Data Components
Data Components identify the specific properties/values relevant to detecting a given ATT&CK technique or sub-technique.
Active Directory Credential Request
Requests for authentication credentials via Kerberos or other methods like NTLM and LDAP queries.
Active Directory Object Access
Object access refers to activities where AD objects (e.g., user accounts, groups, policies) are accessed or queried.
Active Directory Object Creation
Creating new objects in AD, such as user accounts, groups, organizational units (OUs), or trust relationships.
Active Directory Object Deletion
Object deletion in AD (e.g., user accounts, groups, OUs) is logged as Event ID 5141.
Active Directory Object Modification
Changes to AD objects (e.g., users, groups, OUs) are logged as Event ID 5136 (Object Modification) or 5163 (Attribute Changes).
Active DNS
Captures queried DNS registry data that highlights current domain-to-IP address resolutions. This data includes both direct queries to DNS servers and records that provide mappings between domain names and associated IP addresses.
API Calls
API calls utilized by an application that could indicate malicious activity.
Application Assets
Additional assets included with an application.
Application Log Content
Application Log Content refers to logs generated by applications or services, providing a record of their activity. These logs may include metrics, errors, performance data, and operational alerts from web, mail, or other applications.
Asset Inventory
This includes sources of current and expected devices on the network, including the manufacturer, model, and necessary identifiers (e.g., IP and hardware addresses).
Certificate Registration
Certificate Registration refers to the collection and analysis of information about digital certificates, including current, revoked, and expired certificates.
Command Execution
Command Execution involves monitoring and capturing the execution of textual commands (including shell commands, cmdlets, and scripts) within an operating system or application.
Comprehensive Data Collection
This repository contains all 119 MITRE ATT&CK Data Components. The components displayed above represent a sample of the complete collection. Each component is categorized by domain (Enterprise, ICS, or Mobile) and includes relevant detection examples.