Update MITRE documentation

source/user-manual/ruleset/mitre.rst

@@ -10,7 +10,7 @@ Created by the MITRE Corporation, MITRE ATT&CK is an acronym that stands for MIT
 
 The Wazuh integration with MITRE ATT&CK framework is provided through an out-of-the-box module on the Wazuh dashboard. It allows users to map alerts generated by Wazuh to specific tactics and techniques. This gives security teams a better understanding of the nature of the threats they are facing and helps them develop effective mitigation strategies.
 
-The Wazuh MITRE ATT&CK module is accessible under the **THREAT DETECTION AND RESPONSE** section of the main page of the Wazuh dashboard. It is shipped with various functionalities to help enhance your threat detection. 
+The Wazuh MITRE ATT&CK module is accessible under the **THREAT INTELLIGENCE** section of the main page of the Wazuh dashboard. It is shipped with various functionalities to help enhance your threat detection. 
 
 .. thumbnail:: /images/manual/mitre/mitre-att&ck-module.png
   :title: The Wazuh MITRE ATT&CK module
@@ -127,7 +127,8 @@ Windows 11
 Perform the following steps to configure the Wazuh agent to capture Sysmon logs and send them to the Wazuh server for analysis.
 
 #. Download `Sysmon <https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon>`__ and the configuration file `sysmonconfig.xml <https://wazuh.com/resources/blog/emulation-of-attack-techniques-and-detection-with-wazuh/sysmonconfig.xml>`__.
-#. Launch PowerShell with administrative privilege, and install Sysmon as follows:
+#. Extract the contents of the ``Sysmon.zip`` file to a folder, and copy the ``sysmonconfig.xml`` configuration file to the same folder.
+#. Launch PowerShell with administrative privilege, navigate to the folder used in the step above, and install Sysmon as follows:
 
    .. code-block:: powershell
 
@@ -156,7 +157,7 @@ We download the `PsTools archive from the Microsoft Sysinternals <https://docs.m
 
    .. code-block:: powershell
 
-      >./psexec -i -s powershell /accepteula
+      > .\psexec -i -s powershell /accepteula
 
 Run the command below to confirm that the new instance of PowerShell is running as SYSTEM:
 
@@ -175,7 +176,7 @@ Output is shown below:
 Visualize the alerts
 ^^^^^^^^^^^^^^^^^^^^
 
-We use filters on the **Security Module > MITRE ATT&CK> Events** tab of the Wazuh dashboard to query for specific MITRE IDs, tactics, or techniques, as shown in the figure below.
+We use filters on the **MITRE ATT&CK> Events** tab of the Wazuh dashboard to query for specific MITRE IDs, tactics, or techniques, as shown in the figure below.
 
 .. thumbnail:: /images/manual/mitre/visualize-the-alerts.png
   :title: Visualize the alerts
@@ -203,75 +204,75 @@ Click on the **JSON** tab to view the details of the alert in JSON format:
 
    {
      "agent": {
-       "ip": "172.20.10.3",
-       "name": "Windows11",
-       "id": "002"
-     },
-     "manager": {
-       "name": "wazuh-server"
-     },
-     "data": {
-       "win": {
-         "eventdata": {
-           "image": "C:\\\\Windows\\\\system32\\\\services.exe",
-           "targetObject": "HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\PSEXESVC\\\\ObjectName",
-           "processGuid": "{45cd4aff-93d1-6501-0b00-000000000b00}",
-           "processId": "720",
-           "utcTime": "2023-10-16 12:12:15.759",
-           "ruleName": "technique_id=T1543,technique_name=Service Creation",
-           "details": "LocalSystem",
-           "eventType": "SetValue",
-           "user": "NT AUTHORITY\\\\SYSTEM"
-         },
-         "system": {
-           "eventID": "13",
-           "keywords": "0x8000000000000000",
-           "providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
-           "level": "4",
-           "channel": "Microsoft-Windows-Sysmon/Operational",
-           "opcode": "0",
-           "message": "\"Registry value set:\r\nRuleName: technique_id=T1543,technique_name=Service Creation\r\nEventType: SetValue\r\nUtcTime: 2023-10-16 12:12:15.759\r\nProcessGuid: {45cd4aff-93d1-6501-0b00-000000000b00}\r\nProcessId: 720\r\nImage: C:\\Windows\\system32\\services.exe\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\PSEXESVC\\ObjectName\r\nDetails: LocalSystem\r\nUser: NT AUTHORITY\\SYSTEM\"",
-           "version": "2",
-           "systemTime": "2023-10-16T12:12:15.7636688Z",
-           "eventRecordID": "118081",
-           "threadID": "3644",
-           "computer": "Windows11",
-           "task": "13",
-           "processID": "3140",
-           "severityValue": "INFORMATION",
-           "providerName": "Microsoft-Windows-Sysmon"
-         }
-       }
-     },
-     "rule": {
-       "firedtimes": 4,
-       "mail": false,
-       "level": 10,
-       "description": "PsExec service running as NT AUTHORITY\\\\SYSTEM has been created on Windows11",
-       "groups": [
-         "windows",
-         "sysmon"
-       ],
-       "mitre": {
-         "technique": [
-           "Windows Service"
-         ],
-         "id": [
-           "T1543.003"
-         ],
-         "tactic": [
-           "Persistence",
-           "Privilege Escalation"
-         ]
-       },
-       "id": "110011"
-     },
-     "location": "EventChannel",
-     "decoder": {
-       "name": "windows_eventchannel"
-     },
-     "id": "1694607138.3688437",
-     "timestamp": "2023-10-16T12:12:18.684+0000"
+      "ip": "10.0.2.15",
+      "name": "Windows_11",
+      "id": "001"
+    },
+    "manager": {
+      "name": "wazuh-server"
+    },
+    "data": {
+      "win": {
+        "eventdata": {
+          "image": "C:\\\\Windows\\\\system32\\\\services.exe",
+          "targetObject": "HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\PSEXESVC\\\\Start",
+          "processGuid": "{08d76baf-2978-65a7-0b00-000000001300}",
+          "processId": "708",
+          "utcTime": "2024-01-16 15:54:26.456",
+          "details": "DWORD (0x00000004)",
+          "eventType": "SetValue",
+          "user": "NT AUTHORITY\\\\SYSTEM"
+        },
+        "system": {
+          "eventID": "13",
+          "keywords": "0x8000000000000000",
+          "providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
+          "level": "4",
+          "channel": "Microsoft-Windows-Sysmon/Operational",
+          "opcode": "0",
+          "message": "\"Registry value set:\r\nRuleName: -\r\nEventType: SetValue\r\nUtcTime: 2024-01-16 15:54:26.456\r\nProcessGuid: {08d76baf-2978-65a7-0b00-000000001300}\r\nProcessId: 708\r\nImage: C:\\Windows\\system32\\services.exe\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\PSEXESVC\\Start\r\nDetails: DWORD (0x00000004)\r\nUser: NT AUTHORITY\\SYSTEM\"",
+          "version": "2",
+          "systemTime": "2024-01-16T15:54:26.4581578Z",
+          "eventRecordID": "14864",
+          "threadID": "1812",
+          "computer": "Windows-11",
+          "task": "13",
+          "processID": "5908",
+          "severityValue": "INFORMATION",
+          "providerName": "Microsoft-Windows-Sysmon"
+        }
+      }
+    },
+    "rule": {
+      "firedtimes": 18,
+      "mail": false,
+      "level": 10,
+      "description": "PsExec service running as NT AUTHORITY\\\\SYSTEM has been created on Windows-11",
+      "groups": [
+        "windows",
+        "sysmon",
+        "privilege-escalation"
+      ],
+      "mitre": {
+        "technique": [
+          "Windows Service"
+        ],
+        "id": [
+          "T1543.003"
+        ],
+        "tactic": [
+          "Persistence",
+          "Privilege Escalation"
+        ]
+      },
+      "id": "110011"
+    },
+    "location": "EventChannel",
+    "decoder": {
+      "name": "windows_eventchannel"
+    },
+    "id": "1705420467.38720948",
+    "timestamp": "2024-01-16T15:54:27.447+0000"
    }
 
 The alerts display the MITRE ATT&CK ID and its associated tactics and techniques. This helps users quickly understand the nature of the attack and take appropriate actions.