Downloaded 50 times
More Related Content
Similar to Driving Intelligence with MITRE ATT&CK: Leveraging Limited Resources to Build an Evolving Threat Repository
Driving Intelligence with MITRE ATT&CK: Leveraging Limited Resources to Build an Evolving Threat Repository
- 1. Scott J Roberts Headof Threat Research 2023-10-25 Leveraging Limited Resources to Build an Evolving Threat Repository Driving Intelligence with MITRE ATT&CK
- 2. Scott J Roberts Headof Threat Research at Interpres
- 3. What Interpres Does Defense Readiness 01 Defense Surface Optimization 02 Prioritize Vulnerabilities 03 Stack& Product Rationalization 04
- 4.
- 5. MITRE ATT&CK forInternal Customers Interpres is Intel driven from the core. Built originally on public threat intelligence data straight from mitre/cti. Needed custom threat data to keep up.
- 6. Metrics for ThreatResearch at Interpres Depth Breadth Speed Accuracy
- 7. Goals • Code First:git push or bust • Depth: Collection Requirements • Breadth: Collection Requirements • Speed: Automation • Accuracy: Automation & Manual Review • Compatibility: Output to STIX2
- 8. The Problem (Well…3!!!)
- 9. STIX2 != ATT&CK&& ATT&CK != STIX2
- 10. We want MITRE Intelligence& Interpres Intelligence… with as little duplication as possible!
- 11.
- 12.
- 13. STIX2 != ATT&CK&& ATT&CK != STIX2 ATT&CK Tactics Techniques Groups Software Campaigns STIX2 Attack- Pattern Attack- Pattern Intrusion-Set Malware (Usually…) Campaigns ATT&CK to STIX2
- 14. STIX2 != ATT&CK&& ATT&CK != STIX2
- 15. We want MITREIntelligence & Interpres Intelligence… with as little duplication as possible!
- 16. We want MITREIntelligence & Interpres Intelligence… with as little duplication as possible! • Wherever possible we use MITRE ATT&CK Content - Exclusively using MITRE ATT&CK Techniques - Leverage MITRE ATT&CK Groups, Malware, Campaigns, & Relationships • Build custom Groups, Malware, Campaigns & Relationships - Based on internal research, RFIs, etc - More on that a bit later • Relationships are intelligently divided between MITRE/CTI & Intrepres/CTI • DANGER (But Available): All lookups prioritize Interpres/CTI
- 17. An Aside fora Good Name™
- 18. Tooling is Limited •All content is code (STIX2) and created with code - Automated: Custom Automapper (Let computer do what computers are good at) - By Hand Creation & Curation: Jupyter Notebooks + STIX2 Library • Actively working on STIX2 Helper Library - Merging, Bulk Actions, etc - Testing Mapping Scenarios • Git is workflow management • Yes, we looked at Decider, TRAM, & ATT&CK Workbench
- 19. Advantages of IntelligenceAs Code: CI Error
- 20. Advantages of IntelligenceAs Code: CI Error
- 21. Advantages of IntelligenceAs Code: Solutions as Code
- 22. Advantages of IntelligenceAs Code: CI
- 23. Advantages of IntelligenceAs Code: CI
- 24. The Future There are limitationsof STIX2 Library & Jupyter Notebooks Synapse is code for Intelligence & Easier to Extend Continue leveraging STIX2 for Compatibility & Tooling
- 25. Salvador Dali “Have nofear of perfection – you’ll never reach it.”
- 26.
- 27.