keyboardcrunch-sentinelone-attack-queries/README.md

ATT&CK Mapped SentinelOne Queries

MITRE ATT&CK mapped queries for SentinelOne Deep Visiblity

This project aims to document SentinelOne Deep Visibility queries for detecting Windows TTPs generated by Red Canary Co's Atomic Red Team framework. These queries have been crafted and tested on Liberty console release and should support Deep Visibility 3.0. Recommending that your Sentinel Agents be on 4.2.x or newer, as some of the indicators data being queried is only collected by newer agents.

Tactics

Privilege Escalation

Defense Evasion

Persistence

Impact

Discovery

Command and Control

Collection

Execution

Exfiltration

Credential Access

Lateral Movement

Initial Access