ATT&CKcon 5.0 Lightning Talks - Various Speakers

From ATT&CKcon 5.0

By:
Jon Tran
Hossein Jazi
Manish Kapoor
Wade Baker
Ivan Ninichuck
Reid Gilman

Slides from the ATT&CKcon 5.0 Lightning talks (combined presentation)

1. ATT&CKcon 5.0
Lightning Talks

2. Mapping the Cuckoo’s Egg
By Jon Tran
October 2024

3. SPOILER ALERT

4. 4
Mapping The Cuckoo’s Egg
Link to JSON File with notes: https://chertoffgroup.com/mapping-the-cuckoos-egg/

5. Thank you!

6. Implementing Threat Modeling in
DevSecOps with ATT&CK
Tina Newton-White, Accenture

7. APT Tracking Simplified: A Visual
Guide for Threat Intelligence
Hossein Jazi
Senior Threat Intelligence Specialist

8. 8© Fortinet Inc. All Rights Reserved.8© Fortinet Inc. All Rights Reserved.
Hossein Jazi
@h2jazi
•APT researcher
•Malware reverse engineer
•Threat Hunter
•Cyber crime investigator
THREAT INTELLIGENCE
SPECIALIST
8© Fortinet Inc. All Rights Reserved.

9. 9© Fortinet Inc. All Rights Reserved.9© Fortinet Inc. All Rights Reserved.
APT Tracking

10. 10© Fortinet Inc. All Rights Reserved.10© Fortinet Inc. All Rights Reserved.
Attribution of APTs
•Attribution identifies the individuals, groups, or nation-states behind cyberattacks
based on evidence gathered from tracking APT activities.
•Key Elements of Attribution:
•Technical Indicators:
•Malware & Network Traffic Analysis, Forensic Investigation
•Contextual Factors:
•Geopolitical Insights, Historical Attack Patterns, Victimology
•How APT Tracking Supports Attribution:
•Tracking Tools: Passive DNS, threat intelligence platforms, and IoCs help build detailed
threat actor profiles.
•Beyond Technical: Behavioral analysis, motives, and geopolitical context enhance
accuracy in identifying threat actors.
10© Fortinet Inc. All Rights Reserved.
Connecting the dots

12. Connecting the Dots
Between IOAs and IOCs
Manish Kapoor
Founder & CEO, TruKno
[email protected]

13. Cyber Attacks Involve IOAs + IOCs

14. CRITICAL
HIGH
MEDIUM
LOW
IOAIOAIOCASSETCVE
Threat Hunting via ‘Detection Chain’
Risk

16. Easy. Open. Free.
[email protected]
Request Early Access

17. A Risk Wonk’s Humble Request
to Improve ATT&CK Reporting
ATT&CKcon 5.0 Lightning Talk
Wade Baker, Ph.D.Cyentia Institute / Virginia Tech

18. Risk & Intel: different strokes for different folks
Create a character that embodies how [cyber threat intel
/ information risk quant] experts see themselves.DALL-E:

19. Multi-Source Analysis of Top ATT&CK Techniques
-Meta-study of 20+ sources
-36% of techniques not reported
-85% of sub-techs not reported
-Tactic-Technique ambiguity
-Wide variation among sources
-Limited firmographic slicing
-All frequency-based reporting
X Share of financial losses
X Scope/duration of outages
X Amount of data breached

20. Top techniques observed in ransomware incidents
cyentia.com/iris

21. Lightning Recap
1.Risk analysts need to assess exposure
2.Adversary capabilities inform that assessment
3.Let’s work to optimize reporting of TTPs to
support both intel & risk analysts - and
improve collaboration among them!

22. Enter the Flow
Ivan Ninichuck

23. Reid Gilman, Boston Children’s Hospital