In this chapter, we are going to step things up a bit by hunting over MITRE ATT&CK's APT29 emulation. Then, we are going to learn how to carry out a basic emulation using CALDERA so that we can create a simple Sigma rule for one of our detections, right before we upload it to our ElastAlert instance.
In this chapter, we're going to cover the following topics:
- MITRE evaluations
- Using the MITRE CALDERA project
- Sigma rules
Let's get started!