Atomic Threat Coverage

Actionable analytics designed to combat threats

[Atomic Threat Coverage @atc_project]

RE&CT framework released!

A knowledge base of actionable Incident Response techniques, based on @MITREattack philosophy.
Mapping to ATT&CK / AMITT, export to @TheHive_Project templates, visualization in the Navigator, and more!

https://t.co/RTHfhqCgi1

#incidentresponse #dfir

[OSCD @oscd_initiative]

We stand with Ukraine and its people at this difficult time.
Russian invasion, supported by Belarus, must stop.
We condemn the actions of aggressors countries' leadership, not the people who live there.
The initiative will stay open for everyone, regardless nationality.

[OSCD @oscd_initiative]

OSCD: Simulation, Detection & Response Sprint #2 Summary has been published.
Thanks to all the participants and those who helped with it!
Stay tuned!

#ThreatIntel #ThreatHunting #ThreatDetection #BlueTeam

Links:
[EN] https://t.co/m8FAzj2X0D
[RU] https://t.co/jR9t3O2omH

[tuckner @tuckner]

Similar to using Notion previously, extended @atc_project's RE&CT, which generates @Confluence pages for security response actions, with the name of the runbook that @tines_io should use to remediate alerts. Documentation that directly improves #cybersecurity outcomes.

[Atomic Threat Coverage @atc_project]

@ReptonSec @cyb3rops we are now working on @oscd_initiative and atc-react 👋

[Florian Roth ⚡️ @cyb3rops]

The slides of the 7th @MITREattack workshop are now online

Agenda
https://t.co/nllFG6RdHz

Slides
https://t.co/NQE6Vljlq7

[Atomic Threat Coverage @atc_project]

here is an updated link: https://t.co/s4VpMyyLvZ

[Atomic Threat Coverage @atc_project]

here are our slides from EU @MITREattack workshop:

https://t.co/monP02tJYk

thanks to @FDezeure @circl_lu for making it happened!

[Thomas Patzke @blubbfiction]

Just merged the huge @oscd_initiative pull request into the Sigma master branch. Lots of new and improved rules.

Big thanks to all contributors, it was a pleasure to review!

[CyCAT_project @CycatP]

Slides of the CyCAT project - Lightning Talk given by @_saadk and @adulau are available. If you want to have an overview of the project, please have a look. We welcome feedback and ideas. #cybersecurity

https://t.co/S2ani132xD

[Thomas Patzke @blubbfiction]

Looking forward to some feedback regarding Sigma Correlations. My plan is to implement them in the new Sigma Converter.

[Atomic Threat Coverage @atc_project]

@DCSecuritydk thanks for kind feedback! we are still working on @oscd_initiative stuff, but at the same time a few updates regarding atc-data and further re&ct improvements are coming (:

[OSCD @oscd_initiative]

here is a way to show your support and send kudos to all hard workers that contributed to @sigma_hq, @redcanary Atomic Red Team, and @TheHive_Project projects during the OSCD sprints! subscribe and share the list:

https://t.co/Sh98T6LT9d

#EUATTACKworkshop

[OSCD @oscd_initiative]

The @OTR_Community supported @oscd_initiative adding 38 Detection Rules (previously developed at their APT29 Hackathon and Threat @HunterPlaybook) to the @sigma_hq repository during the sprint!
This way, the common initial outcome of the 2nd sprint for the Sigma ruleset is:

[OSCD @oscd_initiative]

The second OSCD sprint is officially ended!
Thanks to all contributors! Great job!

We will finalize WIP PRs and summarize the results in the upcoming weeks. The initial summary will be delivered this Friday at the Sixth EU ATT&CK Community Workshop:

https://t.co/vRyH0EIlkk

[OSCD @oscd_initiative]

The sprint starts tomorrow!

Please keep in mind that you need to create one Pull Request per analytic (@sigma_hq rule or Atomic test). Use the How-To as a reference for the rest of the workflow specifics:

https://t.co/4oHWOGaXjr

See you in GitHub comments!

[Atomic Threat Coverage @atc_project]

@steagee0 @yugoslavskiy @TheHive_Project unfortunately, not yet. we will prepare some in the near future, @mrblacyk is working hard on it. we will keep you posted!

[OSCD @oscd_initiative]

The next Sprint starts on October 5! We will focus on Simulation, Detection & Response: develop @redcanaryco #AtomicRedTeam tests, @sigma_hq Rules, and @TheHive_Project Responders; improving their coverage of @MITREattack and @atc_project RE&CT frameworks

https://t.co/TuajdofUmM

[Atomic Threat Coverage @atc_project]

@DCSecuritydk @BSidesAAR @bsideskbh please take a look at your DM

[Atomic Threat Coverage @atc_project]

@LitMoose preparation is everything. https://t.co/rJJPryvzpb

[Atomic Threat Coverage @atc_project]

RE&CT framework released!

A knowledge base of actionable Incident Response techniques, based on @MITREattack philosophy.
Mapping to ATT&CK / AMITT, export to @TheHive_Project templates, visualization in the Navigator, and more!

https://t.co/RTHfhqCgi1

#incidentresponse #dfir

[Antón Shipulin 🌐 @shipulin_anton]

Call for contributions to incident response techniques in ICS for RE&CT framework @yugoslavskiy @atc_project / a knowledge base of actionable Incident Response techniques, based on @MITREattack philosophy

https://t.co/cmheQYSE2j

[Atomic Threat Coverage @atc_project]

@blackkippah @MITREattack @TheHive_Project here is the link: https://t.co/MXDNsPi3EC

[Atomic Threat Coverage @atc_project]

RE&CT framework released!

A knowledge base of actionable Incident Response techniques, based on @MITREattack philosophy.
Mapping to ATT&CK / AMITT, export to @TheHive_Project templates, visualization in the Navigator, and more!

https://t.co/RTHfhqCgi1

#incidentresponse #dfir