MA
Uploaded byMITRE ATT&CK
949 views

ATT&CKing the Red/Blue Divide

The document discusses the integration of red and blue team efforts to enhance threat detection and response using the MITRE ATT&CK framework. It highlights the importance of community collaboration in curating analytics, reducing false positives, and improving the validation of security measures. The presentation introduces the SnapAttack community platform, aiming to provide open access to threat intelligence while fostering community contributions and better analytic robustness.

Technology◦
In this document
Powered by AI

Overview of the presentation and speakers from SnapAttack on bridging the Red and Blue team divide.

Discusses the agenda, goals, and motivations behind combining red and blue team efforts to improve threat detection.

Exploration of community threat research collaboration between red and blue teams through independent validation.

Focus on measuring false and true positives, validating MITRE ATT&CK coverage, and improving analytic outcomes.

Introduction to the platform for memorializing attacks and sharing within the community.

Details on the structure of the analytic library, its metadata, and the importance of curating analytics for false positive reduction.

Presentation of analytics statistics including Sigma queries and Atomic Red scripts to find quality community detections.

Methods for reducing false positives with validated hits and demonstrating community analytics effectiveness.

Presentation of ATT&CK technique counts and the effectiveness of Sigma queries in threat detection.

Investigation of analytic similarity for deduplication and auto-labeling, with examples and discussion on robustness.

Announcement of the free and open community platform with access to community content and tools for attack engagement.

Embed presentation

Downloaded 161 times
Attacking the Red vs Blue Divide MITRE ATT&CKcon 3.0 March 30, 2022
Copyright © 2021 Threatology, Inc #whoami Fred Frey CTO/Co-founder - SnapAttack 20+ years of red team + threat hunt ffrey@snapattack.com @fryguy2600 Jonathan Mulholland AI Director - SnapAttack 15 years experience in data analysis and scientific research jmulholland@snapattack.com
Agenda Talk Topics • Our approach: red and blue • Threat & analytics library • What is measured, gets improved! • Curating analytics • Better ATT&CK coverage estimates • Analytic robustness measures • SnapAttack Community Release Goals and Motivations Support community threat research efforts by: • Combining multiple red and blue community efforts together • Measuring and identifying community detection gaps • Empower searching and filtering attacks/analytics in a purpose-built platform
Community Threat Research Security Content Analytics Sentinel Use Cases Red Team Communities Blue Team Communities … wouldn't it be cool if we could combine and independently validate these efforts? Sigma
Red ↔ Blue: Particle Collider Particle Collider Propels charged particles at high speeds that smash against other particles. By studying these collisions, physicists are able to probe the world of the infinitely small.
Red ↔ Blue: Particle Collider Atomic Red T1059 -> T1218 -> T1047 -> T1003 -> T1105 -> T1055 -> <- T1059 <- T1218 <- T1047 <- T1003 <- T1105 <- T1055 Sigma Logs EDR, syslogs, application logs, PCAP / Zeek SnapAttack Propels malicious attacks at high speeds that smash against behavioral detection analytics. By studying these collisions, threat researchers are able to probe the world of the hackers.
Empowering Threat Research What can we measure with red and blue data? False Positives – Throw out overly false positive analytics and/or improve filtering True Positives Validation – Ensure it detects what you expect it to MITRE ATT&CK Coverage – Detect across the board, validate community labels Analytic Similarities – Find duplicate analytics, pick the best 1 2 3 4
Into the Platform
Threat and Analytic Library Video of Attack Attack Description Analytic Hit Details Analytic Timeline Memorialize attacks – share with the community
Threat and Analytic Library Validate "All the Things" CONFIDENTLY DEPLOY BLUE TEAM Creates analytics to detect RED TEAM Emulates / captures threat to validate Signature Metadata • Title / description / notes • MITRE ATT&CK mapping • Validation status • Confidence ranking • Exclusion filters • Link to true positive logs Threat Metadata • Title / description / notes • MITRE ATT&CK mapping • Security event logs • Threat intel report link • Labeled threats (ATT&CK + timestamp) ANALYTIC LIBRARY THREAT LIBRARY Undetected Attack Logs VALIDATED True Positive Untested Signatures
FALSE POSITIVE (Noise) TRUE POSITIVE (Validated hit) FALSE NEGATIVE (Undetected hit) Label Data Validation Criteria Blue and red marker must match either: • The same event log, or • +/- 5 seconds with the same ATT&CK technique or process ID Attack timeline with overlayed detection hits
Curating Analytics: False Positive Reduction
Curating Analytics ATOMIC SESSIONS • 1,840 Sigma queries • 322 distinct ATT&CK tags Sigma Community Analytics • 847 Atomic Red scripts • 379 attacks emulated in our lab • 182 distinct ATT&CK tags Atomic Red Scripts • Techniques: 188 • Sub-techniques: 379 ATT&CK Techniques Finding Quality Community Detections ATOMIC SESSIONS SIGMA QUERIES
Curating Analytics • Filter out noise • Identify the events of interest • This experiment is environment sensitive Our Particle Traces Collision! ATOMIC SESSIONS SIGMA QUERIES QUERY HIT
False Positives Removed • Analytic must have 1 - 20 connections on the graph • Analytics that miss are discarded Noise Filters • Results can't be obtained manually • Analytic that miss form a red team backlog (need to create a true positive attack example) Notes ATOMIC SESSIONS SIGMA QUERIES QUERY HIT
Reducing False Positives Example: Change Powershell Policies to an Unsecure Level • Hits every single Atomic Red session • Author's level and false positive entries are unreliable • Behavior is environment dependent, manual curation is impossible CommandLine: powershell.exe -ExecutionPolicy Bypass -File C:Program FilesAmazonEc2ConfigServiceScriptsDiscoverConsolePort.ps1 detection: option: CommandLine|contains: '-executionpolicy' level: CommandLine|contains: - 'Unrestricted' - 'bypass' - 'RemoteSigned' condition: option and level falsepositives: - Administrator script level: high Unanticipated query behavior False Positive Log Hit:
CRITICAL HIGH MEDIUM LOW 0.0 0.2 0.4 0.6 0.8 1.0 QUALITY SCORE Criticality Level Can't Be Trusted! • Is not based on your data • Author expertise is unknown Sigma Author's Assessment Conclusion • Risk = Probability x Severity • Sigma level field does not include probability • Probability can be obtained from real data or estimated using community data DISTRIBUTION OF ANALYTIC QUALITY FOR EACH CRITICALITY LEVEL Quality Score • The fraction of hits by a Sigma query that are validated (1.0 means all hits from an analytic were validated) coin flip whether the analytic is reliable Criticality vs. Analytic Quality
Curating Analytics: Analytic Validation
Analytic Validation • False positive reduction • Analytic must have a validated hit (true positive) Analytic Filters Winners! ATOMIC SESSIONS SIGMA QUERIES QUERY HIT Validation Criteria • Analytic hit and attack marker match the exact same event log, or • Analytic hit must be near (+/- 5 seconds) an attack marker and share a MITRE ATT&CK tag or process ID
Validated Analytics Atomic Sessions Dump LSASS.exe Memory using ProcDump Dump LSASS.exe Memory using comsvcs.dll Dump LSASS.exe Memory using direct system calls and API unhooking Create Mini Dump of LSASS.exe using ProcDump Dump LSASS.exe Memory using Out-Minidump.ps1 Cred Dump Tools Dropped Files LSASS Memory Dump File Creation LSASS Memory Dumping Procdump Usage Suspicious Use of Procdump LSASS Memory Dump Suspicious Use of Procdump on LSASS Lsass Memory Dump via Comsvcs DLL Dumpert Process Dumper LSASS Process Memory Dump Files Dumpert Process Dumper Process Dump via Comsvcs DLL Credentials Dumping Tools Accessing LSASS Memory Generic Password Dumper Activity on LSASS Accessing WinAPI in PowerShell for Credentials Dumping Sigma Queries ATOMIC SESSIONS SIGMA QUERIES QUERY HIT T1003.001: OS Credential Dumping: LSASS Memory
MITRE ATT&CK Coverage Estimate
False Positives Filter Validation Filter Unfiltered Sigma Queries: 129 Atomic Sessions: 127 Sigma Queries: 221 Atomic Sessions: 214 Sigma Queries: 1840 Atomic Sessions: 379 SIGMA 322 ATT&CK TECHNIQUES 567 Realistic ATT&CK Coverage ATT&CK TECHNIQUES 567 SIGMA 130 ATT&CK TECHNIQUES 567 SIGMA 115 Query / Session Counts ATT&CK Technique Coverage
Analytic Similarity
Analytic Similarity • Nerds: Projection of the bipartite network onto a single mode using hyperbolic weighting • Everyone Else: Finding similar/duplicate analytics Analytic Similarity Applications of Similarity Calculation • Deduplication • Auto labeling • Defense-in-depth Use unvalidated data to calculate correlations Disjoint of sets of most correlated analytics Projection showing Sigma query connectivity based on similar Atomic Red hits Leveraging Graph Data
Analytic Similarity Analytic Similarity • Nearly identical analytic • ATT&CK tag error Mavinject Inject DLL Into Running Process T1055.001 Process Injection: Dynamic-link Library Execution T1056.004 Inject Capture: Credential Hooking detection: selection: CommandLine|contains|all: - ' /INJECTRUNNING' - '.dll' OriginalFileName|contains: mavinject condition: selection Mavinject Process Injection T1055.001 Process Injection: Dynamic-link Library Execution T1218. Signed Binary Process Execution detection: selection: CommandLine|contains: ' /INJECTRUNNING ' condition: selection Example #1 – Result: Merge to improve
Analytic Similarity Analytic Similarity Suspicious Rundll32 Script in CommandLine T1218.011 Signed Binary Proxy Execution: Rundll32 detection: selection_run: CommandLine|contains|all: - rundll32 - 'mshtml,RunHTMLApplication' selection_script: CommandLine|contains: - 'javascript:' - 'vbscript:' condition: all of selection_* logsource: category: process_creation product: windows Example #2 – Result: Keep Both for robustness • Similar analytic and same tag • Defense-in-depth • Process logs • Network logs • Auto-labeling potential Rundll32 Internet Connection T1218.011 Signed Binary Proxy Execution: Rundll32 detection: selection: Image|endswith: 'rundll32.exe' Initiated: 'true' filter: - DestinationIp|startswith: - '10.' - '192.168.' - '172.16.' ... filter_microsoft: DestinationIp|startswith: - '51.124.' condition: selection and not 1 of filter* logsource: category: network_connection product: windows
Research Wrap-up CONFIDENTLY DEPLOY ANALYTIC LIBRARY THREAT LIBRARY Undetected Attack Logs VALIDATED True Positive Untested Signatures Collision Experiments Results • Curated set of validated analytics • Backlog of undetected Atomic Red sessions • Realistic MITRE ATT&CK coverage • Graph theory analytic similarity Released Today in SnapAttack Community Platform ATT&CK TECHNIQUES 567 SIGMA 115
SnapAttack – Community Platform • Forever free and open to the community • Access to all community content (including all Sigma analytics and Atomic Red attacks mentioned today) • Request contributor beta access (general availability in the next ~3-4 months) • Analytic IDE for creating and testing detections • Capture and share your own attacks Register Today or Request Contributor Beta Access https://www.snapattack.com/community We are launching our community edition today

More Related Content

PDF
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 
PDF
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
PDF
Threat Modelling - It's not just for developers
byMITRE ATT&CK
 
PDF
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
PDF
State of the ATT&CK
byMITRE ATT&CK
 
PDF
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
PDF
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
Threat Modelling - It's not just for developers
byMITRE ATT&CK
 
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
State of the ATT&CK
byMITRE ATT&CK
 
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 

What's hot

PDF
The ATT&CK Philharmonic
byMITRE ATT&CK
 
PDF
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
PDF
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
PDF
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK for ICS
byMITRE ATT&CK
 
PDF
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
PDF
ATT&CKING Containers in The Cloud
byMITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
PDF
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
byMITRE ATT&CK
 
PDF
ATT&CKcon Intro
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Framework
byn|u - The Open Security Community
 
PDF
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
byMITRE - ATT&CKcon
 
PDF
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
byJorge Orchilles
 
PPTX
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
PDF
Projects to Impact- Operationalizing Work from the Center
byMITRE ATT&CK
 
PDF
Evaluating and Enhancing Security Maturity through MITRE ATT&CK Mapping
byMITRE ATT&CK
 
PDF
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
byMITRE - ATT&CKcon
 
PDF
Introduction to MITRE ATT&CK
byArpan Raval
 
PDF
Purple Team Exercise Framework Workshop #PTEF
byJorge Orchilles
 
PDF
Sharpening your Threat-Hunting Program with ATTACK Framework
byMITRE - ATT&CKcon
 
The ATT&CK Philharmonic
byMITRE ATT&CK
 
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 
ATT&CK Updates- ATT&CK for ICS
byMITRE ATT&CK
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
ATT&CKING Containers in The Cloud
byMITRE ATT&CK
 
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
byMITRE ATT&CK
 
ATT&CKcon Intro
byMITRE ATT&CK
 
MITRE ATT&CK Framework
byn|u - The Open Security Community
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
byMITRE - ATT&CKcon
 
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
byJorge Orchilles
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
Projects to Impact- Operationalizing Work from the Center
byMITRE ATT&CK
 
Evaluating and Enhancing Security Maturity through MITRE ATT&CK Mapping
byMITRE ATT&CK
 
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
byMITRE - ATT&CKcon
 
Introduction to MITRE ATT&CK
byArpan Raval
 
Purple Team Exercise Framework Workshop #PTEF
byJorge Orchilles
 
Sharpening your Threat-Hunting Program with ATTACK Framework
byMITRE - ATT&CKcon
 

Similar to ATT&CKing the Red/Blue Divide

PPTX
ATT&CKing with Threat Intelligence
byChristopher Korban
 
PDF
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
 
PPTX
Leveraging MITRE ATT&CK - Speaking the Common Language
byErik Van Buggenhout
 
PPTX
Detection Rules Coverage
bySunny Neo
 
PDF
Cyber Threat hunting workshop
byArpan Raval
 
PPTX
Purple Teaming with ATT&CK - x33fcon 2018
byChristopher Korban
 
PPTX
Threat hunting in cyber world
byAkash Sarode
 
PDF
Telesoft Cyber Threat Hunting Infographic
bySarah Chandley
 
PPTX
How I Learned to Stop Information Sharing and Love the DIKW
bySounil Yu
 
PDF
ScotSecure West Summit 2024 - Glasgow 11th Sept
byRay Bugg
 
PDF
Data-Driven Threat Intelligence: Metrics on Indicator Dissemination and Sharing
byAlex Pinto
 
PPTX
Awalin-CapWIC
byAwalin Sopan
 
PPTX
2017 Q1 Arcticcon - Meet Up - Adventures in Adversarial Emulation
byScott Sutherland
 
PDF
IT Operation Analytic for security- MiSSconf(sp1)
bystelligence
 
PDF
Data Analytics in Cyber Security - Intellisys 2015 Keynote
byHPCC Systems
 
PDF
Conf 2019 - Workshop: Liam Glanfield - know your threat actor
byTechExeter
 
PDF
Security Consulting Services - Which Is The Best Option For Me? - Diego Sor, ...
byCore Security
 
PPTX
ITD BSides PDX Slides
byEricGoldstrom
 
PPTX
BSidesLV -The SOC Counter ATT&CK
byMathieu Saulnier
 
PDF
[cb22] Keynote: Underwhelmed: Making Sense of the Overwhelming Challenge of C...
byCODE BLUE
 
ATT&CKing with Threat Intelligence
byChristopher Korban
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
 
Leveraging MITRE ATT&CK - Speaking the Common Language
byErik Van Buggenhout
 
Detection Rules Coverage
bySunny Neo
 
Cyber Threat hunting workshop
byArpan Raval
 
Purple Teaming with ATT&CK - x33fcon 2018
byChristopher Korban
 
Threat hunting in cyber world
byAkash Sarode
 
Telesoft Cyber Threat Hunting Infographic
bySarah Chandley
 
How I Learned to Stop Information Sharing and Love the DIKW
bySounil Yu
 
ScotSecure West Summit 2024 - Glasgow 11th Sept
byRay Bugg
 
Data-Driven Threat Intelligence: Metrics on Indicator Dissemination and Sharing
byAlex Pinto
 
Awalin-CapWIC
byAwalin Sopan
 
2017 Q1 Arcticcon - Meet Up - Adventures in Adversarial Emulation
byScott Sutherland
 
IT Operation Analytic for security- MiSSconf(sp1)
bystelligence
 
Data Analytics in Cyber Security - Intellisys 2015 Keynote
byHPCC Systems
 
Conf 2019 - Workshop: Liam Glanfield - know your threat actor
byTechExeter
 
Security Consulting Services - Which Is The Best Option For Me? - Diego Sor, ...
byCore Security
 
ITD BSides PDX Slides
byEricGoldstrom
 
BSidesLV -The SOC Counter ATT&CK
byMathieu Saulnier
 
[cb22] Keynote: Underwhelmed: Making Sense of the Overwhelming Challenge of C...
byCODE BLUE
 

More from MITRE ATT&CK

PDF
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
PDF
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
PDF
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
PDF
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
PDF
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
PDF
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
PDF
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
PDF
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
PDF
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
PDF
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
PDF
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
PDF
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
PDF
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
PDF
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 

Recently uploaded

PPTX
"Feelings versus facts: why metrics are more important than intuition", Igor ...
byFwdays
 
PDF
ODSC AI West: Agent Optimization: Beyond Context engineering
byShashikant Jagtap
 
PDF
[BDD 2025 - Mobile Development] Exploring Apple’s On-Device FoundationModels
byWintari Yasmin
 
PDF
[BDD 2025 - Full-Stack Development] The Modern Stack: Building Web & AI Appli...
byWintari Yasmin
 
PDF
How Much Does It Cost to Build an eCommerce Website in 2025.pdf
byPixlogix Infotech
 
PDF
DUBAI IT MODERNIZATION WITH AZURE MANAGED SERVICES.pdf
byLogicEra
 
PDF
[DevFest Strasbourg 2025] - NodeJs Can do that !!
bymoassiongbon
 
PDF
MuleSoft Meetup: Dreamforce'25 Tour- Vibing With AI & Agents.pdf
byTintu Jacob Shaji
 
PDF
PCCC25（設立25年記念PCクラスタシンポジウム）：エヌビディア合同会社 テーマ２「NVIDIA BlueField-4 DPU」
byPC Cluster Consortium
 
PDF
Integrating AI with Meaningful Human Collaboration
byCadabra Studio
 
PDF
Parallel Computing BCS702 Module notes of the vtu college 7th sem 4.pdf
byMatheshVishnu
 
PPTX
The power of Slack and MuleSoft | Bangalore MuleSoft Meetup #60
byshyamraj55
 
PPTX
Leon Brands - Intro to GPU Occlusion (Graphics Programming Conference 2024)
byleonbrands1998
 
PDF
[BDD 2025 - Artificial Intelligence] AI for the Underdogs: Innovation for Sma...
byWintari Yasmin
 
PPTX
kernel PPT (Explanation of Windows Kernal).pptx
byINFOBYTES1
 
PDF
The Necessity of Digital Forensics, the Digital Forensics Process & Laborator...
bychrstnpetwinchester
 
PDF
"DISC as GPS for team leaders: how to lead a team from storming to performing...
byFwdays
 
PDF
Transcript: The partnership effect: Libraries and publishers on collaborating...
byBookNet Canada
 
PDF
Cybersecurity Prevention and Detection: Unit 2
byVICTOR MAESTRE RAMIREZ
 
PDF
How Much Does It Cost To Build Software
bycollinmishell2
 
"Feelings versus facts: why metrics are more important than intuition", Igor ...
byFwdays
 
ODSC AI West: Agent Optimization: Beyond Context engineering
byShashikant Jagtap
 
[BDD 2025 - Mobile Development] Exploring Apple’s On-Device FoundationModels
byWintari Yasmin
 
[BDD 2025 - Full-Stack Development] The Modern Stack: Building Web & AI Appli...
byWintari Yasmin
 
How Much Does It Cost to Build an eCommerce Website in 2025.pdf
byPixlogix Infotech
 
DUBAI IT MODERNIZATION WITH AZURE MANAGED SERVICES.pdf
byLogicEra
 
[DevFest Strasbourg 2025] - NodeJs Can do that !!
bymoassiongbon
 
MuleSoft Meetup: Dreamforce'25 Tour- Vibing With AI & Agents.pdf
byTintu Jacob Shaji
 
PCCC25（設立25年記念PCクラスタシンポジウム）：エヌビディア合同会社 テーマ２「NVIDIA BlueField-4 DPU」
byPC Cluster Consortium
 
Integrating AI with Meaningful Human Collaboration
byCadabra Studio
 
Parallel Computing BCS702 Module notes of the vtu college 7th sem 4.pdf
byMatheshVishnu
 
The power of Slack and MuleSoft | Bangalore MuleSoft Meetup #60
byshyamraj55
 
Leon Brands - Intro to GPU Occlusion (Graphics Programming Conference 2024)
byleonbrands1998
 
[BDD 2025 - Artificial Intelligence] AI for the Underdogs: Innovation for Sma...
byWintari Yasmin
 
kernel PPT (Explanation of Windows Kernal).pptx
byINFOBYTES1
 
The Necessity of Digital Forensics, the Digital Forensics Process & Laborator...
bychrstnpetwinchester
 
"DISC as GPS for team leaders: how to lead a team from storming to performing...
byFwdays
 
Transcript: The partnership effect: Libraries and publishers on collaborating...
byBookNet Canada
 
Cybersecurity Prevention and Detection: Unit 2
byVICTOR MAESTRE RAMIREZ
 
How Much Does It Cost To Build Software
bycollinmishell2
 

ATT&CKing the Red/Blue Divide

  • 1.
    Attacking the Redvs Blue Divide MITRE ATT&CKcon 3.0 March 30, 2022
  • 2.
    Copyright © 2021Threatology, Inc #whoami Fred Frey CTO/Co-founder - SnapAttack 20+ years of red team + threat hunt ffrey@snapattack.com @fryguy2600 Jonathan Mulholland AI Director - SnapAttack 15 years experience in data analysis and scientific research jmulholland@snapattack.com
  • 3.
    Agenda Talk Topics • Ourapproach: red and blue • Threat & analytics library • What is measured, gets improved! • Curating analytics • Better ATT&CK coverage estimates • Analytic robustness measures • SnapAttack Community Release Goals and Motivations Support community threat research efforts by: • Combining multiple red and blue community efforts together • Measuring and identifying community detection gaps • Empower searching and filtering attacks/analytics in a purpose-built platform
  • 4.
    Community Threat Research Security Content Analytics Sentinel UseCases Red Team Communities Blue Team Communities … wouldn't it be cool if we could combine and independently validate these efforts? Sigma
  • 5.
    Red ↔ Blue:Particle Collider Particle Collider Propels charged particles at high speeds that smash against other particles. By studying these collisions, physicists are able to probe the world of the infinitely small.
  • 6.
    Red ↔ Blue:Particle Collider Atomic Red T1059 -> T1218 -> T1047 -> T1003 -> T1105 -> T1055 -> <- T1059 <- T1218 <- T1047 <- T1003 <- T1105 <- T1055 Sigma Logs EDR, syslogs, application logs, PCAP / Zeek SnapAttack Propels malicious attacks at high speeds that smash against behavioral detection analytics. By studying these collisions, threat researchers are able to probe the world of the hackers.
  • 7.
    Empowering Threat Research Whatcan we measure with red and blue data? False Positives – Throw out overly false positive analytics and/or improve filtering True Positives Validation – Ensure it detects what you expect it to MITRE ATT&CK Coverage – Detect across the board, validate community labels Analytic Similarities – Find duplicate analytics, pick the best 1 2 3 4
  • 8.
  • 9.
    Threat and AnalyticLibrary Video of Attack Attack Description Analytic Hit Details Analytic Timeline Memorialize attacks – share with the community
  • 10.
    Threat and AnalyticLibrary Validate "All the Things" CONFIDENTLY DEPLOY BLUE TEAM Creates analytics to detect RED TEAM Emulates / captures threat to validate Signature Metadata • Title / description / notes • MITRE ATT&CK mapping • Validation status • Confidence ranking • Exclusion filters • Link to true positive logs Threat Metadata • Title / description / notes • MITRE ATT&CK mapping • Security event logs • Threat intel report link • Labeled threats (ATT&CK + timestamp) ANALYTIC LIBRARY THREAT LIBRARY Undetected Attack Logs VALIDATED True Positive Untested Signatures
  • 11.
    FALSE POSITIVE (Noise) TRUE POSITIVE (Validatedhit) FALSE NEGATIVE (Undetected hit) Label Data Validation Criteria Blue and red marker must match either: • The same event log, or • +/- 5 seconds with the same ATT&CK technique or process ID Attack timeline with overlayed detection hits
  • 12.
  • 13.
    Curating Analytics ATOMIC SESSIONS •1,840 Sigma queries • 322 distinct ATT&CK tags Sigma Community Analytics • 847 Atomic Red scripts • 379 attacks emulated in our lab • 182 distinct ATT&CK tags Atomic Red Scripts • Techniques: 188 • Sub-techniques: 379 ATT&CK Techniques Finding Quality Community Detections ATOMIC SESSIONS SIGMA QUERIES
  • 14.
    Curating Analytics • Filterout noise • Identify the events of interest • This experiment is environment sensitive Our Particle Traces Collision! ATOMIC SESSIONS SIGMA QUERIES QUERY HIT
  • 15.
    False Positives Removed •Analytic must have 1 - 20 connections on the graph • Analytics that miss are discarded Noise Filters • Results can't be obtained manually • Analytic that miss form a red team backlog (need to create a true positive attack example) Notes ATOMIC SESSIONS SIGMA QUERIES QUERY HIT
  • 16.
    Reducing False Positives Example:Change Powershell Policies to an Unsecure Level • Hits every single Atomic Red session • Author's level and false positive entries are unreliable • Behavior is environment dependent, manual curation is impossible CommandLine: powershell.exe -ExecutionPolicy Bypass -File C:Program FilesAmazonEc2ConfigServiceScriptsDiscoverConsolePort.ps1 detection: option: CommandLine|contains: '-executionpolicy' level: CommandLine|contains: - 'Unrestricted' - 'bypass' - 'RemoteSigned' condition: option and level falsepositives: - Administrator script level: high Unanticipated query behavior False Positive Log Hit:
  • 17.
    CRITICAL HIGH MEDIUM LOW 0.0 0.2 0.40.6 0.8 1.0 QUALITY SCORE Criticality Level Can't Be Trusted! • Is not based on your data • Author expertise is unknown Sigma Author's Assessment Conclusion • Risk = Probability x Severity • Sigma level field does not include probability • Probability can be obtained from real data or estimated using community data DISTRIBUTION OF ANALYTIC QUALITY FOR EACH CRITICALITY LEVEL Quality Score • The fraction of hits by a Sigma query that are validated (1.0 means all hits from an analytic were validated) coin flip whether the analytic is reliable Criticality vs. Analytic Quality
  • 18.
  • 19.
    Analytic Validation • Falsepositive reduction • Analytic must have a validated hit (true positive) Analytic Filters Winners! ATOMIC SESSIONS SIGMA QUERIES QUERY HIT Validation Criteria • Analytic hit and attack marker match the exact same event log, or • Analytic hit must be near (+/- 5 seconds) an attack marker and share a MITRE ATT&CK tag or process ID
  • 20.
    Validated Analytics Atomic Sessions DumpLSASS.exe Memory using ProcDump Dump LSASS.exe Memory using comsvcs.dll Dump LSASS.exe Memory using direct system calls and API unhooking Create Mini Dump of LSASS.exe using ProcDump Dump LSASS.exe Memory using Out-Minidump.ps1 Cred Dump Tools Dropped Files LSASS Memory Dump File Creation LSASS Memory Dumping Procdump Usage Suspicious Use of Procdump LSASS Memory Dump Suspicious Use of Procdump on LSASS Lsass Memory Dump via Comsvcs DLL Dumpert Process Dumper LSASS Process Memory Dump Files Dumpert Process Dumper Process Dump via Comsvcs DLL Credentials Dumping Tools Accessing LSASS Memory Generic Password Dumper Activity on LSASS Accessing WinAPI in PowerShell for Credentials Dumping Sigma Queries ATOMIC SESSIONS SIGMA QUERIES QUERY HIT T1003.001: OS Credential Dumping: LSASS Memory
  • 21.
  • 22.
    False Positives FilterValidation Filter Unfiltered Sigma Queries: 129 Atomic Sessions: 127 Sigma Queries: 221 Atomic Sessions: 214 Sigma Queries: 1840 Atomic Sessions: 379 SIGMA 322 ATT&CK TECHNIQUES 567 Realistic ATT&CK Coverage ATT&CK TECHNIQUES 567 SIGMA 130 ATT&CK TECHNIQUES 567 SIGMA 115 Query / Session Counts ATT&CK Technique Coverage
  • 23.
  • 24.
    Analytic Similarity • Nerds:Projection of the bipartite network onto a single mode using hyperbolic weighting • Everyone Else: Finding similar/duplicate analytics Analytic Similarity Applications of Similarity Calculation • Deduplication • Auto labeling • Defense-in-depth Use unvalidated data to calculate correlations Disjoint of sets of most correlated analytics Projection showing Sigma query connectivity based on similar Atomic Red hits Leveraging Graph Data
  • 25.
    Analytic Similarity Analytic Similarity •Nearly identical analytic • ATT&CK tag error Mavinject Inject DLL Into Running Process T1055.001 Process Injection: Dynamic-link Library Execution T1056.004 Inject Capture: Credential Hooking detection: selection: CommandLine|contains|all: - ' /INJECTRUNNING' - '.dll' OriginalFileName|contains: mavinject condition: selection Mavinject Process Injection T1055.001 Process Injection: Dynamic-link Library Execution T1218. Signed Binary Process Execution detection: selection: CommandLine|contains: ' /INJECTRUNNING ' condition: selection Example #1 – Result: Merge to improve
  • 26.
    Analytic Similarity Analytic Similarity SuspiciousRundll32 Script in CommandLine T1218.011 Signed Binary Proxy Execution: Rundll32 detection: selection_run: CommandLine|contains|all: - rundll32 - 'mshtml,RunHTMLApplication' selection_script: CommandLine|contains: - 'javascript:' - 'vbscript:' condition: all of selection_* logsource: category: process_creation product: windows Example #2 – Result: Keep Both for robustness • Similar analytic and same tag • Defense-in-depth • Process logs • Network logs • Auto-labeling potential Rundll32 Internet Connection T1218.011 Signed Binary Proxy Execution: Rundll32 detection: selection: Image|endswith: 'rundll32.exe' Initiated: 'true' filter: - DestinationIp|startswith: - '10.' - '192.168.' - '172.16.' ... filter_microsoft: DestinationIp|startswith: - '51.124.' condition: selection and not 1 of filter* logsource: category: network_connection product: windows
  • 27.
    Research Wrap-up CONFIDENTLY DEPLOY ANALYTICLIBRARY THREAT LIBRARY Undetected Attack Logs VALIDATED True Positive Untested Signatures Collision Experiments Results • Curated set of validated analytics • Backlog of undetected Atomic Red sessions • Realistic MITRE ATT&CK coverage • Graph theory analytic similarity Released Today in SnapAttack Community Platform ATT&CK TECHNIQUES 567 SIGMA 115
  • 28.
    SnapAttack – CommunityPlatform • Forever free and open to the community • Access to all community content (including all Sigma analytics and Atomic Red attacks mentioned today) • Request contributor beta access (general availability in the next ~3-4 months) • Analytic IDE for creating and testing detections • Capture and share your own attacks Register Today or Request Contributor Beta Access https://www.snapattack.com/community We are launching our community edition today