From 9b036e6363d0b479e478222f6fbcec57cd8ad123 Mon Sep 17 00:00:00 2001 From: keyboardcrunch <40863898+keyboardcrunch@users.noreply.github.com> Date: Tue, 15 Sep 2020 22:42:25 -0500 Subject: [PATCH] Update README.md --- README.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 64f23c3..6d0a25e 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,9 @@ -# SentinelOne-ATTACK-Queries +# ATT&CK Mapped SentinelOne Queries MITRE ATT&CK mapped queries for SentinelOne Deep Visiblity -This project aims to document (mostly Windows) SentinelOne queries for detecting TTPs generated by Red Canary Co's Atomic Red Team framework. +This project aims to document SentinelOne Deep Visibility queries for detecting Windows TTPs generated by Red Canary Co's Atomic Red Team framework. These queries have been crafted and tested on Liberty console release and should support Deep Visibility 3.0. Recommending that your Sentinel Agents be on 4.2.x or newer, as some of the indicators data being queried is only collected by newer agents. + +## Tactics [Privilege Escalation](https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/master/PrivilegeEscalation.md)