STI Detection Engineering White Paper

Gap Analysis with AtomicRedTeam

The AtomicRedTeam Test Plan is stored in json format for Navigator 4.x or 3.x.
To view import the Windows_Endpoint_Test_Plan_4.0.json into MITRE ATT&CK Navigator 4.x (https://mitre-attack.github.io/attack-navigator/) to see test plan with sub-techniques.
To view import the Windows_Endpoint_Test_Plan_3.0.json into the MITRE ATT&CK Navigator 3.x in Security Onion 2.3.x to see the test plan without sub-techniques.

https://jqplay.org/
Paste contents Windows_Endpoint_Test_Plan_4.0.json into JSON window.
Copy the following text into the Filter field:
.techniques[] | {techniqueID: .techniqueID, comment: .comment} | .techniqueID
Copy and Paste Output into techniques.txt
PowerShell command to sort, unique, and count
get-content techniques.txt | sort-object | get-unique | measure-object -word

https://jqplay.org/
Paste contents Windows_Endpoint_Test_Plan_4.0.json into JSON window.
Copy the following text into the Filter field:
.techniques[] | {techniqueID: .techniqueID, comment: .comment} | select(.comment!="") | .techniqueID
Copy and Paste Output into techniqueID.txt
PowerShell command to sort, unique, and count
get-content techniqueID.txt | sort-object | get-unique | measure-object -word

https://jqplay.org/
Paste contents Windows_Endpoint_Test_Plan_4.0.json into JSON window.
Copy the following text into the Filter field:
.techniques[] | {techniqueID: .techniqueID, comment: .comment} | select(.comment!="") | .comment
Copy and Paste Output into comments.txt
PowerShell command to sort, unique, and count
(get-content comments.txt).split("|") | select-string "Atomic Test #" | sort-object | measure-object -line

For this research paper, the following setup commands were used.

Make a Tools Directory: New-Item -Path"c:\" -Name "Tools" -ItemType "directory"
Install Invoke-AtomicRedTeam Module: IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing); \ Install-AtomicRedTeam -InstallPath "c:\Tools" -getAtomics
Update PowerShell profile to automatically install the module in new shell:
notepad $profile
Paste the following, save, then close. Import-Module "C:\Tools\invoke-atomicredteam\Invoke-AtomicRedTeam.psd1" -Force \ $PSDefaultParameterValues = @{"Invoke-AtomicTest:PathToAtomicsFolder"="C:\Tools\atomics"}

Execute command Invoke-AtomicRedTeam TECHNIQUE_ID -TestNumbers TEST_NUMBERS
Atomic Red Team Test Commands

https://jqplay.org/
Paste contents Windows_Endpoint_Test_Plan_4.0.json into JSON window.
Copy the following text into the Filter field:
.techniques[] | {techniqueID: .techniqueID, tactic: .tactic, comment: .comment} | select(.comment!="")
Copy and Paste Output into techniqueID.txt
PowerShell command to sort, unique, and count
(((((gc .\command_list.txt | sort-object | get-unique).split("|")).TrimEnd("\n")).TrimStart('{"').TrimEnd('"}')).TrimEnd('"comment":')).split(",") | out-file AtomicRedTeam_Test_Commands.md
The rest is good old fashion manual text editing