implementing-mitre-attack-coverage-mapping

MITRE ATT&CK 覆盖度映射

概述

MITRE ATT&CK 覆盖度映射为 SOC 团队提供了一个结构化、以对手为中心的视角，用以评估检测能力。企业 SIEM 平均仅能检测 21% 的 ATT&CK 技术（2025 年 CardinalOps 报告），而现有规则中有 13% 因数据源配置错误而失效。系统化的覆盖度映射可以识别缺口、确定规则开发的优先级，并持续跟踪检测成熟度。ATT&CK v18.1（2025 年 12 月）是最新版本。

适用场景

• 在环境中部署或配置 mitre attack coverage mapping 能力时
• 在建立符合合规要求的安全控制措施时
• 在构建或改进该领域的安全架构时
• 在开展需要此实施的安全评估时

前置条件

• 可访问 MITRE ATT&CK Navigator（https://mitre-attack.github.io/attack-navigator/）
• 所有活跃 SIEM 检测规则的清单
• 每条检测规则的 MITRE ATT&CK 技术映射
• 数据源清单（已采集哪些日志源）
• 了解与所在行业相关的对手威胁画像

覆盖度映射流程

步骤 1：导出当前检测规则

# Splunk ES - Export all active correlation searches with MITRE mappings
| rest /services/saved/searches
| search disabled=0 action.correlationsearch.enabled=1
| table title, search, action.notable.param.security_domain,
    action.notable.param.severity, action.correlationsearch.annotations
| eval mitre_techniques=mvfilter(match('action.correlationsearch.annotations', "mitre_attack"))

// Microsoft Sentinel - Export analytics rules with MITRE mapping
SecurityAlert
| summarize count() by AlertName, ProductName
| join kind=inner (
    resources
    | where type == "microsoft.securityinsights/alertrules"
    | extend tactics = properties.tactics
) on $left.AlertName == $right.name

步骤 2：构建覆盖度矩阵

ATT&CK Navigator 图层格式

{
    "name": "SOC Detection Coverage - 2025",
    "versions": {
        "attack": "16",
        "navigator": "5.1",
        "layer": "4.5"
    },
    "domain": "enterprise-attack",
    "description": "Current detection coverage mapping",
    "techniques": [
        {
            "techniqueID": "T1110",
            "tactic": "credential-access",
            "color": "#00ff00",
            "comment": "2 active rules - Brute Force detection via EventCode 4625",
            "score": 75,
            "metadata": [
                {"name": "rule_count", "value": "2"},
                {"name": "data_sources", "value": "Windows Security Log, Linux Auth"},
                {"name": "last_validated", "value": "2025-01-15"}
            ]
        },
        {
            "techniqueID": "T1059.001",
            "tactic": "execution",
            "color": "#00ff00",
            "comment": "3 rules - PowerShell Script Block Logging",
            "score": 85
        },
        {
            "techniqueID": "T1055",
            "tactic": "defense-evasion",
            "color": "#ff0000",
            "comment": "NO DETECTION - Requires Sysmon EventCode 8/10",
            "score": 0
        }
    ],
    "gradient": {
        "colors": ["#ff0000", "#ffff00", "#00ff00"],
        "minValue": 0,
        "maxValue": 100
    }
}

步骤 3：为每项技术评分

分数	颜色	含义	标准
0	红色	无检测	无规则、缺失数据源
25	橙色	极少	规则存在但未验证/测试
50	黄色	部分	规则有效但覆盖范围有限
75	浅绿色	良好	已验证的规则且数据源良好
100	绿色	优秀	多条已验证规则，并通过模拟测试

评分标准详情

Score = Data_Source_Score (0-25) + Rule_Quality_Score (0-25) +
        Validation_Score (0-25) + Enrichment_Score (0-25)

Data_Source_Score:
  25: All required data sources ingested and parsed
  15: Primary data source available
  5:  Partial data source coverage
  0:  Required data sources not available

Rule_Quality_Score:
  25: Rule uses CIM-compliant queries with proper thresholds
  15: Rule works but may generate false positives
  5:  Basic rule with no tuning
  0:  No detection rule

Validation_Score:
  25: Validated with adversary emulation (Atomic Red Team)
  15: Tested with synthetic data
  5:  Logic reviewed but not tested
  0:  Not validated

Enrichment_Score:
  25: Context-rich with asset, identity, and TI enrichment
  15: Basic enrichment (asset lookup)
  5:  No enrichment
  0:  N/A (no rule)

步骤 4：识别优先缺口

缺口优先级框架

Priority = Technique_Prevalence x Impact x Feasibility

Technique_Prevalence (0-10):
  - Based on MITRE Top Techniques report
  - Frequency in your industry's threat landscape
  - Observed in recent incidents/breaches

Impact (0-10):
  - Damage potential if technique succeeds
  - Difficulty of recovery
  - Data sensitivity at risk

Feasibility (0-10):
  - Data source availability
  - Rule complexity
  - Engineering effort required

需覆盖的优先技术（2025 年）

技术	ID	普遍程度	缺口原因
命令和脚本解释器	T1059	极高	需要脚本块日志记录
网络钓鱼	T1566	极高	需要电子邮件网关集成
有效账户	T1078	高	需要基线行为
进程	T1055	高	需要 Sysmon 或 EDR
横向移动（RDP/SMB）	T1021	高	需要网络分段可见性
计划任务/作业	T1053	高	需要事件日志采集
为造成影响而加密数据	T1486	高	需要文件系统监控
入口工具传输	T1105	中	需要网络流量分析

步骤 5：构建检测路线图

Quarter 1: Close Critical Gaps (Score 0, High Prevalence)
  Week 1-2: Enable missing data sources
  Week 3-4: Build and test rules for top 5 gap techniques
  Week 5-8: Validate with adversary emulation
  Week 9-12: Tune and operationalize

Quarter 2: Improve Partial Coverage (Score 25-50)
  - Upgrade existing rules with enrichment
  - Add secondary detection methods
  - Validate with purple team exercises

Quarter 3: Mature Good Coverage (Score 50-75)
  - Add behavioral analytics
  - Implement detection-as-code pipeline
  - Cross-technique correlation rules

Quarter 4: Excellence (Score 75-100)
  - Continuous testing with BAS tools
  - Automated coverage regression testing
  - Red team validation

自动化覆盖度评估

数据源到技术的映射

# Map available data sources to detectable techniques
DATA_SOURCE_TECHNIQUE_MAP = {
    "Windows Security Event Log": [
        "T1110", "T1078", "T1053.005", "T1098", "T1136",
        "T1070.001", "T1021.001", "T1543.003"
    ],
    "Sysmon": [
        "T1055", "T1059", "T1003", "T1547.001", "T1036",
        "T1218", "T1105", "T1071"
    ],
    "Network Traffic (Firewall/IDS)": [
        "T1071", "T1048", "T1105", "T1572", "T1090",
        "T1571", "T1573"
    ],
    "DNS Logs": [
        "T1071.004", "T1568", "T1583.001", "T1048.003"
    ],
    "Email Gateway": [
        "T1566.001", "T1566.002", "T1534"
    ],
    "Cloud Audit Logs": [
        "T1078.004", "T1537", "T1530", "T1580",
        "T1087.004", "T1098.001"
    ],
}

报告仪表板查询

按战术划分的覆盖度摘要

| inputlookup mitre_coverage_lookup
| stats avg(score) as avg_score count(eval(score=0)) as no_coverage
    count(eval(score>0 AND score<50)) as partial
    count(eval(score>=50 AND score<75)) as good
    count(eval(score>=75)) as excellent
    count as total
    by tactic
| eval coverage_pct=round((total - no_coverage) / total * 100, 1)
| sort -coverage_pct

参考资料

• CyberDefenders - 面向 SOC 与 DFIR 分析师的 MITRE ATT&CK
• MITRE ATT&CK Navigator
• CardinalOps - 2025 年 SIEM 检测覆盖度报告
• Datadog - 云 SIEM MITRE ATT&CK 映射
• Picus Security - MITRE ATT&CK 框架指南