BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo

K
Katie Nickels
••
©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15. ATT&CKing the Status Quo: Improving Threat Intelligence and Cyber Defense with MITRE ATT&CK™ Katie Nickels John Wunder August 7, 2018 | 1 |
The Plan for Today ▪ Define the challenges we’re facing ▪ Explain what ATT&CK is ▪ Show how to use it for: – Threat intelligence – Detection and analytics ▪ Tell you what’s next for ATT&CK ▪ Chat as a community | 2 | ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Tough Questions for Defenders ▪ How effective are my defenses? ▪ Do I have a chance at detecting APT28? ▪ Is the data I’m collecting useful? ▪ Do I have overlapping tool coverage? ▪ Will this *shiny new* product from vendor XYZ help my organization’s defenses? | 3 | ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
The Difficult Task of Detecting TTPs Source: David Bianco, https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html David Bianco’s Pyramid of Pain | 4 | ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
| 5 | What is ? A knowledge base of adversary behavior ➢ Based on real-world observations ➢ Free, open, and globally accessible ➢ A common language ➢ Community-driven ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Zooming in on the Adversary Lifecycle | 6 | Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Exfiltration Command and Control Recon Weaponize Deliver Exploit Control Execute Maintain Priority Definition • Planning, Direction Target Selection Information Gathering • Technical, People, Organizational Weakness Identification • Technical, People, Organizational Adversary OpSec Establish & Maintain Infrastructure Persona Development Build Capabilities Test Capabilities Stage Capabilities Enterprise ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Spanning Multiple Technology Domains | 7 | Enterprise: Windows, Linux, macOS Mobile: Android, iOS ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Hardware Additions Scheduled Task Binary Padding Credentials in Registry Browser Bookmark Discovery Exploitation of Remote Services Data from Information Repositories Exfiltration Over Physical Medium Remote Access Tools Trusted Relationship LSASS Driver Extra Window Memory Injection Exploitation for Credential Access Port Knocking Supply Chain Compromise Local Job Scheduling Access Token Manipulation Network Share Discovery Distributed Component Object Model Video Capture Exfiltration Over Command and Control Channel Multi-hop Proxy Trap Bypass User Account Control Forced Authentication Audio Capture Domain Fronting Spearphishing Attachment Launchctl Process Injection Hooking Peripheral Device Discovery Remote File Copy Automated Collection Data Encoding Signed Binary Proxy Execution Image File Execution Options Injection Password Filter DLL Pass the Ticket Clipboard Data Data Encrypted Remote File Copy Exploit Public-Facing Application Plist Modification LLMNR/NBT-NS Poisoning File and Directory Discovery Replication Through Removable Media Email Collection Automated Exfiltration Multi-Stage Channels User Execution Valid Accounts Screen Capture Exfiltration Over Other Network Medium Web Service Replication Through Removable Media Exploitation for Client Execution DLL Search Order Hijacking Private Keys Permission Groups Discovery Windows Admin Shares Data Staged Standard Non-Application Layer Protocol AppCert DLLs Signed Script Proxy Execution Keychain Pass the Hash Input Capture Exfiltration Over Alternative Protocol Spearphishing via Service CMSTP Hooking Input Prompt Process Discovery Third-party Software Data from Network Shared DriveDynamic Data Exchange Startup Items DCShadow Bash History System Network Connections Discovery Shared Webroot Data Transfer Size Limits Connection Proxy Spearphishing Link Mshta Launch Daemon Port Knocking Two-Factor Authentication Interception Logon Scripts Data from Local System Multilayer Encryption Drive-by Compromise AppleScript Dylib Hijacking Indirect Command Execution System Owner/User Discovery Windows Remote Management Man in the Browser Data Compressed Standard Application Layer ProtocolValid Accounts Source Application Shimming Data from Removable Media Scheduled Transfer Space after Filename AppInit DLLs BITS Jobs Replication Through Removable Media System Network Configuration Discovery Application Deployment Software Commonly Used Port Execution through Module Load Web Shell Control Panel Items Standard Cryptographic Protocol Service Registry Permissions Weakness CMSTP Input Capture Application Window Discovery SSH Hijacking AppleScript Custom Cryptographic Protocol Regsvcs/Regasm New Service Process Doppelgänging Network Sniffing InstallUtil File System Permissions Weakness Mshta Credential Dumping Password Policy Discovery Taint Shared Content Regsvr32 Path Interception Hidden Files and Directories Kerberoasting Remote Desktop Protocol Data Obfuscation Execution through API Accessibility Features Securityd Memory System Time Discovery Custom Command and Control ProtocolPowerShell Port Monitors Space after Filename Brute Force Account Discovery Remote Services Rundll32 Kernel Modules and Extensions Sudo Caching LC_MAIN Hijacking Account Manipulation System Information Discovery Communication Through Removable Media Third-party Software SID-History Injection HISTCONTROL Credentials in Files Scripting Port Knocking Sudo Hidden Users Security Software DiscoveryGraphical User Interface SIP and Trust Provider Hijacking Setuid and Setgid Clear Command History Multiband Communication Command-Line Interface Exploitation for Privilege Escalation Gatekeeper Bypass Network Service ScanningScreensaver Hidden Window Fallback Channels Service Execution Browser Extensions Deobfuscate/Decode Files or Information Remote System Discovery Uncommonly Used Port Windows Remote Management Re-opened Applications Rc.common Trusted Developer Query Registry | 8 | Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Exfiltration Command & Control What is ATT&CK, really? Tactics: the adversary’s technical goals Techniques:howthegoalsare achieved Procedures – Specific technique implementation ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Example Technique: New Service | 9 | Description: When operating systems boot up, they can start programs or applications called services that perform background system functions. […] Adversaries may install a new service which will be executed at startup by directly modifying the registry or by using tools. 1 Platform: Windows Permissions required: Administrator, SYSTEM Effective permissions: SYSTEM Detection: • Monitor service creation through changes in the Registry and common utilities using command-line invocation • … Mitigation: • Limit privileges of user accounts and remediate Privilege Escalation vectors • … Data sources: Windows registry, process monitoring, command-line parameters Examples: Carbanak, Lazarus Group, TinyZBot, Duqu, CozyCar, CosmicDuke, hcdLoader, … References: 1. Microsoft. (n.d.). Services. Retrieved June 7, 2016. ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Example Group: APT28 | 10 | Description: APT28 is a threat group that has been attributed to the Russian government.1 2 3 4 This group reportedly compromised the Democratic National Committee in April 2016.5 Aliases: Sednit, Sofacy, Pawn Storm, Fancy Bear, STRONTIUM, Tsar Team, Threat Group- 4127, TG-4127 1 2 3 4 5 6 7 Techniques: • Data Obfuscation 1 • Connection Proxy 1 8 • Standard Application Layer Protocol 1 • Remote File Copy 8 9 • Rundll32 8 9 • Indicator Removal on Host 5 • Timestomp5 • Credential Dumping 10 • Screen Capture 10 11 • Bootkit 7 and more… Software: CHOPSTICK, JHUHUGIT, ADVSTORESHELL, XTunnel, Mimikatz, HIDEDRV, USBStealer, CORESHELL, OLDBAIT, XAgentOSX, Komplex, Responder, Forfiles, Winexe, certutil 1 3 6 References: 1. FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015. … ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Example Software: CHOPSTICK | 11 | Description: CHOPSTICK is malware family of modular backdoors used by APT28. It has been used from at least November 2012 to August 2016 and is usually dropped on victims as second-stage malware, though it has been used as first-stage malware in several cases. 1 2 3 Aliases: CHOPSTICK, SPLM, Xagent, X-Agent, webhp Techniques: Input Capture - CHOPSTICK is capable of performing keylogging. 5 2 Command-Line Interface - CHOPSTICK is capable of performing remote command execution.5 Fallback Channels - CHOPSTICK can switch to a new C2 channel if the current one is broken. 2 Connection Proxy - CHOPSTICK used a proxy server between victims and the C2 server. 2 and more… Groups: APT28 References: 1. FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015. … ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
How can I actually *use* it? | 12 | Threat Intelligence processes = search Process:Create reg = filter processes where (exe == "reg.exe" and parent_exe == "cmd.exe") cmd = filter processes where (exe == "cmd.exe" and parent_exe != "explorer.exe"") reg_and_cmd = join (reg, cmd) where (reg.ppid == cmd.pid and reg.hostname == cmd.hostname) output reg_and_cmd Detection Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Execution Collection Exfiltration Command and Control Accessibility Features Accessibility Features Binary Padding Brute Force Account Discovery Application Deployment Software Command-Line Automated Collection Automated Exfiltration Commonly Used Port AppInit DLLs AppInit DLLs Bypass User Account Control Credential Dumping Application Window Discovery Exploitation of Vulnerability Execution through API Clipboard Data Data Compressed Communication Through Removable Media Basic Input/Output System Bypass User Account Control Code Signing Credential Manipulation File and Directory Discovery Logon Scripts Graphical User Interface Data Staged Data Encrypted Custom Command and Control Protocol Bootkit DLL Injection Component Firmware Credentials in Files Local Network Configuration Discovery Pass the Hash PowerShell Data from Local System Data Transfer Size Limits Custom Cryptographic Protocol Change Default File Handlers DLL Search Order Hijacking DLL Injection Exploitation of Vulnerability Local Network Connections Discovery Pass the Ticket Process Hollowing Data from Network Shared Drive Exfiltration Over Alternative Protocol Data Obfuscation Component Firmware Exploitation of Vulnerability DLL Search Order Hijacking Input Capture Network Service Scanning Remote Desktop Protocol Rundll32 Data from Removable Media Exfiltration Over Command and Control Channel Fallback Channels DLL Search Order Hijacking Legitimate Credentials DLL Side-Loading Network Sniffing Peripheral Device Discovery Remote File Copy Scheduled Task Email Collection Exfiltration Over Other Network Medium Multi-Stage Channels Hypervisor Local Port Monitor Disabling Security Tools Two-Factor Authentication Interception Permission Groups Discovery Remote Services Service Execution Input Capture Exfiltration Over Physical Medium Multiband Communication Legitimate Credentials New Service Exploitation of Vulnerability Process Discovery Replication Through Removable Media Third-party Software Screen Capture Scheduled Transfer Multilayer Encryption Local Port Monitor Path Interception File Deletion Query Registry Shared Webroot Windows Management Instrumentation Peer Connections Logon Scripts Scheduled Task File System Logical Offsets Remote System Discovery Taint Shared Content Windows Remote Management Remote File Copy Modify Existing Service Service File Permissions Weakness Indicator Blocking on Host Security Software Discovery Windows Admin Shares Standard Application Layer Protocol New Service Service Registry Permissions Weakness Indicator Removal from Tools System Information Discovery Windows Remote Management Standard Cryptographic Protocol Path Interception Web Shell Indicator Removal on Host System Owner/User Discovery Standard Non-Application Layer Protocol Redundant Access Legitimate Credentials System Service Discovery Uncommonly Used Port Registry Run Keys / Start Adversary Emulation Assessment and Engineering ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
All the ATT&CK Things! | 13 | Public ATT&CK Knowledge Base attack.mitre.org ATT&CK Navigator Structured Content github.com/mitre/cti cti-taxii.mitre.org Adversary Emulation Plans mitre.github.io/attack-navigator attack.mitre.org/wiki/Adversary_Emulation_Plans Cyber Analytic Repository car.mitre.org ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
ATT&CK for Threat Intelligence | 14 | ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
The Status Quo in Threat Intelligence | 15 | Reliance on indicators So. Many. Reports! Tough to apply intel to defense ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
So what can we do? Structure threat intelligence using ATT&CK! Here’s how… | 16 | ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
“Extracting” ATT&CK techniques from a threat report | 17 | https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html T1068 - Exploitation for Privilege Escalation T1059 - Command-Line Interface T1033 - System Owner/User Discovery T1053 - Scheduled Task T1065 - Uncommonly Used Port T1095 - Standard Non-Application Layer Protocol T1104 - Multi-Stage Channels ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery ateral Movement Collection Exfiltration Command And Control APT28 techniques* | 18 | *from open source reporting we’ve mapped Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Exfiltration Command and Control ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery ateral Movement Collection Exfiltration Command And Control APT29 techniques | 19 | Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Exfiltration Command and Control ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery ateral Movement Collection Exfiltration Command And Control Comparing APT28 and APT29 | 20 | Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Exfiltration Command and Control Overlay known gaps APT28 APT29 Both groups ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Example from industry – Unit 42 Adversary Playbook https://pan-unit42.github.io/playbook_viewer/ ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Implementation Tips ▪ Tailor your existing threat intel repository – Threat Intelligence Platforms are starting to support ATT&CK (MISP, ThreatQ, others) ▪ Have the threat intel originator do it ▪ Start at the tactic level ▪ Use existing website examples ▪ Work as a team ▪ Remember it’s still human analysis ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
So what does this get us? ▪ Plus!  Gives us a common language to communicate  Allows us to compare groups Status Quo ATT&CKing threat intel So. Many. Reports! Structures threat intel so it’s easier to consume a lot of it Tough to apply intel to defenses Provides a way to directly compare intel to defenses Reliance on indicators Moves to TTPs and behaviors ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Detection and Analytics ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Analytics vs. Indicators AnalyticsIndicators Known malicious behavior Fewer false positives More atomic Higher quantity Suspicious behavior More false positives Broader Lower quantity ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
How do analytics work? ▪ Analytics look for observable events and artifacts that indicate adversary behavior – E.g., if an adversary uses RDP, Windows Event Logs will show a Login with type=RemoteInteractive ▪ The trick: distinguishing the good from the bad Almost everything in ATT&CK Our goal: place event in one circle Evidence Good Bad Good Bad ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Example: Detecting UAC Bypass index=__your sysmon stuff__ IntegrityLevel=High | search ( ParentImage=c:windowssystem32fodhelper.exe OR CommandLine="*.exe”*cleanmgr.exe /autoclean*" OR ... | eval PossibleTechniques=case( like(lower(ParentImage),"c:windowssystem32fodhelper.exe"), "UACME #33", like(lower(CommandLine),"%.exe"%cleanmgr.exe /autoclean%"), "UACME #34", ... ) FOR ILLUSTRATIVE PURPOSES ONLY - INCOMPLETE ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Developing an Analytic ▪ Read the ATT&CK page and understand the attack – ’ – Think from an adversary perspective – Try to mentally separate legitimate usage from malicious usage ▪ Try it – Carry out the attacks via your own testing or pre-written scripts – What does it look like in the logs? ▪ Write and iterate – Write your first search, narrow down false positives, and iterate – Keep testing – make sure you check for a variety of ways it can be used, not just the easiest ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Measuring Defense: what can you cover? Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Execution Collection Exfiltration Command and Control DLL Search Order Hijacking Brute Force Account Discovery Windows Remote Management Automated Collection Automated Exfiltration Commonly Used Port Legitimate Credentials Credential Dumping Application Window Discovery Third-party Software Clipboard Data Data Compressed Communication Through Removable MediaAccessibility Features Binary Padding Application Deployment Software Command-Line Data Staged Data Encrypted AppInit DLLs Code Signing Credential Manipulation File and Directory Discovery Execution through API Data from Local System Data Transfer Size Limits Custom Command and Control ProtocolLocal Port Monitor Component Firmware Exploitation of Vulnerability Graphical User Interface Data from Network Shared Drive Exfiltration Over Alternative ProtocolNew Service DLL Side-Loading Credentials in Files Local Network Configuration Discovery InstallUtil Custom Cryptographic ProtocolPath Interception Disabling Security Tools Input Capture Logon Scripts PowerShell Data from Removable Media Exfiltration Over Command and Control Channel Scheduled Task File Deletion Network Sniffing Local Network Connections Discovery Pass the Hash Process Hollowing Data Obfuscation File System Permissions Weakness File System Logical Offsets Two-Factor Authentication Interception Pass the Ticket Regsvcs/Regasm Email Collection Fallback Channels Service Registry Permissions Weakness Network Service Scanning Remote Desktop Protocol Regsvr32 Input Capture Exfiltration Over Other Network Medium Multi-Stage Channels Web Shell Indicator Blocking Peripheral Device Discovery Remote File Copy Rundll32 Screen Capture Multiband Communication Basic Input/Output System Exploitation of Vulnerability Remote Services Scheduled Task Audio Capture Exfiltration Over Physical MediumBypass User Account Control Permission Groups Discovery Replication Through Removable Media Scripting Video Capture Multilayer Encryption Bootkit DLL Injection Service Execution Scheduled Transfer Peer Connections Change Default File Association Component Object Model Hijacking Process Discovery Shared Webroot Windows Management Instrumentation Remote File Copy Indicator Removal from Tools Query Registry Taint Shared Content Standard Application Layer ProtocolComponent Firmware Remote System Discovery Windows Admin Shares MSBuild Hypervisor Indicator Removal on Host Security Software Discovery Execution through Module Load Standard Cryptographic Protocol Logon Scripts Modify Existing Service InstallUtil System Information Discovery Standard Non-Application Layer ProtocolRedundant Access Masquerading Registry Run Keys / Start Folder Modify Registry System Owner/User Discovery Uncommonly Used Port NTFS Extended Attributes Web Service Security Support Provider Obfuscated Files or Information System Service Discovery Data Encoding Shortcut Modification System Time Discovery Windows Management Instrumentation Event Subscription Process Hollowing Redundant Access Regsvcs/Regasm Winlogon Helper DLL Regsvr32 Netsh Helper DLL Rootkit Authentication Package Rundll32 External Remote Services Scripting Software Packing Timestomp MSBuild Network Share Removal Install Root Certificate ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Prioritizing techniques Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Execution Collection Exfiltration Command and Control DLL Search Order Hijacking Brute Force Account Discovery Windows Remote Management Automated Collection Automated Exfiltration Commonly Used Port Legitimate Credentials Credential Dumping Application Window Discovery Third-party Software Clipboard Data Data Compressed Communication Through Removable MediaAccessibility Features Binary Padding Application Deployment Software Command-Line Data Staged Data Encrypted AppInit DLLs Code Signing Credential Manipulation File and Directory Discovery Execution through API Data from Local System Data Transfer Size Limits Custom Command and Control ProtocolLocal Port Monitor Component Firmware Exploitation of Vulnerability Graphical User Interface Data from Network Shared Drive Exfiltration Over Alternative ProtocolNew Service DLL Side-Loading Credentials in Files Local Network Configuration Discovery InstallUtil Custom Cryptographic ProtocolPath Interception Disabling Security Tools Input Capture Logon Scripts PowerShell Data from Removable Media Exfiltration Over Command and Control Channel Scheduled Task File Deletion Network Sniffing Local Network Connections Discovery Pass the Hash Process Hollowing Data Obfuscation File System Permissions Weakness File System Logical Offsets Two-Factor Authentication Interception Pass the Ticket Regsvcs/Regasm Email Collection Fallback Channels Service Registry Permissions Weakness Network Service Scanning Remote Desktop Protocol Regsvr32 Input Capture Exfiltration Over Other Network Medium Multi-Stage Channels Web Shell Indicator Blocking Peripheral Device Discovery Remote File Copy Rundll32 Screen Capture Multiband Communication Basic Input/Output System Exploitation of Vulnerability Remote Services Scheduled Task Audio Capture Exfiltration Over Physical MediumBypass User Account Control Permission Groups Discovery Replication Through Removable Media Scripting Video Capture Multilayer Encryption Bootkit DLL Injection Service Execution Scheduled Transfer Peer Connections Change Default File Association Component Object Model Hijacking Process Discovery Shared Webroot Windows Management Instrumentation Remote File Copy Indicator Removal from Tools Query Registry Taint Shared Content Standard Application Layer ProtocolComponent Firmware Remote System Discovery Windows Admin Shares MSBuild Hypervisor Indicator Removal on Host Security Software Discovery Execution through Module Load Standard Cryptographic Protocol Logon Scripts Modify Existing Service InstallUtil System Information Discovery Standard Non-Application Layer ProtocolRedundant Access Masquerading Registry Run Keys / Start Folder Modify Registry System Owner/User Discovery Uncommonly Used Port NTFS Extended Attributes Web Service Security Support Provider Obfuscated Files or Information System Service Discovery Data Encoding Shortcut Modification System Time Discovery Windows Management Instrumentation Event Subscription Process Hollowing Redundant Access Regsvcs/Regasm Winlogon Helper DLL Regsvr32 Netsh Helper DLL Rootkit Authentication Package Rundll32 External Remote Services Scripting Software Packing Timestomp MSBuild Network Share Removal Install Root Certificate Legend Moderate Confidence of Detection High Confidence of Detection Low Confidence of Detection IOC Coverage Prioritized Adversary Techniques Define your threat model Assess your coverage Identify gaps Fill gaps ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Working together Filling the gaps is hard, time-consuming, and expensive. • There are a lot of prevalent techniques • Adversary practices are always evolving • Techniques have a wide set of procedures • We all have limited resources • Requires in-depth expertise of system internals But you’re not alone. • Work with your red-team • Work with others in your industry • Talk on Twitter or Slack • Contribute to open source • Read blogs and blog yourself! ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Challenge area: being realistic about coverage ▪ ATT&CK coverage heatmaps are great – Easy to understand – From a defender perspective “ ” straightforward ▪ BUT: Understanding coverage this way is often deceiving and doesn’t align with how attacks are actually detected 1. ATT&CK techniques can be executed and detected in many ways 2. Detecting single ATT&CK techniques is usually not the right level of abstraction ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Challenge area: handling false positives ▪ We think we need to develop comprehensive coverage, but is it realistic with current FP rates and current approaches to detection? – Analytics are noisy, and more coverage means more false positives – Waste of analyst time, alert fatigue, etc. Novel Approaches Detecting event graphs Machine-Learning Tighten the feedback loop Target detections ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Challenge area: getting and searching data ▪ Analytics require increasing amounts of data – , “ ” markers become less useful – Data often needs to come from endpoint + network + infrastructure Collection ▪ Can collection be targeted? ▪ Can collection be agile? ▪ Can collection be decentralized? Search ▪ How can graph-based search scale? ▪ How can you make effective use of your resources? ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Getting started on your own ▪ Take a look at Detection Lab – https://github.com/clong/DetectionLab – https://medium.com/@clong/introducing-detection-lab-61db34bed6ae ▪ Be bad! – Atomic Red Team has a lot of commands to try: https://atomicredteam.io/ ▪ See what bad looks like, write some detections. – https://github.com/Cyb3rWard0g/ThreatHunter-Playbook is a good place for inspiration ▪ Share! ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Bringing it all together… ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
Threat-informed defense, but for real Structured Threat Intel An ever-improving & validated defenseIntel-Driven Adversary Emulation ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
What’s next for ATT&CK? | 38 | Create a new website and infrastructure that makes ATT&CK easier to use Continue to expand the ATT&CK community Open up the development and governance of ATT&CK Improve and add to ATT&CK content: • Sub-techniques • Impacts • New technology domains ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
et’s Chat! ▪ Any questions for us? ▪ How have you tackled the challenges we discussed? ▪ If this is new to you… – How do you think you could use ATT&CK? – What could we do to help you start? ▪ If you’re already familiar with ATT&CK… – How are you using it? – What could we do to help you do that better? ▪ What is missing from ATT&CK? | 39 | ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
| 40 | @likethecoins attack.mitre.org attack@mitre.org @MITREattack Katie Nickels John Wunder @jwunder ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
1 of 40

BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo

••
Download to read offline
Technology

Katie and John from the MITRE ATT&CK team present "ATT&CKing the Status Quo: Improving Threat Intelligence and Cyber Defense with MITRE ATT&CK" at BSidesLV 2018.

K
Katie Nickels

Recommended

ATT&CKing Your Adversaries - Operationalizing cyber intelligence in your own ... by
ATT&CKing Your Adversaries - Operationalizing cyber intelligence in your own ...ATT&CKing Your Adversaries - Operationalizing cyber intelligence in your own ...
ATT&CKing Your Adversaries - Operationalizing cyber intelligence in your own ...JamieWilliams130
4.6K views•47 slides
ATT&CKing with Threat Intelligence by
ATT&CKing with Threat IntelligenceATT&CKing with Threat Intelligence
ATT&CKing with Threat IntelligenceChristopher Korban
5.8K views•32 slides
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™ by
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™Katie Nickels
9K views•34 slides
Purple Teaming with ATT&CK - x33fcon 2018 by
Purple Teaming with ATT&CK - x33fcon 2018Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018Christopher Korban
4.1K views•25 slides
Threat-Based Adversary Emulation with MITRE ATT&CK by
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKKatie Nickels
2.9K views•30 slides
MITRE ATT&CKcon 2018: ATT&CK: All the Things, Neelsen Cyrus and David Thompso... by
MITRE ATT&CKcon 2018: ATT&CK: All the Things, Neelsen Cyrus and David Thompso...MITRE ATT&CKcon 2018: ATT&CK: All the Things, Neelsen Cyrus and David Thompso...
MITRE ATT&CKcon 2018: ATT&CK: All the Things, Neelsen Cyrus and David Thompso...MITRE - ATT&CKcon
8.8K views•24 slides

More Related Content

What's hot

Adversary Emulation - Red Team Village - Mayhem 2020 by
Adversary Emulation - Red Team Village - Mayhem 2020Adversary Emulation - Red Team Village - Mayhem 2020
Adversary Emulation - Red Team Village - Mayhem 2020Jorge Orchilles
748 views•27 slides
Knowledge for the masses: Storytelling with ATT&CK by
Knowledge for the masses: Storytelling with ATT&CKKnowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CKMITRE ATT&CK
878 views•29 slides
Introduction to MITRE ATT&CK by
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CKArpan Raval
985 views•31 slides
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans by
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansEvolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansChristopher Korban
1.2K views•16 slides
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe... by
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE - ATT&CKcon
5.2K views•123 slides
Putting MITRE ATT&CK into Action with What You Have, Where You Are by
Putting MITRE ATT&CK into Action with What You Have, Where You ArePutting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You AreKatie Nickels
13.1K views•46 slides

What's hot(20)

Adversary Emulation - Red Team Village - Mayhem 2020 by Jorge Orchilles
Adversary Emulation - Red Team Village - Mayhem 2020Adversary Emulation - Red Team Village - Mayhem 2020
Adversary Emulation - Red Team Village - Mayhem 2020
Jorge Orchilles•748 views
Knowledge for the masses: Storytelling with ATT&CK by MITRE ATT&CK
Knowledge for the masses: Storytelling with ATT&CKKnowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CK
MITRE ATT&CK•878 views
Introduction to MITRE ATT&CK by Arpan Raval
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CK
Arpan Raval•985 views
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans by Christopher Korban
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansEvolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Christopher Korban•1.2K views
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe... by MITRE - ATT&CKcon
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE - ATT&CKcon•5.2K views
Putting MITRE ATT&CK into Action with What You Have, Where You Are by Katie Nickels
Putting MITRE ATT&CK into Action with What You Have, Where You ArePutting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Katie Nickels•13.1K views
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research by MITRE - ATT&CKcon
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and ResearchUsing MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
MITRE - ATT&CKcon•797 views
Transforming Adversary Emulation Into a Data Analysis Question by MITRE - ATT&CKcon
Transforming Adversary Emulation Into a Data Analysis QuestionTransforming Adversary Emulation Into a Data Analysis Question
Transforming Adversary Emulation Into a Data Analysis Question
MITRE - ATT&CKcon•410 views
Purple Team Exercise Framework Workshop #PTEF by Jorge Orchilles
Purple Team Exercise Framework Workshop #PTEFPurple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEF
Jorge Orchilles•2.7K views
MITRE ATT&CK framework by Bhushan Gurav
MITRE ATT&CK frameworkMITRE ATT&CK framework
MITRE ATT&CK framework
Bhushan Gurav•820 views
Adversary Emulation Workshop by prithaaash
Adversary Emulation WorkshopAdversary Emulation Workshop
Adversary Emulation Workshop
prithaaash•272 views
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da... by MITRE - ATT&CKcon
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE - ATT&CKcon•2.6K views
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ... by MITRE - ATT&CKcon
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE - ATT&CKcon•2.8K views
MITRE ATT&CKcon 2.0: Zeek-based ATT&CK Metrics and Gap Analysis; Allan Thomso... by MITRE - ATT&CKcon
MITRE ATT&CKcon 2.0: Zeek-based ATT&CK Metrics and Gap Analysis; Allan Thomso...MITRE ATT&CKcon 2.0: Zeek-based ATT&CK Metrics and Gap Analysis; Allan Thomso...
MITRE ATT&CKcon 2.0: Zeek-based ATT&CK Metrics and Gap Analysis; Allan Thomso...
MITRE - ATT&CKcon•1.7K views
State of the ATT&CK by MITRE ATT&CK
State of the ATT&CKState of the ATT&CK
State of the ATT&CK
MITRE ATT&CK•1.2K views
Purple Team Exercises - GRIMMCon by Jorge Orchilles
Purple Team Exercises - GRIMMConPurple Team Exercises - GRIMMCon
Purple Team Exercises - GRIMMCon
Jorge Orchilles•2.3K views
State of the ATTACK by MITRE - ATT&CKcon
State of the ATTACKState of the ATTACK
State of the ATTACK
MITRE - ATT&CKcon•1.2K views
Threat Modelling - It's not just for developers by MITRE ATT&CK
Threat Modelling - It's not just for developersThreat Modelling - It's not just for developers
Threat Modelling - It's not just for developers
MITRE ATT&CK•3.3K views
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro... by MITRE ATT&CK
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro... Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
MITRE ATT&CK•1.6K views
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio... by Adam Pennington
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
Adam Pennington•3.8K views

Similar to BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo

Slideshare.net rh-isac summit 2019 - adam pennington - leveraging mitre at ta... by
Slideshare.net rh-isac summit 2019 - adam pennington - leveraging mitre at ta...Slideshare.net rh-isac summit 2019 - adam pennington - leveraging mitre at ta...
Slideshare.net rh-isac summit 2019 - adam pennington - leveraging mitre at ta...Robert Brandel
29 views•15 slides
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w... by
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...Adam Pennington
3K views•53 slides
Pennington - Defending Against Targeted Ransomware with MITRE ATT&CK by
Pennington - Defending Against Targeted Ransomware with MITRE ATT&CKPennington - Defending Against Targeted Ransomware with MITRE ATT&CK
Pennington - Defending Against Targeted Ransomware with MITRE ATT&CKAdam Pennington
500 views•32 slides
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio... by
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...Adam Pennington
209 views•54 slides
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK by
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CKSymantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CKSymantec
560 views•45 slides
MITRE-Module 1 Slides.pdf by
MITRE-Module 1 Slides.pdfMITRE-Module 1 Slides.pdf
MITRE-Module 1 Slides.pdfReZa AdineH
30 views•24 slides

Similar to BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo(20)

Slideshare.net rh-isac summit 2019 - adam pennington - leveraging mitre at ta... by Robert Brandel
Slideshare.net rh-isac summit 2019 - adam pennington - leveraging mitre at ta...Slideshare.net rh-isac summit 2019 - adam pennington - leveraging mitre at ta...
Slideshare.net rh-isac summit 2019 - adam pennington - leveraging mitre at ta...
Robert Brandel•29 views
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w... by Adam Pennington
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...
Adam Pennington•3K views
Pennington - Defending Against Targeted Ransomware with MITRE ATT&CK by Adam Pennington
Pennington - Defending Against Targeted Ransomware with MITRE ATT&CKPennington - Defending Against Targeted Ransomware with MITRE ATT&CK
Pennington - Defending Against Targeted Ransomware with MITRE ATT&CK
Adam Pennington•500 views
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio... by Adam Pennington
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
Adam Pennington•209 views
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK by Symantec
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CKSymantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec•560 views
MITRE-Module 1 Slides.pdf by ReZa AdineH
MITRE-Module 1 Slides.pdfMITRE-Module 1 Slides.pdf
MITRE-Module 1 Slides.pdf
ReZa AdineH•30 views
Automation: The Wonderful Wizard of CTI (or is it?) by MITRE ATT&CK
Automation: The Wonderful Wizard of CTI (or is it?) Automation: The Wonderful Wizard of CTI (or is it?)
Automation: The Wonderful Wizard of CTI (or is it?)
MITRE ATT&CK•539 views
Adversary Emulation and Red Team Exercises - EDUCAUSE by Jorge Orchilles
Adversary Emulation and Red Team Exercises - EDUCAUSEAdversary Emulation and Red Team Exercises - EDUCAUSE
Adversary Emulation and Red Team Exercises - EDUCAUSE
Jorge Orchilles•622 views
NETSCOUT Threat Intelligence Report: Findings Summary 1st half of 2018 by NETSCOUT
NETSCOUT Threat Intelligence Report: Findings Summary 1st half of 2018 NETSCOUT Threat Intelligence Report: Findings Summary 1st half of 2018
NETSCOUT Threat Intelligence Report: Findings Summary 1st half of 2018
NETSCOUT•100 views
Update from the MITRE ATT&CK Team by Adam Pennington
Update from the MITRE ATT&CK TeamUpdate from the MITRE ATT&CK Team
Update from the MITRE ATT&CK Team
Adam Pennington•783 views
Trial Course - CertMaster Learn and CertMaster Labs for Security+ (Exam SY0-6... by MohamedOmerMusa
Trial Course - CertMaster Learn and CertMaster Labs for Security+ (Exam SY0-6...Trial Course - CertMaster Learn and CertMaster Labs for Security+ (Exam SY0-6...
Trial Course - CertMaster Learn and CertMaster Labs for Security+ (Exam SY0-6...
MohamedOmerMusa•117 views
Beyond S3 Buckets - Effective Countermeasures for Emerging Cloud Threats by SBWebinars
Beyond S3 Buckets - Effective Countermeasures for Emerging Cloud ThreatsBeyond S3 Buckets - Effective Countermeasures for Emerging Cloud Threats
Beyond S3 Buckets - Effective Countermeasures for Emerging Cloud Threats
SBWebinars•134 views
01_Metasploit - The Elixir of Network Security by Harish Chaudhary
01_Metasploit - The Elixir of Network Security01_Metasploit - The Elixir of Network Security
01_Metasploit - The Elixir of Network Security
Harish Chaudhary•356 views
Catch Me If You Can - Finding APTs in your network by DefCamp
Catch Me If You Can - Finding APTs in your networkCatch Me If You Can - Finding APTs in your network
Catch Me If You Can - Finding APTs in your network
DefCamp•304 views
Adversary Emulation - DerpCon by Jorge Orchilles
Adversary Emulation - DerpConAdversary Emulation - DerpCon
Adversary Emulation - DerpCon
Jorge Orchilles•1.8K views
Jesse Burke RDPwned HackMiami7 by Jesse Burke
Jesse Burke RDPwned HackMiami7Jesse Burke RDPwned HackMiami7
Jesse Burke RDPwned HackMiami7
Jesse Burke•977 views
Exploits Attack on Windows Vulnerabilities by Amit Kumbhar
Exploits Attack on Windows VulnerabilitiesExploits Attack on Windows Vulnerabilities
Exploits Attack on Windows Vulnerabilities
Amit Kumbhar•594 views
How to Hunt for Lateral Movement on Your Network by Sqrrl
How to Hunt for Lateral Movement on Your NetworkHow to Hunt for Lateral Movement on Your Network
How to Hunt for Lateral Movement on Your Network
Sqrrl•2.8K views
MITRE_ATTACK_Enterprise_11x17.pdf by AisyiFree
MITRE_ATTACK_Enterprise_11x17.pdfMITRE_ATTACK_Enterprise_11x17.pdf
MITRE_ATTACK_Enterprise_11x17.pdf
AisyiFree•19 views
Network Security - Real and Present Dangers by Peter Wood
Network Security - Real and Present DangersNetwork Security - Real and Present Dangers
Network Security - Real and Present Dangers
Peter Wood•732 views

Recently uploaded

handbook for web 3 adoption.pdf by
handbook for web 3 adoption.pdfhandbook for web 3 adoption.pdf
handbook for web 3 adoption.pdfLiveplex
19 views•16 slides
20231123_Camunda Meetup Vienna.pdf by
20231123_Camunda Meetup Vienna.pdf20231123_Camunda Meetup Vienna.pdf
20231123_Camunda Meetup Vienna.pdfPhactum Softwareentwicklung GmbH
28 views•73 slides
Info Session November 2023.pdf by
Info Session November 2023.pdfInfo Session November 2023.pdf
Info Session November 2023.pdfAleksandraKoprivica4
10 views•15 slides
Microsoft Power Platform.pptx by
Microsoft Power Platform.pptxMicrosoft Power Platform.pptx
Microsoft Power Platform.pptxUni Systems S.M.S.A.
47 views•38 slides
6g - REPORT.pdf by
6g - REPORT.pdf6g - REPORT.pdf
6g - REPORT.pdfLiveplex
9 views•23 slides

Recently uploaded(20)

handbook for web 3 adoption.pdf by Liveplex
handbook for web 3 adoption.pdfhandbook for web 3 adoption.pdf
handbook for web 3 adoption.pdf
Liveplex•19 views
20231123_Camunda Meetup Vienna.pdf by Phactum Softwareentwicklung GmbH
20231123_Camunda Meetup Vienna.pdf20231123_Camunda Meetup Vienna.pdf
20231123_Camunda Meetup Vienna.pdf
Phactum Softwareentwicklung GmbH•28 views
METHOD AND SYSTEM FOR PREDICTING OPTIMAL LOAD FOR WHICH THE YIELD IS MAXIMUM ... by Prity Khastgir IPR Strategic India Patent Attorney Amplify Innovation
METHOD AND SYSTEM FOR PREDICTING OPTIMAL LOAD FOR WHICH THE YIELD IS MAXIMUM ...METHOD AND SYSTEM FOR PREDICTING OPTIMAL LOAD FOR WHICH THE YIELD IS MAXIMUM ...
METHOD AND SYSTEM FOR PREDICTING OPTIMAL LOAD FOR WHICH THE YIELD IS MAXIMUM ...
Prity Khastgir IPR Strategic India Patent Attorney Amplify Innovation•25 views
Info Session November 2023.pdf by AleksandraKoprivica4
Info Session November 2023.pdfInfo Session November 2023.pdf
Info Session November 2023.pdf
AleksandraKoprivica4•10 views
Microsoft Power Platform.pptx by Uni Systems S.M.S.A.
Microsoft Power Platform.pptxMicrosoft Power Platform.pptx
Microsoft Power Platform.pptx
Uni Systems S.M.S.A.•47 views
6g - REPORT.pdf by Liveplex
6g - REPORT.pdf6g - REPORT.pdf
6g - REPORT.pdf
Liveplex•9 views
Data-centric AI and the convergence of data and model engineering: opportunit... by Paolo Missier
Data-centric AI and the convergence of data and model engineering: opportunit...Data-centric AI and the convergence of data and model engineering: opportunit...
Data-centric AI and the convergence of data and model engineering: opportunit...
Paolo Missier•34 views
From chaos to control: Managing migrations and Microsoft 365 with ShareGate! by sammart93
From chaos to control: Managing migrations and Microsoft 365 with ShareGate!From chaos to control: Managing migrations and Microsoft 365 with ShareGate!
From chaos to control: Managing migrations and Microsoft 365 with ShareGate!
sammart93•9 views
Empathic Computing: Delivering the Potential of the Metaverse by Mark Billinghurst
Empathic Computing: Delivering the Potential of the MetaverseEmpathic Computing: Delivering the Potential of the Metaverse
Empathic Computing: Delivering the Potential of the Metaverse
Mark Billinghurst•470 views
PharoJS - Zürich Smalltalk Group Meetup November 2023 by Noury Bouraqadi
PharoJS - Zürich Smalltalk Group Meetup November 2023PharoJS - Zürich Smalltalk Group Meetup November 2023
PharoJS - Zürich Smalltalk Group Meetup November 2023
Noury Bouraqadi•120 views
HTTP headers that make your website go faster - devs.gent November 2023 by Thijs Feryn
HTTP headers that make your website go faster - devs.gent November 2023HTTP headers that make your website go faster - devs.gent November 2023
HTTP headers that make your website go faster - devs.gent November 2023
Thijs Feryn•19 views
Perth MeetUp November 2023 by Michael Price
Perth MeetUp November 2023 Perth MeetUp November 2023
Perth MeetUp November 2023
Michael Price•15 views
The Research Portal of Catalonia: Growing more (information) & more (services) by CSUC - Consorci de Serveis Universitaris de Catalunya
The Research Portal of Catalonia: Growing more (information) & more (services)The Research Portal of Catalonia: Growing more (information) & more (services)
The Research Portal of Catalonia: Growing more (information) & more (services)
CSUC - Consorci de Serveis Universitaris de Catalunya•73 views
Melek BEN MAHMOUD.pdf by MelekBenMahmoud
Melek BEN MAHMOUD.pdfMelek BEN MAHMOUD.pdf
Melek BEN MAHMOUD.pdf
MelekBenMahmoud•14 views
Report 2030 Digital Decade by Massimo Talia
Report 2030 Digital DecadeReport 2030 Digital Decade
Report 2030 Digital Decade
Massimo Talia•14 views
AMAZON PRODUCT RESEARCH.pdf by JerikkLaureta
AMAZON PRODUCT RESEARCH.pdfAMAZON PRODUCT RESEARCH.pdf
AMAZON PRODUCT RESEARCH.pdf
JerikkLaureta•15 views
Attacking IoT Devices from a Web Perspective - Linux Day by Simone Onofri
Attacking IoT Devices from a Web Perspective - Linux Day Attacking IoT Devices from a Web Perspective - Linux Day
Attacking IoT Devices from a Web Perspective - Linux Day
Simone Onofri•15 views
Special_edition_innovator_2023.pdf by WillDavies22
Special_edition_innovator_2023.pdfSpecial_edition_innovator_2023.pdf
Special_edition_innovator_2023.pdf
WillDavies22•16 views
STPI OctaNE CoE Brochure.pdf by madhurjyapb
STPI OctaNE CoE Brochure.pdfSTPI OctaNE CoE Brochure.pdf
STPI OctaNE CoE Brochure.pdf
madhurjyapb•12 views
Top 10 Strategic Technologies in 2024: AI and Automation by AutomationEdge Technologies
Top 10 Strategic Technologies in 2024: AI and AutomationTop 10 Strategic Technologies in 2024: AI and Automation
Top 10 Strategic Technologies in 2024: AI and Automation
AutomationEdge Technologies•14 views

BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo

  • 1. ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15. ATT&CKing the Status Quo: Improving Threat Intelligence and Cyber Defense with MITRE ATT&CK™ Katie Nickels John Wunder August 7, 2018 | 1 |
  • 2. The Plan for Today ▪ Define the challenges we’re facing ▪ Explain what ATT&CK is ▪ Show how to use it for: – Threat intelligence – Detection and analytics ▪ Tell you what’s next for ATT&CK ▪ Chat as a community | 2 | ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 3. Tough Questions for Defenders ▪ How effective are my defenses? ▪ Do I have a chance at detecting APT28? ▪ Is the data I’m collecting useful? ▪ Do I have overlapping tool coverage? ▪ Will this *shiny new* product from vendor XYZ help my organization’s defenses? | 3 | ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 4. The Difficult Task of Detecting TTPs Source: David Bianco, https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html David Bianco’s Pyramid of Pain | 4 | ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 5. | 5 | What is ? A knowledge base of adversary behavior ➢ Based on real-world observations ➢ Free, open, and globally accessible ➢ A common language ➢ Community-driven ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 6. Zooming in on the Adversary Lifecycle | 6 | Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Exfiltration Command and Control Recon Weaponize Deliver Exploit Control Execute Maintain Priority Definition • Planning, Direction Target Selection Information Gathering • Technical, People, Organizational Weakness Identification • Technical, People, Organizational Adversary OpSec Establish & Maintain Infrastructure Persona Development Build Capabilities Test Capabilities Stage Capabilities Enterprise ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 7. Spanning Multiple Technology Domains | 7 | Enterprise: Windows, Linux, macOS Mobile: Android, iOS ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 8. Hardware Additions Scheduled Task Binary Padding Credentials in Registry Browser Bookmark Discovery Exploitation of Remote Services Data from Information Repositories Exfiltration Over Physical Medium Remote Access Tools Trusted Relationship LSASS Driver Extra Window Memory Injection Exploitation for Credential Access Port Knocking Supply Chain Compromise Local Job Scheduling Access Token Manipulation Network Share Discovery Distributed Component Object Model Video Capture Exfiltration Over Command and Control Channel Multi-hop Proxy Trap Bypass User Account Control Forced Authentication Audio Capture Domain Fronting Spearphishing Attachment Launchctl Process Injection Hooking Peripheral Device Discovery Remote File Copy Automated Collection Data Encoding Signed Binary Proxy Execution Image File Execution Options Injection Password Filter DLL Pass the Ticket Clipboard Data Data Encrypted Remote File Copy Exploit Public-Facing Application Plist Modification LLMNR/NBT-NS Poisoning File and Directory Discovery Replication Through Removable Media Email Collection Automated Exfiltration Multi-Stage Channels User Execution Valid Accounts Screen Capture Exfiltration Over Other Network Medium Web Service Replication Through Removable Media Exploitation for Client Execution DLL Search Order Hijacking Private Keys Permission Groups Discovery Windows Admin Shares Data Staged Standard Non-Application Layer Protocol AppCert DLLs Signed Script Proxy Execution Keychain Pass the Hash Input Capture Exfiltration Over Alternative Protocol Spearphishing via Service CMSTP Hooking Input Prompt Process Discovery Third-party Software Data from Network Shared DriveDynamic Data Exchange Startup Items DCShadow Bash History System Network Connections Discovery Shared Webroot Data Transfer Size Limits Connection Proxy Spearphishing Link Mshta Launch Daemon Port Knocking Two-Factor Authentication Interception Logon Scripts Data from Local System Multilayer Encryption Drive-by Compromise AppleScript Dylib Hijacking Indirect Command Execution System Owner/User Discovery Windows Remote Management Man in the Browser Data Compressed Standard Application Layer ProtocolValid Accounts Source Application Shimming Data from Removable Media Scheduled Transfer Space after Filename AppInit DLLs BITS Jobs Replication Through Removable Media System Network Configuration Discovery Application Deployment Software Commonly Used Port Execution through Module Load Web Shell Control Panel Items Standard Cryptographic Protocol Service Registry Permissions Weakness CMSTP Input Capture Application Window Discovery SSH Hijacking AppleScript Custom Cryptographic Protocol Regsvcs/Regasm New Service Process Doppelgänging Network Sniffing InstallUtil File System Permissions Weakness Mshta Credential Dumping Password Policy Discovery Taint Shared Content Regsvr32 Path Interception Hidden Files and Directories Kerberoasting Remote Desktop Protocol Data Obfuscation Execution through API Accessibility Features Securityd Memory System Time Discovery Custom Command and Control ProtocolPowerShell Port Monitors Space after Filename Brute Force Account Discovery Remote Services Rundll32 Kernel Modules and Extensions Sudo Caching LC_MAIN Hijacking Account Manipulation System Information Discovery Communication Through Removable Media Third-party Software SID-History Injection HISTCONTROL Credentials in Files Scripting Port Knocking Sudo Hidden Users Security Software DiscoveryGraphical User Interface SIP and Trust Provider Hijacking Setuid and Setgid Clear Command History Multiband Communication Command-Line Interface Exploitation for Privilege Escalation Gatekeeper Bypass Network Service ScanningScreensaver Hidden Window Fallback Channels Service Execution Browser Extensions Deobfuscate/Decode Files or Information Remote System Discovery Uncommonly Used Port Windows Remote Management Re-opened Applications Rc.common Trusted Developer Query Registry | 8 | Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Exfiltration Command & Control What is ATT&CK, really? Tactics: the adversary’s technical goals Techniques:howthegoalsare achieved Procedures – Specific technique implementation ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 9. Example Technique: New Service | 9 | Description: When operating systems boot up, they can start programs or applications called services that perform background system functions. […] Adversaries may install a new service which will be executed at startup by directly modifying the registry or by using tools. 1 Platform: Windows Permissions required: Administrator, SYSTEM Effective permissions: SYSTEM Detection: • Monitor service creation through changes in the Registry and common utilities using command-line invocation • … Mitigation: • Limit privileges of user accounts and remediate Privilege Escalation vectors • … Data sources: Windows registry, process monitoring, command-line parameters Examples: Carbanak, Lazarus Group, TinyZBot, Duqu, CozyCar, CosmicDuke, hcdLoader, … References: 1. Microsoft. (n.d.). Services. Retrieved June 7, 2016. ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 10. Example Group: APT28 | 10 | Description: APT28 is a threat group that has been attributed to the Russian government.1 2 3 4 This group reportedly compromised the Democratic National Committee in April 2016.5 Aliases: Sednit, Sofacy, Pawn Storm, Fancy Bear, STRONTIUM, Tsar Team, Threat Group- 4127, TG-4127 1 2 3 4 5 6 7 Techniques: • Data Obfuscation 1 • Connection Proxy 1 8 • Standard Application Layer Protocol 1 • Remote File Copy 8 9 • Rundll32 8 9 • Indicator Removal on Host 5 • Timestomp5 • Credential Dumping 10 • Screen Capture 10 11 • Bootkit 7 and more… Software: CHOPSTICK, JHUHUGIT, ADVSTORESHELL, XTunnel, Mimikatz, HIDEDRV, USBStealer, CORESHELL, OLDBAIT, XAgentOSX, Komplex, Responder, Forfiles, Winexe, certutil 1 3 6 References: 1. FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015. … ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 11. Example Software: CHOPSTICK | 11 | Description: CHOPSTICK is malware family of modular backdoors used by APT28. It has been used from at least November 2012 to August 2016 and is usually dropped on victims as second-stage malware, though it has been used as first-stage malware in several cases. 1 2 3 Aliases: CHOPSTICK, SPLM, Xagent, X-Agent, webhp Techniques: Input Capture - CHOPSTICK is capable of performing keylogging. 5 2 Command-Line Interface - CHOPSTICK is capable of performing remote command execution.5 Fallback Channels - CHOPSTICK can switch to a new C2 channel if the current one is broken. 2 Connection Proxy - CHOPSTICK used a proxy server between victims and the C2 server. 2 and more… Groups: APT28 References: 1. FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015. … ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 12. How can I actually *use* it? | 12 | Threat Intelligence processes = search Process:Create reg = filter processes where (exe == "reg.exe" and parent_exe == "cmd.exe") cmd = filter processes where (exe == "cmd.exe" and parent_exe != "explorer.exe"") reg_and_cmd = join (reg, cmd) where (reg.ppid == cmd.pid and reg.hostname == cmd.hostname) output reg_and_cmd Detection Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Execution Collection Exfiltration Command and Control Accessibility Features Accessibility Features Binary Padding Brute Force Account Discovery Application Deployment Software Command-Line Automated Collection Automated Exfiltration Commonly Used Port AppInit DLLs AppInit DLLs Bypass User Account Control Credential Dumping Application Window Discovery Exploitation of Vulnerability Execution through API Clipboard Data Data Compressed Communication Through Removable Media Basic Input/Output System Bypass User Account Control Code Signing Credential Manipulation File and Directory Discovery Logon Scripts Graphical User Interface Data Staged Data Encrypted Custom Command and Control Protocol Bootkit DLL Injection Component Firmware Credentials in Files Local Network Configuration Discovery Pass the Hash PowerShell Data from Local System Data Transfer Size Limits Custom Cryptographic Protocol Change Default File Handlers DLL Search Order Hijacking DLL Injection Exploitation of Vulnerability Local Network Connections Discovery Pass the Ticket Process Hollowing Data from Network Shared Drive Exfiltration Over Alternative Protocol Data Obfuscation Component Firmware Exploitation of Vulnerability DLL Search Order Hijacking Input Capture Network Service Scanning Remote Desktop Protocol Rundll32 Data from Removable Media Exfiltration Over Command and Control Channel Fallback Channels DLL Search Order Hijacking Legitimate Credentials DLL Side-Loading Network Sniffing Peripheral Device Discovery Remote File Copy Scheduled Task Email Collection Exfiltration Over Other Network Medium Multi-Stage Channels Hypervisor Local Port Monitor Disabling Security Tools Two-Factor Authentication Interception Permission Groups Discovery Remote Services Service Execution Input Capture Exfiltration Over Physical Medium Multiband Communication Legitimate Credentials New Service Exploitation of Vulnerability Process Discovery Replication Through Removable Media Third-party Software Screen Capture Scheduled Transfer Multilayer Encryption Local Port Monitor Path Interception File Deletion Query Registry Shared Webroot Windows Management Instrumentation Peer Connections Logon Scripts Scheduled Task File System Logical Offsets Remote System Discovery Taint Shared Content Windows Remote Management Remote File Copy Modify Existing Service Service File Permissions Weakness Indicator Blocking on Host Security Software Discovery Windows Admin Shares Standard Application Layer Protocol New Service Service Registry Permissions Weakness Indicator Removal from Tools System Information Discovery Windows Remote Management Standard Cryptographic Protocol Path Interception Web Shell Indicator Removal on Host System Owner/User Discovery Standard Non-Application Layer Protocol Redundant Access Legitimate Credentials System Service Discovery Uncommonly Used Port Registry Run Keys / Start Adversary Emulation Assessment and Engineering ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 13. All the ATT&CK Things! | 13 | Public ATT&CK Knowledge Base attack.mitre.org ATT&CK Navigator Structured Content github.com/mitre/cti cti-taxii.mitre.org Adversary Emulation Plans mitre.github.io/attack-navigator attack.mitre.org/wiki/Adversary_Emulation_Plans Cyber Analytic Repository car.mitre.org ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 14. ATT&CK for Threat Intelligence | 14 | ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 15. The Status Quo in Threat Intelligence | 15 | Reliance on indicators So. Many. Reports! Tough to apply intel to defense ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 16. So what can we do? Structure threat intelligence using ATT&CK! Here’s how… | 16 | ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 17. “Extracting” ATT&CK techniques from a threat report | 17 | https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html T1068 - Exploitation for Privilege Escalation T1059 - Command-Line Interface T1033 - System Owner/User Discovery T1053 - Scheduled Task T1065 - Uncommonly Used Port T1095 - Standard Non-Application Layer Protocol T1104 - Multi-Stage Channels ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 18. Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery ateral Movement Collection Exfiltration Command And Control APT28 techniques* | 18 | *from open source reporting we’ve mapped Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Exfiltration Command and Control ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 19. Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery ateral Movement Collection Exfiltration Command And Control APT29 techniques | 19 | Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Exfiltration Command and Control ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 20. Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery ateral Movement Collection Exfiltration Command And Control Comparing APT28 and APT29 | 20 | Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Exfiltration Command and Control Overlay known gaps APT28 APT29 Both groups ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 21. Example from industry – Unit 42 Adversary Playbook https://pan-unit42.github.io/playbook_viewer/ ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 22. Implementation Tips ▪ Tailor your existing threat intel repository – Threat Intelligence Platforms are starting to support ATT&CK (MISP, ThreatQ, others) ▪ Have the threat intel originator do it ▪ Start at the tactic level ▪ Use existing website examples ▪ Work as a team ▪ Remember it’s still human analysis ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 23. So what does this get us? ▪ Plus!  Gives us a common language to communicate  Allows us to compare groups Status Quo ATT&CKing threat intel So. Many. Reports! Structures threat intel so it’s easier to consume a lot of it Tough to apply intel to defenses Provides a way to directly compare intel to defenses Reliance on indicators Moves to TTPs and behaviors ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 24. Detection and Analytics ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 25. Analytics vs. Indicators AnalyticsIndicators Known malicious behavior Fewer false positives More atomic Higher quantity Suspicious behavior More false positives Broader Lower quantity ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 26. How do analytics work? ▪ Analytics look for observable events and artifacts that indicate adversary behavior – E.g., if an adversary uses RDP, Windows Event Logs will show a Login with type=RemoteInteractive ▪ The trick: distinguishing the good from the bad Almost everything in ATT&CK Our goal: place event in one circle Evidence Good Bad Good Bad ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 27. Example: Detecting UAC Bypass index=__your sysmon stuff__ IntegrityLevel=High | search ( ParentImage=c:windowssystem32fodhelper.exe OR CommandLine="*.exe”*cleanmgr.exe /autoclean*" OR ... | eval PossibleTechniques=case( like(lower(ParentImage),"c:windowssystem32fodhelper.exe"), "UACME #33", like(lower(CommandLine),"%.exe"%cleanmgr.exe /autoclean%"), "UACME #34", ... ) FOR ILLUSTRATIVE PURPOSES ONLY - INCOMPLETE ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 28. Developing an Analytic ▪ Read the ATT&CK page and understand the attack – ’ – Think from an adversary perspective – Try to mentally separate legitimate usage from malicious usage ▪ Try it – Carry out the attacks via your own testing or pre-written scripts – What does it look like in the logs? ▪ Write and iterate – Write your first search, narrow down false positives, and iterate – Keep testing – make sure you check for a variety of ways it can be used, not just the easiest ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 29. Measuring Defense: what can you cover? Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Execution Collection Exfiltration Command and Control DLL Search Order Hijacking Brute Force Account Discovery Windows Remote Management Automated Collection Automated Exfiltration Commonly Used Port Legitimate Credentials Credential Dumping Application Window Discovery Third-party Software Clipboard Data Data Compressed Communication Through Removable MediaAccessibility Features Binary Padding Application Deployment Software Command-Line Data Staged Data Encrypted AppInit DLLs Code Signing Credential Manipulation File and Directory Discovery Execution through API Data from Local System Data Transfer Size Limits Custom Command and Control ProtocolLocal Port Monitor Component Firmware Exploitation of Vulnerability Graphical User Interface Data from Network Shared Drive Exfiltration Over Alternative ProtocolNew Service DLL Side-Loading Credentials in Files Local Network Configuration Discovery InstallUtil Custom Cryptographic ProtocolPath Interception Disabling Security Tools Input Capture Logon Scripts PowerShell Data from Removable Media Exfiltration Over Command and Control Channel Scheduled Task File Deletion Network Sniffing Local Network Connections Discovery Pass the Hash Process Hollowing Data Obfuscation File System Permissions Weakness File System Logical Offsets Two-Factor Authentication Interception Pass the Ticket Regsvcs/Regasm Email Collection Fallback Channels Service Registry Permissions Weakness Network Service Scanning Remote Desktop Protocol Regsvr32 Input Capture Exfiltration Over Other Network Medium Multi-Stage Channels Web Shell Indicator Blocking Peripheral Device Discovery Remote File Copy Rundll32 Screen Capture Multiband Communication Basic Input/Output System Exploitation of Vulnerability Remote Services Scheduled Task Audio Capture Exfiltration Over Physical MediumBypass User Account Control Permission Groups Discovery Replication Through Removable Media Scripting Video Capture Multilayer Encryption Bootkit DLL Injection Service Execution Scheduled Transfer Peer Connections Change Default File Association Component Object Model Hijacking Process Discovery Shared Webroot Windows Management Instrumentation Remote File Copy Indicator Removal from Tools Query Registry Taint Shared Content Standard Application Layer ProtocolComponent Firmware Remote System Discovery Windows Admin Shares MSBuild Hypervisor Indicator Removal on Host Security Software Discovery Execution through Module Load Standard Cryptographic Protocol Logon Scripts Modify Existing Service InstallUtil System Information Discovery Standard Non-Application Layer ProtocolRedundant Access Masquerading Registry Run Keys / Start Folder Modify Registry System Owner/User Discovery Uncommonly Used Port NTFS Extended Attributes Web Service Security Support Provider Obfuscated Files or Information System Service Discovery Data Encoding Shortcut Modification System Time Discovery Windows Management Instrumentation Event Subscription Process Hollowing Redundant Access Regsvcs/Regasm Winlogon Helper DLL Regsvr32 Netsh Helper DLL Rootkit Authentication Package Rundll32 External Remote Services Scripting Software Packing Timestomp MSBuild Network Share Removal Install Root Certificate ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 30. Prioritizing techniques Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Execution Collection Exfiltration Command and Control DLL Search Order Hijacking Brute Force Account Discovery Windows Remote Management Automated Collection Automated Exfiltration Commonly Used Port Legitimate Credentials Credential Dumping Application Window Discovery Third-party Software Clipboard Data Data Compressed Communication Through Removable MediaAccessibility Features Binary Padding Application Deployment Software Command-Line Data Staged Data Encrypted AppInit DLLs Code Signing Credential Manipulation File and Directory Discovery Execution through API Data from Local System Data Transfer Size Limits Custom Command and Control ProtocolLocal Port Monitor Component Firmware Exploitation of Vulnerability Graphical User Interface Data from Network Shared Drive Exfiltration Over Alternative ProtocolNew Service DLL Side-Loading Credentials in Files Local Network Configuration Discovery InstallUtil Custom Cryptographic ProtocolPath Interception Disabling Security Tools Input Capture Logon Scripts PowerShell Data from Removable Media Exfiltration Over Command and Control Channel Scheduled Task File Deletion Network Sniffing Local Network Connections Discovery Pass the Hash Process Hollowing Data Obfuscation File System Permissions Weakness File System Logical Offsets Two-Factor Authentication Interception Pass the Ticket Regsvcs/Regasm Email Collection Fallback Channels Service Registry Permissions Weakness Network Service Scanning Remote Desktop Protocol Regsvr32 Input Capture Exfiltration Over Other Network Medium Multi-Stage Channels Web Shell Indicator Blocking Peripheral Device Discovery Remote File Copy Rundll32 Screen Capture Multiband Communication Basic Input/Output System Exploitation of Vulnerability Remote Services Scheduled Task Audio Capture Exfiltration Over Physical MediumBypass User Account Control Permission Groups Discovery Replication Through Removable Media Scripting Video Capture Multilayer Encryption Bootkit DLL Injection Service Execution Scheduled Transfer Peer Connections Change Default File Association Component Object Model Hijacking Process Discovery Shared Webroot Windows Management Instrumentation Remote File Copy Indicator Removal from Tools Query Registry Taint Shared Content Standard Application Layer ProtocolComponent Firmware Remote System Discovery Windows Admin Shares MSBuild Hypervisor Indicator Removal on Host Security Software Discovery Execution through Module Load Standard Cryptographic Protocol Logon Scripts Modify Existing Service InstallUtil System Information Discovery Standard Non-Application Layer ProtocolRedundant Access Masquerading Registry Run Keys / Start Folder Modify Registry System Owner/User Discovery Uncommonly Used Port NTFS Extended Attributes Web Service Security Support Provider Obfuscated Files or Information System Service Discovery Data Encoding Shortcut Modification System Time Discovery Windows Management Instrumentation Event Subscription Process Hollowing Redundant Access Regsvcs/Regasm Winlogon Helper DLL Regsvr32 Netsh Helper DLL Rootkit Authentication Package Rundll32 External Remote Services Scripting Software Packing Timestomp MSBuild Network Share Removal Install Root Certificate Legend Moderate Confidence of Detection High Confidence of Detection Low Confidence of Detection IOC Coverage Prioritized Adversary Techniques Define your threat model Assess your coverage Identify gaps Fill gaps ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 31. Working together Filling the gaps is hard, time-consuming, and expensive. • There are a lot of prevalent techniques • Adversary practices are always evolving • Techniques have a wide set of procedures • We all have limited resources • Requires in-depth expertise of system internals But you’re not alone. • Work with your red-team • Work with others in your industry • Talk on Twitter or Slack • Contribute to open source • Read blogs and blog yourself! ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 32. Challenge area: being realistic about coverage ▪ ATT&CK coverage heatmaps are great – Easy to understand – From a defender perspective “ ” straightforward ▪ BUT: Understanding coverage this way is often deceiving and doesn’t align with how attacks are actually detected 1. ATT&CK techniques can be executed and detected in many ways 2. Detecting single ATT&CK techniques is usually not the right level of abstraction ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 33. Challenge area: handling false positives ▪ We think we need to develop comprehensive coverage, but is it realistic with current FP rates and current approaches to detection? – Analytics are noisy, and more coverage means more false positives – Waste of analyst time, alert fatigue, etc. Novel Approaches Detecting event graphs Machine-Learning Tighten the feedback loop Target detections ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 34. Challenge area: getting and searching data ▪ Analytics require increasing amounts of data – , “ ” markers become less useful – Data often needs to come from endpoint + network + infrastructure Collection ▪ Can collection be targeted? ▪ Can collection be agile? ▪ Can collection be decentralized? Search ▪ How can graph-based search scale? ▪ How can you make effective use of your resources? ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 35. Getting started on your own ▪ Take a look at Detection Lab – https://github.com/clong/DetectionLab – https://medium.com/@clong/introducing-detection-lab-61db34bed6ae ▪ Be bad! – Atomic Red Team has a lot of commands to try: https://atomicredteam.io/ ▪ See what bad looks like, write some detections. – https://github.com/Cyb3rWard0g/ThreatHunter-Playbook is a good place for inspiration ▪ Share! ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 36. Bringing it all together… ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 37. Threat-informed defense, but for real Structured Threat Intel An ever-improving & validated defenseIntel-Driven Adversary Emulation ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 38. What’s next for ATT&CK? | 38 | Create a new website and infrastructure that makes ATT&CK easier to use Continue to expand the ATT&CK community Open up the development and governance of ATT&CK Improve and add to ATT&CK content: • Sub-techniques • Impacts • New technology domains ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 39. et’s Chat! ▪ Any questions for us? ▪ How have you tackled the challenges we discussed? ▪ If this is new to you… – How do you think you could use ATT&CK? – What could we do to help you start? ▪ If you’re already familiar with ATT&CK… – How are you using it? – What could we do to help you do that better? ▪ What is missing from ATT&CK? | 39 | ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.
  • 40. | 40 | @likethecoins attack.mitre.org attack@mitre.org @MITREattack Katie Nickels John Wunder @jwunder ©2018 The MITRE Corporation. ALL RIGHTS RESERVED Approved for public release. Distribution unlimited 18-1528-15.