Tags

Purpose

This page defines some standardized tags that can be used to categorize Sigma rules.

Namespaces

• attack: Categorization according to MITRE ATT&CK
• car: Link to the corresponding MITRE Cyber Analytics Repository (CAR)

Namespace: attack

• t1234: Refers to a technique
• g1234: Refers to a group
• s1234: Refers to software

Tactics:

• initial_access: Initial Access
• execution: Execution
• persistence: Persistence
• privilege_escalation: Privilege Escalation
• defense_evasion: Defense Evasion
• credential_access: Credential Access
• discovery: Discovery
• lateral_movement: Lateral_Movement
• collection: Collection
• exfiltration: Exfiltration
• c2: Command and Control
• impact: Impact

Namespace: car

Use the CAR tag from the analytics repository without the prepending CAR-. Example tag: car.2016-04-005.