create_or_Modify_System_Process (4)yesyesyesyesyes5
T1059-Command_and_Scripting_Interpreter (8)yesyesyesyesyes5
T1053.005-Scheduled_Taskyesyesnoyesyes4
T1204.001-Malicious_Linkyesyesyesnoyes4
T1204-User_Execution (3)yesyesyesnoyes4
T1053-Scheduled_Task/Job (5)yesyesnoyesyes4
T1218-System_Binary_Proxy_Execution (13)yesnoyesyesyes4
T1543.003-Windows_Serviceyesyesnonoyes3
T1548.002-Bypass_User_Account_Controlnoyesyesnoyes3
T1059.001-PowerShellyesyesnonoyes3
T1548-Abuse_Elevation_Control_Mechanism (4)noyesyesnoyes3
T1555-Credentials_from_Password_Stores (5)noyesyesnoyes3
T1547.001-Registry_Run_Keys_/_Startup_Folderyesyesyesnono3
T1555.003-Credentials_from_Web_Browsersnoyesyesnoyes3
T1112-Modify_Registryyesyesyesnono3
T1071-Application_Layer_Protocol (4)yesyesnonoyes3
T1547-Boot_or_Logon_Autostart_Execution (14)yesyesyesnono3
T1055-Process_Injection (12)yesnoyesyesno3
T1049-System_Network_Connections_Discoveryyesyesnonono2
T1592-Gather_Victim_Host_Information (4)yesnoyesnono2
T1021-Remote_Services (6)noyesnoyesno2
T1027-Obfuscated_Files_or_Information (9)yesnonoyesno2
T1055.001-Dynamic-link_Library_Injectionyesnoyesnono2
T1590-Gather_Victim_Network_Information (6)noyesnoyesno2
T1059.003-Windows_Command_Shellyesyesnonono2
T1218.010-Regsvr32yesnoyesnono2
T1590.005-IP_Addressesnoyesnoyesno2
T1059.007-JavaScriptyesnoyesnono2
T1569-System_Services (2)yesyesnonono2
T1569.002-Service_Executionyesyesnonono2
T1087.002-Domain_Accountnononoyesno1
T1087-Account_Discovery (4)nononoyesno1
T1218.011-Rundll32nononoyesno1
T1218.001-Compiled_HTML_Filenonononoyes1
T1021.002-SMB/Windows_Admin_Sharesnononoyesno1
T1564.001-Hidden_Files_and_Directoriesnoyesnonono1
T1482-Domain_Trust_Discoveryyesnononono1
T1564-Hide_Artifacts (10)noyesnonono1
T1559.001-Component_Object_Modelnonoyesnono1
T1566.002-Spearphishing_Linkyesnononono1
T1222.001-Windows_File_and_Directory_Permissions_Modificationnoyesnonono1
T1134.004-Parent_PID_Spoofingnonoyesnono1
T1134-Access_Token_Manipulation (5)nonoyesnono1
T1574.001-DLL_Search_Order_Hijackingyesnononono1
T1069-Permission_Groups_Discovery (3)noyesnonono1
T1069.001-Local_Groupsnoyesnonono1
T1059.005-Visual_Basicnonoyesnono1
T1021.001-Remote_Desktop_Protocolnoyesnonono1
T1531-Account_Access_Removalnoyesnonono1
T1036.003-Rename_System_Utilitiesyesnononono1
T1489-Service_Stopnoyesnonono1
T1222-File_and_Directory_Permissions_Modification (2)noyesnonono1
T1562.004-Disable_or_Modify_System_Firewallnoyesnonono1
T1047-Windows_Management_Instrumentationyesnononono1
T1574.002-DLL_Side-Loadingyesnononono1
T1574-Hijack_Execution_Flow (12)yesnononono1
T1113-Screen_Capturenonoyesnono1
T1016-System_Network_Configuration_Discovery (1)yesnononono1
T1033-System_Owner/User_Discoveryyesnononono1
T1218.005-Mshtanononoyesno1
T1014-Rootkitnonononoyes1
T1068-Exploitation_for_Privilege_Escalationnonononoyes1
T1219-Remote_Access_Softwarenoyesnonono1
T1055.002-Portable_Executable_Injectionyesnononono1
T1136.001-Local_Accountnoyesnonono1
T1136-Create_Account (3)noyesnonono1
T1070-Indicator_Removal (9)nonoyesnono1
T1071.003-Mail_Protocolsnonononoyes1
T1016.001-Internet_Connection_Discoveryyesnononono1
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 47, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "\n", + "\n", + "new_table = yes_no_table(mitre_attack_tid_name_dict, story_name_list)\n", + "tdf = pd.DataFrame.from_dict(new_table, orient=\"index\")\n", + "tdf.columns = [\"Qakbot\", \"Azorult\", \"Remcos\", \"Trickbot\", \"AgentTesla\", \"total_coverage\"]\n", + "print(tdf.shape)\n", + "tdf = tdf.sort_values(by=['total_coverage'], ascending = False)\n", + "tdf.style.apply(highlight_rows, axis=1) " + ] + }, + { + "cell_type": "code", + "execution_count": 48, + "id": "3f48e979-531c-466c-a299-1282cff990df", + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "(7, 6)\n" + ] + }, + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 QakbotAzorultRemcosTrickbotAgentTeslatotal_coverage
T1562.001-Disable_or_Modify_Toolsyesyesyesyesyes5
T1036-Masquerading (7)yesyesyesyesyes5
T1566-Phishing (3)yesyesyesyesyes5
T1566.001-Spearphishing_Attachmentyesyesyesyesyes5
T1562-Impair_Defenses (9)yesyesyesyesyes5
T1543-Create_or_Modify_System_Process (4)yesyesyesyesyes5
T1059-Command_and_Scripting_Interpreter (8)yesyesyesyesyes5
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 48, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "rslt_df = tdf[tdf['total_coverage'] == 5]\n", + "print(rslt_df.shape)\n", + "rslt_df.style.apply(highlight_rows, axis=1)" + ] + }, + { + "cell_type": "code", + "execution_count": 49, + "id": "21f3b96f-b020-49ee-97a9-579196ba6a99", + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "(5, 6)\n" + ] + }, + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 QakbotAzorultRemcosTrickbotAgentTeslatotal_coverage
T1053.005-Scheduled_Taskyesyesnoyesyes4
T1204.001-Malicious_Linkyesyesyesnoyes4
T1204-User_Execution (3)yesyesyesnoyes4
T1053-Scheduled_Task/Job (5)yesyesnoyesyes4
T1218-System_Binary_Proxy_Execution (13)yesnoyesyesyes4
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 49, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "rslt_df = tdf[tdf['total_coverage'] == 4]\n", + "print(rslt_df.shape)\n", + "rslt_df.style.apply(highlight_rows, axis=1)" + ] + }, + { + "cell_type": "code", + "execution_count": 50, + "id": "22b8ad1c-1a53-41ba-bdff-6d5ed29f8ad5", + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "(11, 6)\n" + ] + }, + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 QakbotAzorultRemcosTrickbotAgentTeslatotal_coverage
T1543.003-Windows_Serviceyesyesnonoyes3
T1548.002-Bypass_User_Account_Controlnoyesyesnoyes3
T1059.001-PowerShellyesyesnonoyes3
T1548-Abuse_Elevation_Control_Mechanism (4)noyesyesnoyes3
T1555-Credentials_from_Password_Stores (5)noyesyesnoyes3
T1547.001-Registry_Run_Keys_/_Startup_Folderyesyesyesnono3
T1555.003-Credentials_from_Web_Browsersnoyesyesnoyes3
T1112-Modify_Registryyesyesyesnono3
T1071-Application_Layer_Protocol (4)yesyesnonoyes3
T1547-Boot_or_Logon_Autostart_Execution (14)yesyesyesnono3
T1055-Process_Injection (12)yesnoyesyesno3
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 50, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "rslt_df = tdf[tdf['total_coverage'] == 3]\n", + "print(rslt_df.shape)\n", + "rslt_df.style.apply(highlight_rows, axis=1)" + ] + }, + { + "cell_type": "code", + "execution_count": 51, + "id": "fb52fd1f-f949-4caf-a0e3-e0a40ebffb85", + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "(12, 6)\n" + ] + }, + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 QakbotAzorultRemcosTrickbotAgentTeslatotal_coverage
T1049-System_Network_Connections_Discoveryyesyesnonono2
T1592-Gather_Victim_Host_Information (4)yesnoyesnono2
T1021-Remote_Services (6)noyesnoyesno2
T1027-Obfuscated_Files_or_Information (9)yesnonoyesno2
T1055.001-Dynamic-link_Library_Injectionyesnoyesnono2
T1590-Gather_Victim_Network_Information (6)noyesnoyesno2
T1059.003-Windows_Command_Shellyesyesnonono2
T1218.010-Regsvr32yesnoyesnono2
T1590.005-IP_Addressesnoyesnoyesno2
T1059.007-JavaScriptyesnoyesnono2
T1569-System_Services (2)yesyesnonono2
T1569.002-Service_Executionyesyesnonono2
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 51, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "rslt_df = tdf[tdf['total_coverage'] == 2]\n", + "print(rslt_df.shape)\n", + "rslt_df.style.apply(highlight_rows, axis=1)" + ] + }, + { + "cell_type": "code", + "execution_count": 52, + "id": "5533fb9c-36af-4ea1-addc-0f447f3e62dc", + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "(39, 6)\n" + ] + }, + { + "data": { + "text/html": [ + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
 QakbotAzorultRemcosTrickbotAgentTeslatotal_coverage
T1087.002-Domain_Accountnononoyesno1
T1087-Account_Discovery (4)nononoyesno1
T1218.011-Rundll32nononoyesno1
T1218.001-Compiled_HTML_Filenonononoyes1
T1021.002-SMB/Windows_Admin_Sharesnononoyesno1
T1564.001-Hidden_Files_and_Directoriesnoyesnonono1
T1482-Domain_Trust_Discoveryyesnononono1
T1564-Hide_Artifacts (10)noyesnonono1
T1559.001-Component_Object_Modelnonoyesnono1
T1566.002-Spearphishing_Linkyesnononono1
T1222.001-Windows_File_and_Directory_Permissions_Modificationnoyesnonono1
T1134.004-Parent_PID_Spoofingnonoyesnono1
T1134-Access_Token_Manipulation (5)nonoyesnono1
T1574.001-DLL_Search_Order_Hijackingyesnononono1
T1069-Permission_Groups_Discovery (3)noyesnonono1
T1069.001-Local_Groupsnoyesnonono1
T1059.005-Visual_Basicnonoyesnono1
T1021.001-Remote_Desktop_Protocolnoyesnonono1
T1531-Account_Access_Removalnoyesnonono1
T1036.003-Rename_System_Utilitiesyesnononono1
T1489-Service_Stopnoyesnonono1
T1222-File_and_Directory_Permissions_Modification (2)noyesnonono1
T1562.004-Disable_or_Modify_System_Firewallnoyesnonono1
T1047-Windows_Management_Instrumentationyesnononono1
T1574.002-DLL_Side-Loadingyesnononono1
T1574-Hijack_Execution_Flow (12)yesnononono1
T1113-Screen_Capturenonoyesnono1
T1016-System_Network_Configuration_Discovery (1)yesnononono1
T1033-System_Owner/User_Discoveryyesnononono1
T1218.005-Mshtanononoyesno1
T1014-Rootkitnonononoyes1
T1068-Exploitation_for_Privilege_Escalationnonononoyes1
T1219-Remote_Access_Softwarenoyesnonono1
T1055.002-Portable_Executable_Injectionyesnononono1
T1136.001-Local_Accountnoyesnonono1
T1136-Create_Account (3)noyesnonono1
T1070-Indicator_Removal (9)nonoyesnono1
T1071.003-Mail_Protocolsnonononoyes1
T1016.001-Internet_Connection_Discoveryyesnononono1
\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 52, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "rslt_df = tdf[tdf['total_coverage'] == 1]\n", + "print(rslt_df.shape)\n", + "rslt_df.style.apply(highlight_rows, axis=1)" + ] + }, + { + "cell_type": "code", + "execution_count": null, + "id": "62821d46-d7a2-4964-9401-47189fb4b510", + "metadata": {}, + "outputs": [], + "source": [] + }, + { + "cell_type": "code", + "execution_count": null, + "id": "848faf4c-1939-4b32-ab7d-9821d5bf2ed0", + "metadata": {}, + "outputs": [], + "source": [] + } + ], + "metadata": { + "kernelspec": { + "display_name": "Python 3 (ipykernel)", + "language": "python", + "name": "python3" + }, + "language_info": { + "codemirror_mode": { + "name": "ipython", + "version": 3 + }, + "file_extension": ".py", + "mimetype": "text/x-python", + "name": "python", + "nbconvert_exporter": "python", + "pygments_lexer": "ipython3", + "version": "3.9.15" + } + }, + "nbformat": 4, + "nbformat_minor": 5 +} diff --git a/notebooks/cisa_commonalities_notebook.yml b/notebooks/cisa_commonalities_notebook.yml new file mode 100644 index 0000000000..d0198ed998 --- /dev/null +++ b/notebooks/cisa_commonalities_notebook.yml @@ -0,0 +1,3 @@ +description: a simple jupyter notebook that helps Splunk Threat Research Team sees the data connections, commonalities and differences of security content stories or threat families. +filename: cisa_commonalities_notebook.ipynb +name: cisa_commonalities_notebook \ No newline at end of file diff --git a/requirements.txt b/requirements.txt index 837747f901..8aa4f7a8fd 100644 --- a/requirements.txt +++ b/requirements.txt @@ -10,7 +10,7 @@ pydantic==1.10.4 pytest==7.2.0 PyYAML==5.4.1 questionary==1.10.0 -requests==2.28.1 +requests==2.28.2 six==1.16.0 splunk-appinspect==2.32.0 splunk-sdk==1.7.2