Manage malware

Manage the malware information that you imported from the MITRE TAXII collections. Malware is a type of TTP that represents malicious code. It refers to a program that is covertly inserted into a system. The intent of a malware is to compromise the confidentiality, integrity, or availability of the victim's data, applications, or operating system (OS).

Avant de commencer

Role required:

• sn_ti.admin: delete access
• sn_ti.read: read access
• sn_ti.write: create, write access

Procédure

1. Navigate to All > Threat Intelligence > MITRE ATT&CK Repository > Malware.
   You can view the listed malware.
2. Click a malware to view all the associated information.
   In the following illustration, you can view the details for the 3PARA RAT malware, its ID, source, and other related information.
3. To view how these objects are related, click Show Relationships.

Que faire ensuite

Use the techniques module to add or modify the malware data.

Concepts associés

• Auto-extract technique rules for importing MITRE-ATT&CK information

Tâches associées

• Set up the MITRE-ATT&CK framework
• Manage matrices
• Manage techniques
• Manage mitigations
• Manage groups
• Manage tools
• Manage MITRE relationships
• Manage CVE and technique mapping
• Extend the MITRE-ATT&CK data
• Define the data source and detection tool mapping
• Define the data source and data component mapping
• Define the technique detection coverage
• Map your technique detection coverage to a technique
• Define the mitigation coverage
• Map your mitigation coverage to a technique
• Create and map detection rules
• Review threat group and MITRE-ATT&CK techniques mapping
• Threat group to technique heatmap definition
• Review the MITRE-ATT&CK system properties

Référence associée

• Get started with MITRE-ATT&CK framework
• Understand the MITRE to STIX data model
• Domain separation and MITRE-ATT&CK