Add MITRE ATT&CK framework queries to query library (#39930)

Browse Source

## Summary

- Adds 152 MITRE ATT&CK framework threat detection queries to the Fleet
query library (`docs/queries.yml`)
- Queries cover Linux (23), macOS (18), and Windows (36) platforms, plus
cross-platform queries
- Mapped to specific ATT&CK techniques (T1025, T1033, T1053, T1078,
T1548, etc.)
- All queries tagged with `MITRE, ATT&CK, threat detection` for easy
filtering on the website

## Details

Queries are sourced from the
[fleet-osquery-attck](https://github.com/MitchF/fleet-osquery-attck)
project and cover:

- **Discovery**: Process, account, system information, network
connections
- **Persistence**: Cron jobs, startup items, launch agents/daemons,
registry run keys
- **Credential Access**: SSH keys, browser credentials, sudoers
- **Execution**: Command interpreters, scheduled tasks, shell history
- **Defense Evasion**: Rootkit detection, process injection, file
integrity
- **Lateral Movement**: SSH connections, remote services

## Test plan

- [x] Verify `docs/queries.yml` parses correctly during website build
(`build-static-content.js`)
- [ ] Verify MITRE queries appear on https://fleetdm.com/queries with
proper platform filtering
- [ ] Verify no slug collisions with existing queries
- [ ] Verify contributor profile resolves for `MitchF` GitHub username

...

This commit is contained in:

Mitch Francese

2026-03-06 12:28:11 -06:00

committed by GitHub

parent c0e5adf32f

commit dc397209f0

1 changed files with 1852 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

docs/queries.yml

+1852

File diff suppressed because it is too large Load Diff