01MITRE ATT&CK KQL Explorer
Atomare KQL ist Vokabular. Ein Szenario ist die Grammatik.
Ein Szenario verkettet Einzelsignale zu einem verteidigbaren Incident. Jeder Schritt trägt eine ehrliche Reifegrad-Angabe: theorized, static-reviewed, lab-tested oder field-observed.
- Techniken
- 697
- KQL-Queries
- 102
- Techniken mit Detection
- 71
Stand 14. November 2026, mitre.triath.xyz
Weiteres Szenario ClickFix → Potemkin Loader → Hands-on-Keyboard
Trigona Ransomware in 3 Hours
Quelle: The DFIR Report, #19172. Jeder Schritt lief über gültige Admin-Credentials und Bordmittel. Einzeln liest sich jedes Signal wie legitime Administration.
Korrelationsfenster · eine Identität · 3 h
1 Incident · 6 Signale · 2 h 49 min
1 Initial Access T1133 T0 2 Discovery T1135 T0 + Minuten 3 Lateral Movement T1021.001 T0 + ~20 min 4 Defense Evasion T1562.001 T0 + ~20–40 min 5 Exfiltration T1567.002 T0 + ~1–2 h 6 Impact T1486 T0 + 2 h 49 min
External Remote Services
rdp-external-logon · draftDeviceLogonEvents| where LogonType == "RemoteInteractive"| where isnotempty(RemoteIP) and ipv4_is_private(RemoteIP) == false| where AccountName == "Administrator"| project Timestamp, DeviceName, AccountName, RemoteIP, RemoteDeviceNameNetwork Share Discovery
netscan-share-enum · draftSecurityEvent| where EventID == 5145| where RelativeTargetName has "delete.me"| summarize hits=count() by Computer, SubjectUserName, IpAddress, bin(TimeGenerated, 5m)Remote Desktop Protocol
lateral-rdp-pivot · draftDeviceLogonEvents| where LogonType == "RemoteInteractive"| where ipv4_is_private(RemoteIP) == true| summarize targets=dcount(DeviceName), hosts=make_set(DeviceName) by AccountName, RemoteIP, bin(Timestamp, 30m)| where targets > 1Impair Defenses: Disable or Modify Tools
defender-tamper · draftDeviceProcessEvents| where ProcessCommandLine has_any ("Set-MpPreference -DisableRealtimeMonitoring", "DisableAntiSpyware", "MSASCuiL.exe")| project Timestamp, DeviceName, AccountName, ProcessCommandLineExfiltration to Cloud Storage
exfil-rclone-mega · draftDeviceProcessEvents| where FileName =~ "rclone.exe" or ProcessCommandLine has "MEGA:"| project Timestamp, DeviceName, AccountName, ProcessCommandLine// pair with DeviceNetworkEvents to mega.io / mega.co.nz for corroborationData Encrypted for Impact
impact-mass-encryption · draftDeviceFileEvents| where ActionType in ("FileRenamed","FileModified") or FileName =~ "how_to_decrypt.hta"| summarize affected=dcount(FolderPath), note=countif(FileName =~ "how_to_decrypt.hta") by DeviceName, bin(Timestamp, 5m)| where affected > 200 or note > 0