SentinelOne-ATTACK-Queries

KO | EN

gitlite — search

#javascript #python #react #typescript #llm #go #rust #linux #java #cli #mcp #ios #openai #open-source

SentinelOne-ATTACK-Queries

(★ 95)

MITRE ATT&CK mapped queries for SentinelOne Deep Visiblity

SentinelOne-ATTACK-Queries 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# ATT&amp;CK Mapped SentinelOne Queries
[MITRE ATT&amp;CK](https://attack.mitre.org/) mapped queries for SentinelOne Deep Visiblity

## DISCONTINUED
*This project has been replaced by the [SentinelOne-Queries](https://github.com/keyboardcrunch/sentinelone-queries) repository which moves towards shareable signatures and for use in tooling. New repo is built of the work within this repository and most testing is still performed against Atomic Red Team. These queries will not be updated as detections change between Agent versions etc.*

This project aims to document SentinelOne Deep Visibility queries for detecting Windows TTPs generated by Red Canary Co's Atomic Red Team framework. Not all techniques documented within the Atomic Red Team project will have matching queries, due to limited data sources within SentinelOne some detections will be limited; we'll eventually expand beyond A.R.T. and just call these ATT&CK mapped queries, but I like the idea of having a framework to test these detections.

*These queries have been crafted and tested on Liberty console release and should support Deep Visibility 3.0. Recommending that your Sentinel Agents be on 4.2.x or newer, as some of the indicator data being queried is only collected by newer agents.*

## Tactics (COMPLETED)
[Privilege Escalation](https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/master/Tactics/PrivilegeEscalation.md)

[Initial Access](https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/master/Tactics/InitialAccess.md)

[Persistence](https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/master/Tactics/Persistence.md)

[Execution](https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/master/Tactics/Execution.md)

[Lateral Movement](https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/master/Tactics/LateralMovement.md)

[Impact](https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/master/Tactics/Impact.md)

[Exfiltration](https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/master/Tactics/Exfiltration.md)

## Tactics (IN PROGRESS)

[Defense Evasion](https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/master/Tactics/DefenseEvasion.md)

[Discovery](https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/master/Tactics/Discovery.md)

[Command and Control](https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/master/Tactics/CommandAndControl.md)

[Collection](https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/master/Tactics/Collection.md)

[Credential Access](https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/master/Tactics/CredentialAccess.md)

SentinelOne-ATTACK-Queries

SentinelOne-ATTACK-Queries 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

SentinelOne-ATTACK-Queries

SentinelOne-ATTACK-Queries 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README