Mitre Attack Techniques Observed

Events mapped against MITRE ATT&CK Techniques that have been observed in the environment, with percentage of total.

KQL Library  /  MITRE ATT&CK

 MITRE ATT&CK mitre-attack-techniques-observed.kql

Events mapped against MITRE ATT&CK Techniques that have been observed in the environment, with percentage of total.

 Download .kql 
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// This query identifies events mapped against the MITRE ATT&CK Matrix that have been observed in the environment

let TotalCount = toscalar(
    SecurityAlert
    | where TimeGenerated > ago(90d)
    | where isnotempty(Techniques)
    | mv-expand technique = split(Techniques, ", ")
    | summarize TotalCount = count()
    );
SecurityAlert
| where TimeGenerated > ago(90d)
| where isnotempty(Techniques)
| mv-expand technique = split(Techniques, ", ")
| summarize Count = count() by tostring(technique)
| extend Percentage = strcat(round(Count * 100.0 / TotalCount, 2), '%')
| sort by Count desc
| top 10 by Count
| project ["MITRE Technique"] = technique, Count, Percentage