ATT&CK - MISP

Overview

MISP is a threat intelligence platform for sharing, storing, and correlating Indicators of Compromise of targeted attacks, threat intelligence, financial fraud information, vulnerability information, or even counter-terrorism information.

MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations.

With MISP and MITRE ATT&CK Entities and Transforms, investigators may query data from a MISP Threat Sharing instance, browse through other MISP events, attributes, objects, tags, and galaxies.

With MISP and MITRE ATT&CK Entities and Transforms, investigators may query data from a MISP Threat Sharing instance, browse through other MISP events, attributes, objects, tags, and galaxies. A typical workflow may involve:

• Querying a MISP instance for Events that include a given IOC
• Pivoting a MISP Event into its attributes, objects, tags, galaxies and/or related Events
• Exploring further details from Galaxies and related Events
• Categorizing available related information within the MITRE ATT&CK framework

It also permits visualization of the full MITRE ATT&CK framework, the MISP Galaxies, and much more.

For ATT&CK visualization no MISP API keys are required (leave empty). For more information check out https://www.misp-project.org/ , https://attack.mitre.org/.

This set of Transforms is open source and can be downloaded or be installed as Local Transform. More here: https://github.com/MISP/MISP-maltego.

Please read the disclaimer before using the Transforms: https://github.com/MISP/MISP-maltego/blob/master/TRANSFORM_HUB_DISCLAIMER.md.

If you are not yet a member of a MISP community, see: https://www.misp-project.org/communities/.

You can read more about ATT&CK - MISP Transforms for Maltego on our website here.

Pricing & Access

Community Hub

Available free to Maltego CE users (API Key Required): Sign up for a free API key here.

Commercial Hub

Available free to Maltego One users (API Key Required): Sign up for a free API key here.

ATT&CK - MISP Transform

To Objects

Transform Settings

Transform Meta Info

To Malware/Software/Tools

Transform Meta Info

To Attributes/Objects

Transform Settings

Transform Meta Info

To Tags

Transform Settings

Transform Meta Info

To Related Events

Transform Settings

Transform Meta Info

Search in MISP

Description

Use % at the front/end for wildcard search.

Transform Settings

Transform Meta Info

To Attributes

Transform Settings

Transform Meta Info

To Galaxies / ATTACK

Transform Settings

Transform Meta Info

To Related Galaxies

Transform Meta Info

To Related Objects

Transform Settings

Transform Meta Info

To MISP Events

Transform Settings

Transform Meta Info

To All

Description

Expands an Event to Attributes, Objects, Tags, Galaxies

Transform Settings

Transform Meta Info

To ThreatActors

Transform Meta Info

To Attack Techniques

Transform Meta Info