rule update: add MITRE tags for rules

[Kaizhe]

Added MITRE tags for default falco rules

[Kaizhe]

At the top level, we have the following categories are covered:

Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Exfiltration, Command and Control (in sub cat Port Knocking)

https://attack.mitre.org/matrices/enterprise/linux/

[mstemm]

Do want to include "Mitre" or similar in each tag so it's clear that we're tagging them for the mitre attack framework?

Also, we publish the set of tags we use at https://falco.org/docs/rules/#tags-for-current-falco-ruleset. We should add info about mitre tags there. The docs just moved to the new site, so I'll coordinate w/ you offline on how we update them.

[KnoxAnderson]

Maybe something like Mitre-Execution @Kaizhe

[Kaizhe]

👌

[mstemm]

I think this should be mitre_credential_access right?