MA
Uploaded byMITRE ATT&CK
PDF, PPTX734 views

What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team

The document outlines a presentation on the Atomic Red Team and MITRE ATT&CK framework, focusing on enhancing coverage analysis through a breadth and depth approach. Key topics include the community-driven development of atomic tests, categorization by difficulty, and strategies for identifying coverage gaps. The presenters emphasize the importance of paying interns and contributing to open-source efforts within the cybersecurity community.

Embed presentation

Download as PDF, PPTX
This is the main title of your talk This is a sub-header: Should be a sentence and not a paragraph. Breadth and Depth Analysis with Atomic Red Team™ What is ATT&CK coverage, anyway?
Former Journalist turned CTI analyst Dabbled briefly in marketing ○ (was bad at it) Fourth time attending; third time speaking ○ (I’m sorry) Write, research, talk about security Lives nearby ATT&CKcon Brian Donohue Principal Security Specialist RED CANARY @TheBrianDonohue Presenter
Background in… ○ Privacy & Encryption ○ Adversary Simulation/Emulation Soul of a Product Manager Primary objective: be an enabler 💜’s Purple Teaming Write enough code to be dangerous Lives far from ATT&CKcon Adam Mashinchi Director, Open Source Programs RED CANARY @Adam_Mashinchi Co-Author
Preface Slide MITRE ATT&CK A “common language” for (cyber) security practitioners, executives, and stakeholders. Classification system for the library of Atomic Red Team examples. Atomic Red Team An open source library of simple, focused tests mapped to the MITRE ATT&CK® matrix. Each test runs in five minutes or less, and many tests come with easy-to-use configuration and cleanup commands. [Audience Interactive Slide: If you know what the “Dewey Decimal System” is, please feel old now!!!]
This is the main title of your talk This is a sub-header: Should be a sentence and not a paragraph. What is “coverage” in the context of Atomic Red Team & MITRE ATT&CK? Problem #1
A (naive) approach to “breadth” coverage… Atomic test for technique ID? → “Done!” Breakdown by “all” and each platform But what about “depth”? How well do a group of tests cover a technique? How difficult is a test to execute? What about “sub-platforms”? ○ (i.e., IaaS vs. IaaS:AWS) Defining “coverage”
This is the main title of your talk This is a sub-header: Should be a sentence and not a paragraph. Who will help solve this problem?!?! Problem #B
Project Maintainers & Contributors These are amazing people!!! ○ “Thanks for everything you do!” Great at small/iterative changes The Atomic Tests are almost 100% community developed & maintained Shameless Plug: If you contribute to Atomic Red Team you get a t-shirt! Learn more at atomicredteam.io! Who works on the (free) stuff?
Internships Exclusively working on open source SOLUTION
DO’s & DON'Ts Internships 101 Always: Pay your interns (Part/Full Time, Contractor, etc.) (Offer to) work with educational institutions Treat them like any other teammate Pay. Your. Interns.* Never: Use them for menial tasks (exclusively) Rely on “great culture” as primary benefit * likely the most-important take-away from this talk
Gets all-the-credit for the work done!!! Has worked for a few cybersecurity firms An awesome open source contributor Enjoys (hacking) video games Cameron Roberts Open Source Developer Intern (Former) @JrOrOneEquals1 Shout-Out: Cameron The Intern™
#1: Analysis of Atomic Red Team coverage Create scripted means of generating report Add visualization of data into web interface #2: Categorization of Atomic Tests by difficulty Define means of sorting Tests Generate data #3: Gap Analysis of Atomic Red Team Review gaps in coverage Fill coverage gaps based on effort/value Atomic Red Team - Coverage We’re Here
Part #1 Counting Things AKA “Breadth Analysis” First with Python Then later with JavaScript
More than a FOR loop ● Platforms ● Deprecated stuff ● Sub-techniques ● Python → to CSV ○ Pivot tables! Part #1 - Counting “Run Upon” != “Run From” (target) != (source)
Part #1 - Visualize After doing this in Python, doing it in JavaScript is easy Advice: Avoid solving, solved problems ○ i.e. Don’t get stuck writing a graphing library—use Google Charts (js lib)
Part #2 Categorizing Things AKA “Depth Analysis” Finding a (practical) sorting method
We know if… ○ we have test(s), how many, by platform But what if… ○ T9100 has 14 tests, but only 2 for Linux? ○ T9200 has 14 tests, but all are really tricky? And to further complicate things… ○ “System Time Discovery” ← Easy? ○ “Network Sniffing” ← Less-Easy? ○ “Cloud Storage Object Discovery” ← ??? ■ Prerequisites & Paid Providers But how “well covered” is that?
Scoring Rubric Initial Pass (v1.0) Use only what is in the YAML Multiple IF statements Apply a “Difficulty Score” (0 - 9) With a Difficulty Score Can now auto-apply and check Can even grade on a curve...
Part #2 Define a scale of “difficulty” MUST BE: ○ Strictly defined ○ Human actionable Bonus Round: ○ Machine parsable ○ Test execution (not here yet) Copy/Paste Work? Has Prerequisites? Default Arguments? Need 2nd Machine? Requires Credentials? Requires Elevation?
Coverage Gaps! T9300 doesn’t have enough macOS tests… T9400 is the only technique in the tactic with 1 Windows test… With all the Atomic Tests Scored… Difficulty Gaps! T9500 only has “hard” tests… T9600’s has Linux tests, but none are “easy”...
Part #3 Filling The Gaps AKA “Make this better/easier”
Part #3 - Goal Heatmap to end all heatmaps Be able to visually identify where we should add atomic tests ○ … at the wholistic, and per-platform, level
How to prioritize where to start? ○ “Most bang for the buck” ○ “Low-hanging fruit” Ye olde Product Manager Trick Effort → 1 == Low Value → 1 == High Score → Lower == Better Options: ○ Fill empty Tests ○ Add more easy Tests Defining Effort-To-Value Ratios ITEM EFFORT VALUE SCORE Alpha 3 3 6 Beta 1 1 2 Gamma 1 2 3
Going to launch a new cool site Includes interactive charts/graphs Adding more Atomic Tests Write up the how/why in detail So… When do we get to see this stuff?!
Pay. Your. Interns. And also, in Atomic Red Team land… Coverage & gap analysis is underway New site (and tests!) are Coming Soon™ Also… you should contribute! Last Takeaways
Q&A Everything Atomic Red Team is at: atomicredteam.io
The Last Slide Thanks!

More Related Content

PDF
Threat Modelling - It's not just for developers
byMITRE ATT&CK
 
PDF
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
PDF
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 
PDF
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
PDF
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
PDF
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 
PDF
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
PDF
ATT&CKING Containers in The Cloud
byMITRE ATT&CK
 
Threat Modelling - It's not just for developers
byMITRE ATT&CK
 
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
ATT&CKING Containers in The Cloud
byMITRE ATT&CK
 

What's hot

PDF
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
byMITRE ATT&CK
 
PDF
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
PDF
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK for ICS
byMITRE ATT&CK
 
PDF
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
PDF
ATT&CKcon Intro
byMITRE ATT&CK
 
PPTX
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
PDF
State of the ATT&CK
byMITRE ATT&CK
 
PDF
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
byKatie Nickels
 
PPTX
ATT&CKing with Threat Intelligence
byChristopher Korban
 
PDF
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
PDF
When Insiders ATT&CK!
byMITRE ATT&CK
 
PDF
Automation: The Wonderful Wizard of CTI (or is it?)
byMITRE ATT&CK
 
PDF
The ATT&CK Philharmonic
byMITRE ATT&CK
 
PPTX
Threat hunting - Every day is hunting season
byBen Boyd
 
PDF
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...
byMITRE - ATT&CKcon
 
PDF
Threat-Based Adversary Emulation with MITRE ATT&CK
byKatie Nickels
 
PDF
MITRE ATT&CKcon 2018: Helping Your Non-Security Executives Understand ATT&CK ...
byMITRE - ATT&CKcon
 
PDF
ATT&CKing Your Adversaries - Operationalizing cyber intelligence in your own ...
byJamieWilliams130
 
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
byMITRE ATT&CK
 
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
ATT&CK Updates- ATT&CK for ICS
byMITRE ATT&CK
 
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
ATT&CKcon Intro
byMITRE ATT&CK
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
State of the ATT&CK
byMITRE ATT&CK
 
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
byKatie Nickels
 
ATT&CKing with Threat Intelligence
byChristopher Korban
 
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
When Insiders ATT&CK!
byMITRE ATT&CK
 
Automation: The Wonderful Wizard of CTI (or is it?)
byMITRE ATT&CK
 
The ATT&CK Philharmonic
byMITRE ATT&CK
 
Threat hunting - Every day is hunting season
byBen Boyd
 
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...
byMITRE - ATT&CKcon
 
Threat-Based Adversary Emulation with MITRE ATT&CK
byKatie Nickels
 
MITRE ATT&CKcon 2018: Helping Your Non-Security Executives Understand ATT&CK ...
byMITRE - ATT&CKcon
 
ATT&CKing Your Adversaries - Operationalizing cyber intelligence in your own ...
byJamieWilliams130
 

Similar to What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team

PDF
MITRE ATT&CKcon 2018: Building an Atomic Testing Program, Brian Beyer, Red Ca...
byMITRE - ATT&CKcon
 
PPTX
Quest for the ultimate autotest coverage
byAlexander Pushkarev
 
PDF
Getting Ahead of Delivery Issues with Deep SDLC Analysis by Donald Belcham
by.NET Conf UY
 
PDF
The Most Important Thing: How Mozilla Does Security and What You Can Steal
bymozilla.presentations
 
PPTX
Finding Zero-Days Before The Attackers: A Fortune 500 Red Team Case Study
byDevOps.com
 
PPTX
BSidesLV -The SOC Counter ATT&CK
byMathieu Saulnier
 
PDF
The Future of DevSecOps
byStefan Streichsbier
 
PPTX
Test Coverage: An Art and a Science
byTeamQualityPro
 
PDF
Continuous (Production) Integration: Ruby on Rails Application Monitoring wit...
byjnewland
 
PDF
DSR Testing (Part 2)
bySteve Upton
 
PDF
#ATAGTR2019 Presentation "Top 10 quality engineering best practices to achiev...
byAgile Testing Alliance
 
PDF
Полезные метрики покрытия. Практический опыт и немного теории
bySQALab
 
PDF
Pragmatic Code Coverage
byAlexandre (Shura) Iline
 
PPT
Software test management
byVishad Garg
 
PPTX
UXDX London 2018 Nik Crabtree - Enhancing the Processes of Test Driven Develo...
byUXDXConf
 
PDF
Dare to Explore: Discover ET!
byRaj Indugula
 
PDF
Software Analytics: Data Analytics for Software Engineering
byTao Xie
 
PDF
From Data to Insights: How IT Operations Data Can Boost Quality
byCognizant
 
PPTX
#ATAGTR2020 Presentation - Speed Up Your Regression Testing Cycles with Data ...
byAgile Testing Alliance
 
PPT
Code Quality - Security
bysedukull
 
MITRE ATT&CKcon 2018: Building an Atomic Testing Program, Brian Beyer, Red Ca...
byMITRE - ATT&CKcon
 
Quest for the ultimate autotest coverage
byAlexander Pushkarev
 
Getting Ahead of Delivery Issues with Deep SDLC Analysis by Donald Belcham
by.NET Conf UY
 
The Most Important Thing: How Mozilla Does Security and What You Can Steal
bymozilla.presentations
 
Finding Zero-Days Before The Attackers: A Fortune 500 Red Team Case Study
byDevOps.com
 
BSidesLV -The SOC Counter ATT&CK
byMathieu Saulnier
 
The Future of DevSecOps
byStefan Streichsbier
 
Test Coverage: An Art and a Science
byTeamQualityPro
 
Continuous (Production) Integration: Ruby on Rails Application Monitoring wit...
byjnewland
 
DSR Testing (Part 2)
bySteve Upton
 
#ATAGTR2019 Presentation "Top 10 quality engineering best practices to achiev...
byAgile Testing Alliance
 
Полезные метрики покрытия. Практический опыт и немного теории
bySQALab
 
Pragmatic Code Coverage
byAlexandre (Shura) Iline
 
Software test management
byVishad Garg
 
UXDX London 2018 Nik Crabtree - Enhancing the Processes of Test Driven Develo...
byUXDXConf
 
Dare to Explore: Discover ET!
byRaj Indugula
 
Software Analytics: Data Analytics for Software Engineering
byTao Xie
 
From Data to Insights: How IT Operations Data Can Boost Quality
byCognizant
 
#ATAGTR2020 Presentation - Speed Up Your Regression Testing Cycles with Data ...
byAgile Testing Alliance
 
Code Quality - Security
bysedukull
 

More from MITRE ATT&CK

PDF
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
PDF
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
PDF
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
PDF
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
PDF
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
PDF
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
PDF
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
PDF
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
PDF
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
PDF
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
PDF
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
PDF
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
PDF
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
PDF
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 

Recently uploaded

PDF
UiPath Automation Developer Associate Training Series 2026 - Session 2
byDianaGray10
 
PDF
AI and Zero Trust: What it takes to do it right
byMark Simos
 
PPTX
TechSprint (SJBIT) 2025-26 Hackathon Winners & Awards Ceremony
bysuhasspgdg
 
PDF
Advanced SELinux Management - RHCSA (RH134).pdf
byLinuxCert Guru
 
PDF
From DeFi POC to Production MVP - A 12-16 Week Blueprint.pdf
byniahiggins21
 
PDF
UiPath Automation Developer Associate Training Series 2026 - Session 1
byDianaGray10
 
PPTX
TechSprint WinterHack — Top 10 Teams Pitching Session we are excited for pit...
bybajpaitusharoffon678
 
PDF
CI CD Observability, Metrics and DORA - Shifting Left and Cleaning Up! - Febr...
byPeter Souter
 
PPTX
The Lex Wire Precedent: A Technical Standard for Machine-Mediated Authority ...
byJeff Howell
 
PPTX
Introduction to Artificial Intelligence (AI).pptx
byammar414783
 
PDF
Chapter 4 Network Security in computer security
byGetnet Tigabie Askale -(GM)
 
PDF
Getting Started with Apache Spark: Big Data Made Simple [Free Meetup]
byHaim Michael
 
PPTX
Introduction to Industrial-Arts Grade 8 ppt Lesson 1
byFSBTLEDNathanVince
 
PDF
What Is the Azure AI Foundry and Why Does It Matter for Enterprises?
byjohncarterjn
 
PDF
Adapt.com Seed Fundraising Deck | The AI Computer for Business
byashley459565
 
PDF
ICT500 - CRITICAL AND CREATIVE THINKING FOR INFORMATION TECHNOLOGY SOLUTIONS:...
by2024432452
 
PDF
Designing a Blog Using Wordpress
bymarkzubi50
 
PDF
The Manifesto for AI-enabled Governance !
byYannis Charalabidis
 
PPTX
Beyond the Algorithm: Designing Human-Centric Public Service with AI
byAlan Dix
 
PPTX
Working Session — Build a Document Understanding Automation Using an OOTB ML ...
byDianaGray10
 
UiPath Automation Developer Associate Training Series 2026 - Session 2
byDianaGray10
 
AI and Zero Trust: What it takes to do it right
byMark Simos
 
TechSprint (SJBIT) 2025-26 Hackathon Winners & Awards Ceremony
bysuhasspgdg
 
Advanced SELinux Management - RHCSA (RH134).pdf
byLinuxCert Guru
 
From DeFi POC to Production MVP - A 12-16 Week Blueprint.pdf
byniahiggins21
 
UiPath Automation Developer Associate Training Series 2026 - Session 1
byDianaGray10
 
TechSprint WinterHack — Top 10 Teams Pitching Session we are excited for pit...
bybajpaitusharoffon678
 
CI CD Observability, Metrics and DORA - Shifting Left and Cleaning Up! - Febr...
byPeter Souter
 
The Lex Wire Precedent: A Technical Standard for Machine-Mediated Authority ...
byJeff Howell
 
Introduction to Artificial Intelligence (AI).pptx
byammar414783
 
Chapter 4 Network Security in computer security
byGetnet Tigabie Askale -(GM)
 
Getting Started with Apache Spark: Big Data Made Simple [Free Meetup]
byHaim Michael
 
Introduction to Industrial-Arts Grade 8 ppt Lesson 1
byFSBTLEDNathanVince
 
What Is the Azure AI Foundry and Why Does It Matter for Enterprises?
byjohncarterjn
 
Adapt.com Seed Fundraising Deck | The AI Computer for Business
byashley459565
 
ICT500 - CRITICAL AND CREATIVE THINKING FOR INFORMATION TECHNOLOGY SOLUTIONS:...
by2024432452
 
Designing a Blog Using Wordpress
bymarkzubi50
 
The Manifesto for AI-enabled Governance !
byYannis Charalabidis
 
Beyond the Algorithm: Designing Human-Centric Public Service with AI
byAlan Dix
 
Working Session — Build a Document Understanding Automation Using an OOTB ML ...
byDianaGray10
 

What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team

  • 1.
    This is themain title of your talk This is a sub-header: Should be a sentence and not a paragraph. Breadth and Depth Analysis with Atomic Red Team™ What is ATT&CK coverage, anyway?
  • 2.
    Former Journalist turnedCTI analyst Dabbled briefly in marketing ○ (was bad at it) Fourth time attending; third time speaking ○ (I’m sorry) Write, research, talk about security Lives nearby ATT&CKcon Brian Donohue Principal Security Specialist RED CANARY @TheBrianDonohue Presenter
  • 3.
    Background in… ○ Privacy& Encryption ○ Adversary Simulation/Emulation Soul of a Product Manager Primary objective: be an enabler 💜’s Purple Teaming Write enough code to be dangerous Lives far from ATT&CKcon Adam Mashinchi Director, Open Source Programs RED CANARY @Adam_Mashinchi Co-Author
  • 4.
    Preface Slide MITRE ATT&CK A“common language” for (cyber) security practitioners, executives, and stakeholders. Classification system for the library of Atomic Red Team examples. Atomic Red Team An open source library of simple, focused tests mapped to the MITRE ATT&CK® matrix. Each test runs in five minutes or less, and many tests come with easy-to-use configuration and cleanup commands. [Audience Interactive Slide: If you know what the “Dewey Decimal System” is, please feel old now!!!]
  • 5.
    This is themain title of your talk This is a sub-header: Should be a sentence and not a paragraph. What is “coverage” in the context of Atomic Red Team & MITRE ATT&CK? Problem #1
  • 6.
    A (naive) approachto “breadth” coverage… Atomic test for technique ID? → “Done!” Breakdown by “all” and each platform But what about “depth”? How well do a group of tests cover a technique? How difficult is a test to execute? What about “sub-platforms”? ○ (i.e., IaaS vs. IaaS:AWS) Defining “coverage”
  • 7.
    This is themain title of your talk This is a sub-header: Should be a sentence and not a paragraph. Who will help solve this problem?!?! Problem #B
  • 8.
    Project Maintainers &Contributors These are amazing people!!! ○ “Thanks for everything you do!” Great at small/iterative changes The Atomic Tests are almost 100% community developed & maintained Shameless Plug: If you contribute to Atomic Red Team you get a t-shirt! Learn more at atomicredteam.io! Who works on the (free) stuff?
  • 9.
  • 10.
    DO’s & DON'Ts Internships101 Always: Pay your interns (Part/Full Time, Contractor, etc.) (Offer to) work with educational institutions Treat them like any other teammate Pay. Your. Interns.* Never: Use them for menial tasks (exclusively) Rely on “great culture” as primary benefit * likely the most-important take-away from this talk
  • 11.
    Gets all-the-credit forthe work done!!! Has worked for a few cybersecurity firms An awesome open source contributor Enjoys (hacking) video games Cameron Roberts Open Source Developer Intern (Former) @JrOrOneEquals1 Shout-Out: Cameron The Intern™
  • 12.
    #1: Analysis ofAtomic Red Team coverage Create scripted means of generating report Add visualization of data into web interface #2: Categorization of Atomic Tests by difficulty Define means of sorting Tests Generate data #3: Gap Analysis of Atomic Red Team Review gaps in coverage Fill coverage gaps based on effort/value Atomic Red Team - Coverage We’re Here
  • 13.
    Part #1 Counting Things AKA“Breadth Analysis” First with Python Then later with JavaScript
  • 14.
    More than aFOR loop ● Platforms ● Deprecated stuff ● Sub-techniques ● Python → to CSV ○ Pivot tables! Part #1 - Counting “Run Upon” != “Run From” (target) != (source)
  • 15.
    Part #1 -Visualize After doing this in Python, doing it in JavaScript is easy Advice: Avoid solving, solved problems ○ i.e. Don’t get stuck writing a graphing library—use Google Charts (js lib)
  • 16.
    Part #2 Categorizing Things AKA“Depth Analysis” Finding a (practical) sorting method
  • 17.
    We know if… ○we have test(s), how many, by platform But what if… ○ T9100 has 14 tests, but only 2 for Linux? ○ T9200 has 14 tests, but all are really tricky? And to further complicate things… ○ “System Time Discovery” ← Easy? ○ “Network Sniffing” ← Less-Easy? ○ “Cloud Storage Object Discovery” ← ??? ■ Prerequisites & Paid Providers But how “well covered” is that?
  • 18.
    Scoring Rubric Initial Pass(v1.0) Use only what is in the YAML Multiple IF statements Apply a “Difficulty Score” (0 - 9) With a Difficulty Score Can now auto-apply and check Can even grade on a curve...
  • 19.
    Part #2 Define ascale of “difficulty” MUST BE: ○ Strictly defined ○ Human actionable Bonus Round: ○ Machine parsable ○ Test execution (not here yet) Copy/Paste Work? Has Prerequisites? Default Arguments? Need 2nd Machine? Requires Credentials? Requires Elevation?
  • 20.
    Coverage Gaps! T9300 doesn’thave enough macOS tests… T9400 is the only technique in the tactic with 1 Windows test… With all the Atomic Tests Scored… Difficulty Gaps! T9500 only has “hard” tests… T9600’s has Linux tests, but none are “easy”...
  • 21.
    Part #3 Filling TheGaps AKA “Make this better/easier”
  • 22.
    Part #3 -Goal Heatmap to end all heatmaps Be able to visually identify where we should add atomic tests ○ … at the wholistic, and per-platform, level
  • 23.
    How to prioritizewhere to start? ○ “Most bang for the buck” ○ “Low-hanging fruit” Ye olde Product Manager Trick Effort → 1 == Low Value → 1 == High Score → Lower == Better Options: ○ Fill empty Tests ○ Add more easy Tests Defining Effort-To-Value Ratios ITEM EFFORT VALUE SCORE Alpha 3 3 6 Beta 1 1 2 Gamma 1 2 3
  • 24.
    Going to launcha new cool site Includes interactive charts/graphs Adding more Atomic Tests Write up the how/why in detail So… When do we get to see this stuff?!
  • 25.
    Pay. Your. Interns. Andalso, in Atomic Red Team land… Coverage & gap analysis is underway New site (and tests!) are Coming Soon™ Also… you should contribute! Last Takeaways
  • 26.
    Q&A Everything Atomic RedTeam is at: atomicredteam.io
  • 27.