[FR] Capability to Pull New ATT&CK Version and Update Existing Rule Threat Maps

[terrancedejesus]

Description

From time to time we will need to update MITRE ATT&CK data locally and then update any potential name changes to techniques and subtechniques. When using pytests, these are checked with the updates data to confirm names match but we should be able to programmatically update the local ATT&CK data and current mappings with a single command.

This was found during efforts to update all mappings.

• [Rule Tuning] Missing MITRE ATT&CK Mappings #2073

While the following code is not perfect, it does give a good starting point for being able to do this.

devtools.py

@dev_group.group('attack')
def attack_group():
    """Commands for dev attack methods"""

@attack_group.command('update')
@click.option('--update_existing', '-u', is_flag=True, help="Update outdated technique names")
def update(update_existing: bool):
    """Updates current MITRE ATT&CK mappings"""
    refresh_attack_data()

    if update_existing:
        click.echo("Updating incorrect mappings\n")
        rules = RuleCollection.default()
        for rule in rules:
            threat_mapping = rule.contents.data.threat or []
            if threat_mapping:
                changes = False
                for entry in threat_mapping:
                    techniques = entry.technique or []

                    if rule.contents.data.threat[0].technique:
                        new_technique_list = []
                        for technique in techniques:
                            expected_technique = technique_lookup[technique.id]['name']
                            if expected_technique != technique.name:
                                click.echo(rule.contents.data.name)
                                click.echo(f"\t Technique Name: {technique.name} -> {expected_technique}")
                                new_technique_data = dataclasses.replace(rule.contents.data.threat[0].technique[0], name=expected_technique)
                                changes = True
                            else:
                                new_technique_data = rule.contents.data.threat[0].technique[0]

                            sub_techniques = technique.subtechnique or []
                            updated_technique_data = None
                            if sub_techniques:
                                for sub_technique in sub_techniques:
                                    new_subtechnique_list = []
                                    expected_sub_technique = technique_lookup[sub_technique.id]['name']
                                    if expected_sub_technique not in [st.name for st in  technique.subtechnique]:
                                        click.echo(rule.contents.data.name)
                                        click.echo(f"\t Sub-Technique Name: {technique.subtechnique[0].name} -> {expected_sub_technique}")
                                        new_subtechnique_data = dataclasses.replace(rule.contents.data.threat[0].technique[0].subtechnique[0], name=expected_sub_technique)
                                        new_subtechnique_list.append(new_subtechnique_data)
                                        changes = True
                                    else:
                                        new_subtechnique_list.append(sub_technique)

                                updated_technique_data = dataclasses.replace(new_technique_data, subtechnique=new_subtechnique_list)
                            new_technique_list.append(updated_technique_data or new_technique_data)

                        #if changes:
                            #new_metadata = dataclasses.replace(rule.contents.metadata, updated_date=str(date.today()).replace("-","/"))
                            #updated_contents= dataclasses.replace(rule.contents.data, threat=new_technique_list)
                            #new_rule = TOMLRule(path=rule.path, contents=updated_contents)
                            #new_rule.save_toml()

[Mikaayenson]

I came across update_threat_map and build_threat_map_entry as well. They look useful.

[shashank-elastic]

During the study came across a file artifact that is already being generated named attack-crosswalk.json with all the mapping changes in a single consolidated mapping!

[Mikaayenson]

I think @brokensound77 started working on this as well.