CAR Knowledge Base

Cyber Analytics Repository

The official definition of CAR is "The MITRE Cyber Analytics Repository (CAR) is a knowledge base of analytics developed by MITRE based on the MITRE ATT&CK® adversary model. CAR defines a data model that is leveraged in its pseudocode representations but also includes implementations directly targeted at specific tools (e.g., Splunk, EQL) in its analytics. With respect to coverage, CAR is focused on providing a set of validated and well-explained analytics, in particular with regards to their operating theory and rationale."

Instead of further attempting to explain what CAR is, let's dive in. With our newly acquired knowledge from the previous section, we should feel comfortable and understand the information that CAR is providing to us.

Let's begin our journey by reviewing CAR-2020-09-001: Scheduled Task - File Access.

Upon visiting the page, we're given a brief description of the analytic and references to ATT&CK (technique, sub-technique, and tactic).

We're also provided with Pseudocode and a query on how to search for this specific analytic within Splunk. A pseudocode is a plain, human-readable way to describe a set of instructions or algorithms that a program or system will perform.

Note the reference to Sysmon. We have not covered Sysmon as of yet, but you can read more about this tool here.

To take full advantage of CAR, we can view the Full Analytic List or the CAR ATT&CK® Navigator layer to view all the analytics.

Full Analytic List

In the Full Analytic List view, we can see what implementations are available for any given analytic at a single glance, along with what OS platform it applies to.

CAR ATTACK Navigator

(The techniques highlighted in blue are the analytics currently in CAR)

Let's look at another analytic to see a different implementation, CAR-2014-11-004: Remote PowerShell Sessions.

Under Implementations, pseudocode is provided and an EQL version of the pseudocode. EQL (pronounced as 'equal'), and it's an acronym for Event Query Language. EQL can be utilized to query, parse, and organize Sysmon event data. You can read more about this here.

To summarize, CAR is a great place for finding analytics that takes us further than the Mitigation and Detection summaries in the ATT&CK® framework. This tool is not a replacement for ATT&CK® but an added resource.

For the above analytic, what is the pseudocode a representation of?

What tactic has an ID of TA0003?

What is the name of the library that is a collection of Zeek (BRO) scripts?

What is the name of the technique for running executables with the same hash and different names?

Examine CAR-2013-05-004, what additional information is provided to analysts to ensure coverage for this technique?