Skip to content

feat(cli): Implement list rules command#229

Merged
rabbitstack merged 1 commit intomasterfrom
list-rules-command
Dec 24, 2023
Merged

feat(cli): Implement list rules command#229
rabbitstack merged 1 commit intomasterfrom
list-rules-command

Conversation

@rabbitstack
Copy link
Copy Markdown
Owner

The new subcommand is able to list all rules contained in the local detection rules catalog. It can also receive the -s option to show the summary of rules per MITRE tactic/technique. Example:

┌────────────────────────────────────────────────────┬─────────┐
│ TACTIC                                             │ # RULES │
├────────────────────────────────────────────────────┼─────────┤
│ Persistence                                        │ 6       │
│ Credential Access                                  │ 17      │
│ Defense Evasion                                    │ 2       │
│ Initial Access                                     │ 2       │
├────────────────────────────────────────────────────┼─────────┤
│ TECHNIQUE                                          │ # RULES │
├────────────────────────────────────────────────────┼─────────┤
│ System Binary Proxy Execution                      │ 2       │
│ Phishing                                           │ 2       │
│ Boot or Logon Autostart Execution                  │ 6       │
│ Credentials from Password Stores                   │ 7       │
│ Modify Authentication Process                      │ 2       │
│ OS Credential Dumping                              │ 6       │
│ Unsecured credentials                              │ 2       │
├────────────────────────────────────────────────────┼─────────┤
│ TOTAL                                              │ 27      │
└────────────────────────────────────────────────────┴─────────┘

The new subcommand is able to list all rules contained in the local detection rules catalog. It can also receive the `-s` option to show the summary of rules per MITRE tactic/technique.
@rabbitstack rabbitstack merged commit 74ba252 into master Dec 24, 2023
@rabbitstack rabbitstack deleted the list-rules-command branch December 24, 2023 23:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant