mitre-CAR analytics

car → analytic MTA0011

Query MITRE CAR detection analytics, the adversary behavior catalog with the queries that detect them.

Use it when you need behavior-based detection with the MITRE reference: CAR (Cyber Analytics Repository) catalogs adversary behaviors — each analytic describes the behavior, the associated ATT&CK technique, and the detection queries (in Splunk, EQL, Sigma) that catch it. Analytic MTA0011 (Command Line Arguments) is the classic example: it detects execution with suspicious arguments. In detection engineering, CAR is the starting library: the analytic is adapted to the environment (fields, sources) and deployed. It's the bridge between the ATT&CK framework and operational detections.

Don't use it as a production-ready detection: CAR analytics are reference — the queries assume standard telemetry and must be adapted to the environment (fields, sources, volumes) and validated with real data before deployment. CAR covers common behaviors: new or environment-specific techniques are not in the catalog. And watch out: the analytic describes the behavior, not the tool — implementation depends on your telemetry (Sysmon, EDR, SIEM); without the data source, the CAR query sees nothing. For full coverage, combine CAR with SigmaHQ and vendor rules.