OSSEM Detection Model (DM)

This part of the project focuses on defining the required telemetry to gather security context of different behaviors that happen in a network environment. Network behaviors are described using data entities and the interaction or relationships among them. These relationships and its metadata may facilitate the creation of data analytics and validate detection of adversary techniques. We have also extended this concept to the MITRE-ATT&CK framework.

Projects Using the OSSEM Detection Model

• Threat Hunter Playbook

Documentation Format and Schema

We document relationships metadata in YAML format (.yml extension) using the following schema:

a) General Metadata

• Metadata that help to identify and describe the relationship

b) ATT&CK Data Sources Mapping (attack)

• Metadata that describes the mapping of relationships to Data Sources and Data Components from the MITRE-ATT&CK framework.
• This section of the YAML file is not mandatory, and it should be described using a Dictionary.

c) Network Environment Behavior (behavior)

• Metadata that describes the interaction among entities. It considers three components: source entity, relationship, and target entity. Entities' names are aligned with the OSSEM Common Data Model project.
• This sections of the YAML file is mandatory, and it should be described using a Dictionary.

d) Security Telemetry Mapping (security_events)

• Metadata that describes the mapping of security telemetry to relationships.
• This section of the YAML file is mandatory, and it should be described using a List of Dictionaries, where each dictionary represents a specific event log or source of data.
• Even though this section is mandatory, some of the fields within this section are not since they only apply for specific telemetry sources.
  • We use fields audit_category, audit_sub_category, and channel when mapping Microsoft Windows Security Auditing events.
  • We use field audit_category in Windows Sysmon events in order to populate the Enable Commands columns of the ATT&CK CSV file
  • We use field filter_in to provide additional context when an event log or telemetry source describes multiple objects or actions using the same schema. A good example of this is Windows Security Auditing event 4656, where the object context varies based on the ObjectType field (Process, Key, Service, etc).

Contribution Example

Here is YAML example that you can use as a reference when contributing relationships:

name: Process created Process
contributors:
- Jose Rodriguez @Cyb3rPandaH
attack:
  data_source: process
  data_component: process creation
behavior:
  source: process
  relationship: created
  target: process
security_events:
- event_id: '4688'
  name: A new process has been created.
  platform: windows
  audit_category: Detailed Tracking
  audit_sub_category: Process Creation
  channel: Security
  log_source: Microsoft-Windows-Security-Auditing
  event_version:
  - '2'
- event_id: DeviceProcessEvents
  name: DeviceProcessEvents
  platform: windows
  log_source: Microsoft Defender for Endpoint
  filter_in:
  - ActionType: ProcessCreated
  event_version:
  - '1'
- event_id: '1'
  name: Process Creation.
  platform: windows
  audit_category: ProcessCreate
  channel: Microsoft-Windows-Sysmon/Operational
  log_source: Microsoft-Windows-Sysmon
  event_version:
  - '4.32'
references:
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688
- https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-1-process-creation
notes:
- For event 4688 - You must enable "Administrative Templates\System\Audit Process Creation\Include command line in process creation events" group policy to include command line in process creation events.

Available documents

References

Presentations:

• Started from the Bottom: Exploiting Data Sources to Uncover ATT&CK Behaviors

Related Projects:

• OSSEM Data Dictionaries
• OSSEM Common Data Model

ATT&CK:

• ATT&CK Data Sources
• Defining ATT&CK Data Sources, Part I: Enhancing the Current State
• Defining ATT&CK Data Sources, Part II: Operationalizing the Methodology
• Finding Cyber Threats with ATTCK Based Analytics
• ATT&CK Data Sources GitHub repository - DEPRECATED

Other:

• CAR Analytics
• CAR Analytics Data Model
• STIX Cybox ObjectRelationshipVOcab-1.1
• Cybox Object
• STIX Version 2.0. Part 4 - Cyber Observable Object
• Quantifying your hunt - not your parent's red teaming