Introduction to MITRE’s ATT&CK Framework.pdf

Introduction to MITRE’s ATT&CK Framework

1. CySecKWebinar Series
On24-Jun-2020
ByKirtar Oza

2. ▪Introduction and Overview MITRE’s ATT&CK
▪Anatomy of MITRE ATT&CK –Components of ATT&CK
▪For people who want to get started with ATT&CK
▪Will not get in to too much of technical weeds
▪Deliberately kept simple and at high level
▪Can have workshop in-depth for some technical actions
2
Introduction to MITRE ATT&CK Framework

3. ▪MITRE –Non-profit Organization established in 1958
▪Felt the need to document common tactics,
techniques, and procedures (TTPs) that advanced
persistent threats use against Windows enterprise
▪Started in 2013 as a part of FMX Project
▪Investigate use of endpoint telemetry data and
analytics to improve post-compromise detection of
adversaries operating
3
Introduction to MITRE ATT&CK Framework

4. ▪What is ATTA&CK ?
▪Why ATT&CK was needed? Why ATT&CK received the
wide acceptance?
▪Anatomy of ATT&CK
▪Demo: A Sample Technique and its detection
▪ATT&CK Navigator
▪ATT&CK Navigator in Cyber Threat Intelligence (CTI)
▪Approach to actionize ATT&CK
4
Introduction to MITRE ATT&CK Framework

5. ▪Repository of the Attackers’ Behaviour
▪MITRE ATT&CK™ is a globally-accessible knowledge base of
adversary tacticsand techniquesbased on real-world
observations.
•Common Language
•Community Driven
•Pre-ATT&CK
•Enterprise ATT&CK
•Mobile
•ICS(Industrial Control Systems)
Adversarial Tactics,
Techniques, and Common
Knowledge
5
Introduction to MITRE ATT&CK Framework

6. Pyramid of pain
David J Bianco’s Pyramid of Pain
Source: http://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html
6
Introduction to MITRE ATT&CK Framework
Challenges in Pre-ATT&CK Era
–Lack of resources for building detection
capabilities
–Scattered resources (Reports, Red Teams,
SANS, Legacy Usecases)
–Unreliable Cyber Threat Intelligence
–LackofBenchmarkfor measurement
–Lackofguidancefordatacollection

7. Tactics(12) –Technical Goals of the Adversary
Techniques
–
How the Goals are
achieved
7
Introduction to MITRE ATT&CK Framework

8. 268
146
176
0
50
100
150
200
250
300
Windows Linux Mac
ATT&CK Techniques by
Operating System
0
10
20
30
40
50
60
ATT&CK Techniques by Operating System
Windows Linux Mac
11
33
59
28
67
19
22
17
13
22
9
14
0
10
20
30
40
50
60
70
80
Initial AccessExecution PersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral Movement CollectionCommand and ControlExfiltration Impact
ATT&CK Techniques by Tactics
8
Introduction to MITRE ATT&CK Framework

9. 9
Introduction to MITRE ATT&CK Framework

10. 10
Introduction to MITRE ATT&CK Framework

11. 11
Introduction to MITRE ATT&CK Framework

12. 12
Introduction to MITRE ATT&CK Framework

13. 13
Introduction to MITRE ATT&CK Framework

14. 14
Introduction to MITRE ATT&CK Framework

15. 15
Introduction to MITRE ATT&CK Framework

16. ▪Detection and Analytics
▪Cyber Threat Intelligence (CTI)
▪Assessment and Engineering
▪Adversary Emulation & Red Teaming
16
Introduction to MITRE ATT&CK Framework

17. DEMO
17
Introduction to MITRE ATT&CK Framework

18. ▪Introduction & Demo
▪https://mitre-attack.github.io/attack-navigator/enterprise/#
18
Introduction to MITRE ATT&CK Framework

19. ▪India Vs China
▪Gothic Panda
▪Stone Panda
19
Introduction to MITRE ATT&CK Framework

20. ▪Ways to Prioritize the techniques
❑Data Sources -what data sources we have already
❑Threat Intelligence -what our adversaries are
doing ?
❑Tools -what your current tools can cover
❑Red Team -what can you see red teamer doing ?
20
Introduction to MITRE ATT&CK Framework

21. Thank You
21
Introduction to MITRE ATT&CK Framework