ESM Default Content

Threat Intelligence Platform

This package is designed to detect security threat based on intelligence data feed from open source Malware Information Sharing Platform (MISP). It also follows MITRE ATT&CK framework.

This package requires installation of MIC for MISP. For more information on MIC, please refer to the documentation at https://community.microfocus.com/t5/ESM-and-ESM-Express/Model-Import-Connector-for-MISP-Malware-Information-Sharing/ta-p/2752381

Following use cases are covered in this package:

• Botnet Activity
• Dangerous Browsing
• Internal Asset Found in Reputation List
• Phishing
• Ransomware
• Suspicious Activity
• Suspicious DNS Query
• Suspicious Email
• Suspicious File Hash

Following MITRE ATT&CK Techniques are covered:

TA0001 Initial Access

• T1192-Spearphishing Link
• T1193-Spearphishing Attachment

TA0011 Command and Control

• T1043-Commonly Used Port
• T1065-Uncommonly Used Port
• T1092-Communication Through Removable Media
• T1219-Remote Access Tools

TA0040 Impact

• T1486-Data Encrypted for Impact

Following MITRE ATT&CK Techniques were added to Threat Intelligence Platform release 2.0:

T1043, T1065, T1092, T1193

Security Threat Monitoring:

This package monitors security threats based on security log events from firewall, IDS/IPS, OS, Application, Scanner, Anti-Virus etc.

Following use cases are included in this package:

• Application Monitoring
• Entity Monitoring
• Host Monitoring
• Malware Monitoring
• Network Monitoring
• Perimeter Monitoring
• Vulnerability Monitoring

Following MITRE ATT&CK Techniques are covered as well:

TA0001 Initial Access

• T1078-Valid Accounts
• T1091-Replication Through Removable Media
• T1189-Drive-by Compromise
• T1190-Exploit Public-Facing Application
• T1200-Hardware Additions

TA0002 Execution

• T1028-Windows Remote Management
• T1035-Service Execution
• T1047-Windows Management Instrumentation
• T1053-Scheduled Task
• T1059-Command-Line Interface
• T1061-Graphical User Interface
• T1064-Scripting
• T1072-Third-party Software
• T1085-Rundll32
• T1086-PowerShell
• T1117-Regsvr32
• T1118-InstallUtil
• T1121-Regsvcs Regasm
• T1127-Trusted Developer Utilities
• T1129-Execution through Module Load
• T1151-Space after Filename
• T1168-Local Job Scheduling
• T1170-Mshta
• T1173-Dynamic Data Exchange
• T1175-Component Object Model and Distributed COM
• T1191-CMSTP
• T1196-Control Panel Items
• T1203-Exploitation for Client Execution
• T1204-User Execution
• T1216-Signed Script Proxy Execution
• T1218-Signed Binary Proxy Execution
• T1220-XSL Script Processing
• T1223-Compiled HTML File

TA0003 Persistence

• T1031-Modify Existing Service
• T1038-DLL Search Order Hijacking
• T1050-New Service
• T1053-Scheduled Task
• T1078-Valid Accounts
• T1098-Account Manipulation
• T1136-Create Account
• T1168-Local Job Scheduling
• T1179-Hooking
• T1183-Image File Execution Options Injection
• T1215-Kernel Modules and Extensions

TA0004 Privilege Escalation

• T1038-DLL Search Order Hijacking
• T1050-New Service
• T1053-Scheduled Task
• T1055-Process Injection
• T1068-Exploitation for Privilege Escalation
• T1078-Valid Accounts
• T1179-Hooking
• T1183-Image File Execution Options Injection

TA0005 Defense Evasion

• T1038-DLL Search Order Hijacking
• T1055-Process Injection
• T1064-Scripting
• T1078-Valid Accounts
• T1085-Rundll32
• T1089-Disabling Security Tools
• T1090-Connection Proxy
• T1107-File Deletion
• T1117-Regsvr32
• T1118-InstallUtil
• T1121-Regsvcs Regasm
• T1127-Trusted Developer Utilities
• T1140-DeobfuscateDecode Files or Information
• T1151-Space after Filename
• T1170-Mshta
• T1183-Image File Execution Options Injection
• T1191-CMSTP
• T1196-Control Panel Items
• T1216-Signed Script Proxy Execution
• T1218-Signed Binary Proxy Execution
• T1220-XSL Script Processing
• T1223-Compiled HTML File

TA0006 Credential Access

• T1003-Credential Dumping
• T1098-Account Manipulation
• T1110-Brute Force
• T1179-Hooking

TA0007 Discovery

• T1087-Account Discovery

TA0008 Lateral Movement

• T1028-Windows Remote Management
• T1072-Third-party Software
• T1075-Pass the Hash
• T1091-Replication Through Removable Media
• T1210-Exploitation of Remote Services
• TA0009 Collection
• T1039-Data from Network Shared Drive
• T1113-Screen Capture
• T1114-Email Collection
• T1115-Clipboard Data

TA0010 Exfiltration

• T1002-Data Compressed
• T1041-Exfiltration Over Command and Control Channel
• T1048-Exfiltration Over Alternative Protocol
• T1052-Exfiltration Over Physical Medium

TA0011 Command and Control

• T1090-Connection Proxy
• T1483-Domain Generation Algorithms

TA0040 Impact

• T1486-Data Encrypted for Impact
• T1489-Service Stop
• T1498-Network Denial of Service

Following MITRE ATT&CK Techniques were added to Security Threat Monitoring release 2.0:

T1002, T1003, T1028, T1031, T1035, T1038, T1039, T1041, T1047, T1050, T1052, T1053, T1055, T1059, T1061, T1064, T1072, T1078, T1085, T1086, T1087, T1089, T1090, T1091, T1107, T1113, T1114, T1115, T1117, T1118, T1121, T1127, T1129, T1140, T1151, T1168, T1170, T1173, T1175, T1179, T1183, T1191, T1196, T1200, T1203, T1204, T1215, T1216, T1218, T1220, T1223

ESM 6.9.1 and above

Threat Intelligence Platform package requires MIC for MISP