MA
Uploaded byMITRE ATT&CK
PDF, PPTX1,124 views

Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK

Haylee Mills discusses utilizing the MITRE ATT&CK framework for enhancing risk-based alerting within security operations, showcasing a 90% reduction in alert volume while increasing the fidelity of alerts. The approach involves implementing a scoring system that evaluates and prioritizes risks from various data sources, ultimately improving threat detection and response capabilities. Key methodologies include refining detection logic and creating actionable insights for risk management and threat hunting.

Embed presentation

Download as PDF, PPTX
Tracking Noisy Behavior and Risk- Based Alerting with ATT&CK Haylee Mills Global Security Strategist Splunk
What am I talking about? How do I do that? What can I do now?
The Problem I have the MITRE ATT&CK technique data source BUT SO I could never alert on that (without SOC murdering me) Risk Based Alerting
Storytime Results Reduced alert volume by 90%, increased alert fidelity from 1% to nearly 10% Covered huge swaths of ATT&CK; increase value from purple teams New view into behavior for risk adjustment, trends, and threat hunting
Detection Methodology for Too Long Log Source Alert Detection Logic
Risk Based Alerting Observation Log Source Risk Index
Risk Based Alerting Observation Log Source Risk Index Log Source ATT&CK Tactic Risk Score
Risk Based Alerting Observation Log Source Risk Index BU Outlier Crit Vuln Count Asset Priority Log Source ATT&CK Tactic Risk Score
Risk Based Alerting Observation Log Source Risk Index Risk Grouping Alert BU Outlier Crit Vuln Count Asset Priority Log Source ATT&CK Tactic Risk Score
ALERT SOURCE TACTIC SCORE Nonstandard Port Activity Netflow TA0011 10 Potential C2 Activity Web TA0011 25 Some Noisy IDS Alert IDS TA0001 15 New Registry Startup Key EDR TA0003 30 New Scheduled Task Created EDR TA0002 35
ALERT SOURCE TACTIC SCORE Nonstandard Port Activity Netflow TA0011 10 Potential C2 Activity Web TA0011 25 Some Noisy IDS Alert IDS TA0001 15 New Registry Startup Key EDR TA0003 30 New Scheduled Task Created EDR TA0002 35
ALERT SOURCE TACTIC SCORE Nonstandard Port Activity Netflow TA0011 10 Potential C2 Activity Web TA0011 25 Some Noisy IDS Alert IDS TA0001 15 New Registry Startup Key EDR TA0003 30 New Scheduled Task Created EDR TA0002 35
Requirements (AFAIK) Tie events from all sources into abstraction layer with shared fields COLLECT in SPL, Risk Analysis action in Enterprise Security Tweak scores up or down based on attributes of risk object LOOKUP in SPL, Risk Factors / Identity & Asset Lookup in Enterprise Security Define a risk score and add security metadata to these observations EVAL in SPL, Risk Factors in Enterprise Security
Risk Rule Skeleton - Scoring index=ids sourcetype=suricata | stats count values(classtype) as category by src_ip, dest_ip, signature | eval risk_score = case(category = ”trojan-activity”, ”25”, category=”bad-unknown”,”15”,category=”web-application- attack”,”35”) | eval category_info = if(match(signature,”^ET INFO.+),”info”,null())
Risk Rule Skeleton - Scoring index=ids sourcetype=suricata | stats count values(classtype) as category by src_ip, dest_ip, signature | eval risk_score = case(category_info=”info”,”0”,category = ”trojan-activity”, ”25”, category=”bad-unknown”, ”15”, category=”web-application-attack”,”35”) | eval category_info = if(match(signature,”^ET INFO.+),”info”,null())
Risk Rule Muscles - Metadata | eval risk_object=src_ip , risk_object_type=”system” | eval threat_object = dest_ip, threat_object_type = “ip”
Risk Rule Muscles - Metadata | eval risk_object=src_ip , risk_object_type=”system” | eval threat_object = dest_ip, threat_object_type = “ip” | eval sourcetype=”suricata” , event_time = _time
Risk Rule Muscles - Metadata | eval risk_object=src_ip , risk_object_type=”system” | eval threat_object = dest_ip, threat_object_type = “ip” | eval sourcetype=”suricata” , event_time = _time | eval risk_message = “IDS - “.signature.” - from “.src_ip.” to “.dest_ip | eval risk_info = “count=”.count.”|src_category=”.src_category
Risk Rule Muscles - Metadata | eval rule_attack_tactic_technique = case( category=”trojan-activity”,”TA0011 - T1071 - Application Layer Protocols”, category=”bad-unknown”,”TA0001 - T1189 - Drive-by Compromise”, category=”web-application-attack”,”T0001 - T1190 - Exploit Public Facing Application”, true(),null()) | eval risk_object=src_ip , risk_object_type=”system” | eval threat_object = dest_ip, threat_object_type = “ip” | eval sourcetype=”suricata” , event_time = _time | eval risk_message = “IDS - “.signature.” - from “.src_ip.” to “.dest_ip | eval risk_info = “count=”.count.”|src_category=”.src_category
Risk Rule Skin - Adjustment | lookup assets_list.csv ip AS src_ip OUTPUT nt_host AS src , priority AS src_priority , category AS src_category
Risk Rule Skin - Adjustment | lookup assets_list.csv ip AS src_ip OUTPUT nt_host AS src , priority AS src_priority , category AS src_category | eval risk_mod_count=0 | eval risk_mod_count=if(like(src_category,"%pci%"), risk_mod_count+1, risk_mod_count) | eval risk_mod_count=if(like(src_category, "%production%"), risk_mod_count+1, risk_mod_count) | eval risk_mod_count=if(like(src_category, "%database%"), risk_mod_count+1, risk_mod_count) | eval risk_mod_count=if((src_priority="critical" OR src_priority="high"),risk_mod_count+1,risk_mod_count)
Risk Rule Skin - Adjustment | lookup vulnerability_list.csv nt_host as src OUTPUT crit_vuln_count | eval risk_mod_count=risk_mod_count+crit_vuln_count | eval risk_score=risk_score * ((risk_mod_count * .25)+1) | lookup assets_list.csv ip AS src_ip OUTPUT nt_host AS src , priority AS src_priority , category AS src_category | eval risk_mod_count=0 | eval risk_mod_count=if(like(src_category,"%pci%"), risk_mod_count+1, risk_mod_count) | eval risk_mod_count=if(like(src_category, "%production%"), risk_mod_count+1, risk_mod_count) | eval risk_mod_count=if(like(src_category, "%database%"), risk_mod_count+1, risk_mod_count) | eval risk_mod_count=if((src_priority="critical" OR src_priority="high"),risk_mod_count+1,risk_mod_count)
Risk Event Collection | collect index=risk FIELDS risk_object - risk_object_type threat_object - threat_object_type mitre_attack / any_cybersecurity_framework sourcetype - event_time risk_message - risk_info
Risk Alerts | index=risk | stats dc(mitre_tactic) dc(mitre_tech) dc(source) sum(risk_score) by risk_object
Risk Alerts | index=risk | stats dc(mitre_tactic) dc(mitre_tech) dc(source) sum(risk_score) by risk_object | where sum(risk_score) > 100 | where dc(mitre_tactic) > 2 OR (dc(mitre_tech) > 2 and dc(source) > 1) | where dc(source) > 2 generate threat hunting queues with different timeframes!
Rethinking Detection Anything I might want to know about later… make risk score ZERO EXAMPLES Adobe Acrobat Spawns Web Browser Proxy Connection to Uncategorized Site PHISH CATCHER Reconnaissance Command Detection (whoami, netstat, ipconfig, systeminfo, tasklist, ver, net, qprocess, query, ping, type, dir) C2 CATCHER Multiple Reconnaissance Commands Detected
Rethinking Alerting Different “lenses” into risk data for unique alerts per team https://ctid.mitre-engenuity.org/our-work/attack-flow/ Custom this-then-that attack flows
What were we talking about? How do we do that? What can we do now?
Q&A

More Related Content

PDF
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
PDF
When Insiders ATT&CK!
byMITRE ATT&CK
 
PDF
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
PDF
State of the ATT&CK
byMITRE ATT&CK
 
PDF
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 
PDF
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
PDF
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 
PDF
Threat Modelling - It's not just for developers
byMITRE ATT&CK
 
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
When Insiders ATT&CK!
byMITRE ATT&CK
 
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
State of the ATT&CK
byMITRE ATT&CK
 
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 
Threat Modelling - It's not just for developers
byMITRE ATT&CK
 

What's hot

PDF
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
PDF
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
PDF
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 
PDF
The ATT&CK Philharmonic
byMITRE ATT&CK
 
PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK for ICS
byMITRE ATT&CK
 
PDF
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
PDF
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
byMITRE - ATT&CKcon
 
PDF
ATT&CKcon Intro
byMITRE ATT&CK
 
PDF
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
byMITRE - ATT&CKcon
 
PDF
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...
byMITRE - ATT&CKcon
 
PDF
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
PDF
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
byMITRE ATT&CK
 
PDF
Cyber Threat Intelligence
bymohamed nasri
 
PDF
Projects to Impact- Operationalizing Work from the Center
byMITRE ATT&CK
 
PDF
From Theory to Practice: How My ATTACK Perspectives Have Changed
byMITRE - ATT&CKcon
 
PDF
ATT&CKING Containers in The Cloud
byMITRE ATT&CK
 
PDF
Adversary Emulation and Red Team Exercises - EDUCAUSE
byJorge Orchilles
 
PPTX
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
PDF
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
 
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 
The ATT&CK Philharmonic
byMITRE ATT&CK
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
ATT&CK Updates- ATT&CK for ICS
byMITRE ATT&CK
 
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
byMITRE - ATT&CKcon
 
ATT&CKcon Intro
byMITRE ATT&CK
 
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
byMITRE - ATT&CKcon
 
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...
byMITRE - ATT&CKcon
 
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
byMITRE ATT&CK
 
Cyber Threat Intelligence
bymohamed nasri
 
Projects to Impact- Operationalizing Work from the Center
byMITRE ATT&CK
 
From Theory to Practice: How My ATTACK Perspectives Have Changed
byMITRE - ATT&CKcon
 
ATT&CKING Containers in The Cloud
byMITRE ATT&CK
 
Adversary Emulation and Red Team Exercises - EDUCAUSE
byJorge Orchilles
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
 

Similar to Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK

PDF
Tips for IT Risk Management Prof. Hernan Huwyler Information Security Institute
byHernan Huwyler, MBA CPA
 
PDF
A Risk Based Approach to Security Detection and Investigation by Kelby Shelton
byJohn Billings CISSP
 
PPTX
1234567RISK-MANAGEMENT-FOR-SECURITY.pptx
byJOHNLLOYDFERIDO
 
PDF
CNIT 160: 3. Information Risk Management (Part 4)
bySam Bowne
 
PPTX
Assessing Quality in Cyber Risk Forecasting
byJack Freund, PhD
 
PPTX
July 2021 Virtual PNW Splunk User Group Slides
byAmanda Richardson
 
PDF
Tips for IT Risk Management Prof. Hernan Huwyler Information Security Institute
byHernan Huwyler, MBA CPA
 
PDF
CNIT 160: Ch 3c: The Risk Management Life Cycle
bySam Bowne
 
PPTX
Week_5_Foundations_of_Risk_Management_Attack_Surfaces.pptx
bySangheethaaSukumran
 
PDF
CNIT 160: Ch 3c: The Risk Management Life Cycle
bySam Bowne
 
PDF
Lightweight Cybersecurity Risk Assessment Tools for Cyberinfrastructure
byjbasney
 
PDF
Threat Based Risk Assessment
byMichael Lines
 
PDF
CNIT 160: Ch 3d: Operational Risk Management
bySam Bowne
 
PDF
Stronger 2021 Building the Blocks to Quantify Cyber Risks - Prof hernan huwyler
byHernan Huwyler, MBA CPA
 
PDF
Cybersecurity risk assessments help organizations identify.pdf
byTheWalkerGroup1
 
PDF
Data Driven Risk Assessment
byResolver Inc.
 
PPTX
IS-lecture-risk-management-security.pptx
bysyedatoobaaftab1
 
PPT
Cs461 06.risk analysis (1)
byneeraj.sihag
 
PPTX
MIS: Information Security Management
byJonathan Coleman
 
PDF
SplunkLive! Amsterdam 2015 - Analytics based security breakout
bySplunk
 
Tips for IT Risk Management Prof. Hernan Huwyler Information Security Institute
byHernan Huwyler, MBA CPA
 
A Risk Based Approach to Security Detection and Investigation by Kelby Shelton
byJohn Billings CISSP
 
1234567RISK-MANAGEMENT-FOR-SECURITY.pptx
byJOHNLLOYDFERIDO
 
CNIT 160: 3. Information Risk Management (Part 4)
bySam Bowne
 
Assessing Quality in Cyber Risk Forecasting
byJack Freund, PhD
 
July 2021 Virtual PNW Splunk User Group Slides
byAmanda Richardson
 
Tips for IT Risk Management Prof. Hernan Huwyler Information Security Institute
byHernan Huwyler, MBA CPA
 
CNIT 160: Ch 3c: The Risk Management Life Cycle
bySam Bowne
 
Week_5_Foundations_of_Risk_Management_Attack_Surfaces.pptx
bySangheethaaSukumran
 
CNIT 160: Ch 3c: The Risk Management Life Cycle
bySam Bowne
 
Lightweight Cybersecurity Risk Assessment Tools for Cyberinfrastructure
byjbasney
 
Threat Based Risk Assessment
byMichael Lines
 
CNIT 160: Ch 3d: Operational Risk Management
bySam Bowne
 
Stronger 2021 Building the Blocks to Quantify Cyber Risks - Prof hernan huwyler
byHernan Huwyler, MBA CPA
 
Cybersecurity risk assessments help organizations identify.pdf
byTheWalkerGroup1
 
Data Driven Risk Assessment
byResolver Inc.
 
IS-lecture-risk-management-security.pptx
bysyedatoobaaftab1
 
Cs461 06.risk analysis (1)
byneeraj.sihag
 
MIS: Information Security Management
byJonathan Coleman
 
SplunkLive! Amsterdam 2015 - Analytics based security breakout
bySplunk
 

More from MITRE ATT&CK

PDF
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
PDF
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
PDF
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
PDF
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
PDF
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
PDF
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
PDF
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
PDF
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
PDF
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
PDF
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
PDF
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
PDF
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
PDF
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
PDF
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 

Recently uploaded

PPTX
Dell poweredge-customer-presentation.pptx
byhungungphu123
 
PDF
Why Are Cloud Migration Services Essential for Modern Business Growth?
byGeoPITS Global Pvt Ltd
 
PDF
Introduction to Linux and Basic Commands
byiDev Semarang
 
PPTX
API Gateway Architecture - Technical Report 2026
byPowersoft2026
 
PPTX
Strategic Shelf Planning for the New Year Turning Resolutions into Revenue .pptx
byAnoop Ashok
 
PDF
apidays Australia 2025 | The Strategic Role of APIs in Digital Transformation
byapidays
 
PDF
Talaria: A Sound-Driven Music Search Engine for Discovery Beyond Metadata
byShuen-Huei Guan
 
PDF
Skills to Pass the UiPath Agentic Automation Associate (UiAAA) Certification
byUiPathCommunity
 
PPTX
Mastering SQL Server Replication: Types, Setup & Troubleshooting
byGeoPITS Global Pvt Ltd
 
PPTX
Single Cell Protein from Methane or Methanol - Process development research c...
byJohn Downs
 
PDF
How the EU Ecolabel's Record Growth Creates ESG Opportunities for CRE
byWastify AI
 
PDF
apidays Australia 2025 | User Brainpower vs. AI Blind Spots in API Docs
byapidays
 
PPTX
Storage-and-HCI-Positioning-update-sales.pptx
byhungungphu123
 
PPTX
Driving Smarter Decisions with Oracle Analytics Cloud Consulting
byChetu
 
PDF
TopMate ES11 3-Wheel Electric Scooter: Comfortable, Stable Mobility for Every...
byTopmate
 
DOCX
Best Web to Learn About Buying Verified Skrill Accounts (Los Angeles).docx
byhttps://topsellerit.com/product/buy-verified-binance-accounts/
 
PPTX
Code Like Bro -A guide for better Coding
byMadan Panthi
 
PPT
connectives-linking words in English.ppt
byAmrMohammed82
 
PPTX
Apache Kafka 101 for Techies in IT dep.pptx
byamulyareddyk97
 
PPTX
Achieve enterprise automation with SAP BTP solutions and SAP Signavio
bydarrellkiwi
 
Dell poweredge-customer-presentation.pptx
byhungungphu123
 
Why Are Cloud Migration Services Essential for Modern Business Growth?
byGeoPITS Global Pvt Ltd
 
Introduction to Linux and Basic Commands
byiDev Semarang
 
API Gateway Architecture - Technical Report 2026
byPowersoft2026
 
Strategic Shelf Planning for the New Year Turning Resolutions into Revenue .pptx
byAnoop Ashok
 
apidays Australia 2025 | The Strategic Role of APIs in Digital Transformation
byapidays
 
Talaria: A Sound-Driven Music Search Engine for Discovery Beyond Metadata
byShuen-Huei Guan
 
Skills to Pass the UiPath Agentic Automation Associate (UiAAA) Certification
byUiPathCommunity
 
Mastering SQL Server Replication: Types, Setup & Troubleshooting
byGeoPITS Global Pvt Ltd
 
Single Cell Protein from Methane or Methanol - Process development research c...
byJohn Downs
 
How the EU Ecolabel's Record Growth Creates ESG Opportunities for CRE
byWastify AI
 
apidays Australia 2025 | User Brainpower vs. AI Blind Spots in API Docs
byapidays
 
Storage-and-HCI-Positioning-update-sales.pptx
byhungungphu123
 
Driving Smarter Decisions with Oracle Analytics Cloud Consulting
byChetu
 
TopMate ES11 3-Wheel Electric Scooter: Comfortable, Stable Mobility for Every...
byTopmate
 
Best Web to Learn About Buying Verified Skrill Accounts (Los Angeles).docx
byhttps://topsellerit.com/product/buy-verified-binance-accounts/
 
Code Like Bro -A guide for better Coding
byMadan Panthi
 
connectives-linking words in English.ppt
byAmrMohammed82
 
Apache Kafka 101 for Techies in IT dep.pptx
byamulyareddyk97
 
Achieve enterprise automation with SAP BTP solutions and SAP Signavio
bydarrellkiwi
 

Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK

  • 1.
    Tracking Noisy Behaviorand Risk- Based Alerting with ATT&CK Haylee Mills Global Security Strategist Splunk
  • 2.
    What am Italking about? How do I do that? What can I do now?
  • 3.
    The Problem I havethe MITRE ATT&CK technique data source BUT SO I could never alert on that (without SOC murdering me) Risk Based Alerting
  • 5.
    Storytime Results Reduced alertvolume by 90%, increased alert fidelity from 1% to nearly 10% Covered huge swaths of ATT&CK; increase value from purple teams New view into behavior for risk adjustment, trends, and threat hunting
  • 6.
    Detection Methodology forToo Long Log Source Alert Detection Logic
  • 7.
  • 8.
    Risk Based Alerting Observation LogSource Risk Index Log Source ATT&CK Tactic Risk Score
  • 9.
    Risk Based Alerting Observation LogSource Risk Index BU Outlier Crit Vuln Count Asset Priority Log Source ATT&CK Tactic Risk Score
  • 10.
    Risk Based Alerting Observation LogSource Risk Index Risk Grouping Alert BU Outlier Crit Vuln Count Asset Priority Log Source ATT&CK Tactic Risk Score
  • 13.
    ALERT SOURCE TACTICSCORE Nonstandard Port Activity Netflow TA0011 10 Potential C2 Activity Web TA0011 25 Some Noisy IDS Alert IDS TA0001 15 New Registry Startup Key EDR TA0003 30 New Scheduled Task Created EDR TA0002 35
  • 14.
    ALERT SOURCE TACTICSCORE Nonstandard Port Activity Netflow TA0011 10 Potential C2 Activity Web TA0011 25 Some Noisy IDS Alert IDS TA0001 15 New Registry Startup Key EDR TA0003 30 New Scheduled Task Created EDR TA0002 35
  • 15.
    ALERT SOURCE TACTICSCORE Nonstandard Port Activity Netflow TA0011 10 Potential C2 Activity Web TA0011 25 Some Noisy IDS Alert IDS TA0001 15 New Registry Startup Key EDR TA0003 30 New Scheduled Task Created EDR TA0002 35
  • 16.
    Requirements (AFAIK) Tie eventsfrom all sources into abstraction layer with shared fields COLLECT in SPL, Risk Analysis action in Enterprise Security Tweak scores up or down based on attributes of risk object LOOKUP in SPL, Risk Factors / Identity & Asset Lookup in Enterprise Security Define a risk score and add security metadata to these observations EVAL in SPL, Risk Factors in Enterprise Security
  • 17.
    Risk Rule Skeleton- Scoring index=ids sourcetype=suricata | stats count values(classtype) as category by src_ip, dest_ip, signature | eval risk_score = case(category = ”trojan-activity”, ”25”, category=”bad-unknown”,”15”,category=”web-application- attack”,”35”) | eval category_info = if(match(signature,”^ET INFO.+),”info”,null())
  • 18.
    Risk Rule Skeleton- Scoring index=ids sourcetype=suricata | stats count values(classtype) as category by src_ip, dest_ip, signature | eval risk_score = case(category_info=”info”,”0”,category = ”trojan-activity”, ”25”, category=”bad-unknown”, ”15”, category=”web-application-attack”,”35”) | eval category_info = if(match(signature,”^ET INFO.+),”info”,null())
  • 19.
    Risk Rule Muscles- Metadata | eval risk_object=src_ip , risk_object_type=”system” | eval threat_object = dest_ip, threat_object_type = “ip”
  • 20.
    Risk Rule Muscles- Metadata | eval risk_object=src_ip , risk_object_type=”system” | eval threat_object = dest_ip, threat_object_type = “ip” | eval sourcetype=”suricata” , event_time = _time
  • 21.
    Risk Rule Muscles- Metadata | eval risk_object=src_ip , risk_object_type=”system” | eval threat_object = dest_ip, threat_object_type = “ip” | eval sourcetype=”suricata” , event_time = _time | eval risk_message = “IDS - “.signature.” - from “.src_ip.” to “.dest_ip | eval risk_info = “count=”.count.”|src_category=”.src_category
  • 22.
    Risk Rule Muscles- Metadata | eval rule_attack_tactic_technique = case( category=”trojan-activity”,”TA0011 - T1071 - Application Layer Protocols”, category=”bad-unknown”,”TA0001 - T1189 - Drive-by Compromise”, category=”web-application-attack”,”T0001 - T1190 - Exploit Public Facing Application”, true(),null()) | eval risk_object=src_ip , risk_object_type=”system” | eval threat_object = dest_ip, threat_object_type = “ip” | eval sourcetype=”suricata” , event_time = _time | eval risk_message = “IDS - “.signature.” - from “.src_ip.” to “.dest_ip | eval risk_info = “count=”.count.”|src_category=”.src_category
  • 23.
    Risk Rule Skin- Adjustment | lookup assets_list.csv ip AS src_ip OUTPUT nt_host AS src , priority AS src_priority , category AS src_category
  • 24.
    Risk Rule Skin- Adjustment | lookup assets_list.csv ip AS src_ip OUTPUT nt_host AS src , priority AS src_priority , category AS src_category | eval risk_mod_count=0 | eval risk_mod_count=if(like(src_category,"%pci%"), risk_mod_count+1, risk_mod_count) | eval risk_mod_count=if(like(src_category, "%production%"), risk_mod_count+1, risk_mod_count) | eval risk_mod_count=if(like(src_category, "%database%"), risk_mod_count+1, risk_mod_count) | eval risk_mod_count=if((src_priority="critical" OR src_priority="high"),risk_mod_count+1,risk_mod_count)
  • 25.
    Risk Rule Skin- Adjustment | lookup vulnerability_list.csv nt_host as src OUTPUT crit_vuln_count | eval risk_mod_count=risk_mod_count+crit_vuln_count | eval risk_score=risk_score * ((risk_mod_count * .25)+1) | lookup assets_list.csv ip AS src_ip OUTPUT nt_host AS src , priority AS src_priority , category AS src_category | eval risk_mod_count=0 | eval risk_mod_count=if(like(src_category,"%pci%"), risk_mod_count+1, risk_mod_count) | eval risk_mod_count=if(like(src_category, "%production%"), risk_mod_count+1, risk_mod_count) | eval risk_mod_count=if(like(src_category, "%database%"), risk_mod_count+1, risk_mod_count) | eval risk_mod_count=if((src_priority="critical" OR src_priority="high"),risk_mod_count+1,risk_mod_count)
  • 26.
    Risk Event Collection |collect index=risk FIELDS risk_object - risk_object_type threat_object - threat_object_type mitre_attack / any_cybersecurity_framework sourcetype - event_time risk_message - risk_info
  • 27.
    Risk Alerts | index=risk| stats dc(mitre_tactic) dc(mitre_tech) dc(source) sum(risk_score) by risk_object
  • 28.
    Risk Alerts | index=risk| stats dc(mitre_tactic) dc(mitre_tech) dc(source) sum(risk_score) by risk_object | where sum(risk_score) > 100 | where dc(mitre_tactic) > 2 OR (dc(mitre_tech) > 2 and dc(source) > 1) | where dc(source) > 2 generate threat hunting queues with different timeframes!
  • 29.
    Rethinking Detection Anything Imight want to know about later… make risk score ZERO EXAMPLES Adobe Acrobat Spawns Web Browser Proxy Connection to Uncategorized Site PHISH CATCHER Reconnaissance Command Detection (whoami, netstat, ipconfig, systeminfo, tasklist, ver, net, qprocess, query, ping, type, dir) C2 CATCHER Multiple Reconnaissance Commands Detected
  • 30.
    Rethinking Alerting Different “lenses”into risk data for unique alerts per team https://ctid.mitre-engenuity.org/our-work/attack-flow/ Custom this-then-that attack flows
  • 31.
    What were wetalking about? How do we do that? What can we do now?
  • 32.