MA
Uploaded byMITRE ATT&CK
PDF, PPTX578 views

It's just a jump to the left (of boom): Prioritizing detection implementation with intelligence and ATT&CK

The document discusses the implementation of behavioral detections in cybersecurity using intelligence and the ATT&CK framework as a guiding methodology. It highlights the importance of bridging operational intelligence with security controls to effectively counter threats, including a case study demonstrating the proactive development of detection rules based on emerging malware. Additionally, it emphasizes the classification of threats and tactics, providing resources to guide cybersecurity teams in prioritizing detection efforts.

Embed presentation

Download as PDF, PPTX
It’s Just a Jump To The Left (of Boom) Prioritizing Detection Implementation With Intelligence and ATT&CK
Introduction Lindsay Kaye Director, Operational Outcomes, Insikt Group Recorded Future @TheQueenofELF Scott Small Threat Intelligence Consultant Recorded Future @IntelScott
Nearly 600 techniques & sub-techniques 9,000+ detection rules, 2,100+ tests
For defenders, deciding where to start when implementing behavioral detections can be daunting Ideally, a “best practice” approach involves closing the gap between existing controls and relevant threats - but this is easier said than done Background
Intelligence as a Bridge
Intelligence as a Bridge Assets, IP, PII Technology, Processes Bridge between External & Internal Bridge between Offense & Defense (Threats & Controls) Intelligence- Informed Control Validation Bridge between Strategic & Tactical Threat Security Controls
Different sources provide different operational value Coverage across the entire attack chain ATT&CK hierarchy Layer behavior groupings to identify overlap Emerging Tools & TTPs Closed Sources Open Sources Technical Sourcing Emerging Tools & TTPs Open-sourced tools are routinely used by bad actors Validate controls against these TTPs for a proactive posture Closed Sources High-tier criminal & special access forums TTPs used to gain illicit network access Internal telemetry, alerts, hunting, sandbox, proprietary sourcing Open Sources Government & vendor reporting, social media (researchers), publicly reported events & incident analyses Technical Sourcing Publicly accessible malware sandbox results Behavioral analysis More proactive More reactive Sourcing TTP-Focused Intelligence
Lateral Movement, Discovery, Privilege Escalation, Persistence, Reconnaissance Case Study: Anatomy of a Ransomware Attack Initial Access Exfiltrate Data Drop Ransomware Cobalt Strike Active Directory Enumeration RClone 7Zip Phishing Exploits VPN appliances Credential Harvesting Stolen Credentials MEGA.nz Other Purchased Accesses Domain Access Living off the Land Kerberoasting WinSCP ←Lots of opportunity for detections here
ATT&CK serves as a common language between highly technical concepts or reports and defenders’/operators’ needs Intel driving rule development (Insikt’s process) Open Source Data Closed Source Data Technical Sources Insikt Group’s Tools and TTPs Team “TTP Note” Insikt Validated TTP Aligned to ATT&CK!
Case Study: Intelligence Driving Rule Development We saw a threat actor “release” Jester Stealer on the dark web in August 2021 - produced a “note” Then, in January 2022, we saw a user on social media shared a sample of Jester Stealer on MalwareBazaar….
Now that Jester Stealer was openly in use, an Insikt Validated TTP was created to provide a Sigma rule to our clients, to help detect the malware Case Study: Intelligence Driving Rule Development
One month later, other vendors identified Jester Stealer as a priority threat Case Study: Intelligence Driving Rule Development
Intelligence-Informed Detection Development Top Techniques in Threat Intel & Our Rules
Top Techniques in Emerging Tools & TTP Reports Top Techniques in Insikt Sigma Rules T1562.001: Disable or Modify Tools T1059.003: Windows Command Shell T1518.001: Security Software Discovery T1562.001: Disable or Modify Tools T1547.001: Registry Run Keys / Startup Folder T1543.003: Windows Service T1555.003: Credentials from Web Browsers T1070.004: File Deletion T1070.004: File Deletion T1547.001: Registry Run Keys / Startup Folder T1059.001: PowerShell T1518.001: Security Software Discovery T1548.002: Bypass User Account Control T1204.002: Malicious File T1056.001: Keylogging T1059.001: PowerShell T1037.005: Startup Items T1555.003: Credentials from Web Browsers T1027.002: Software Packing T1555.001: Keychain T1574.002: DLL Side-Loading T1552.004: Private Keys T1059.003: Windows Command Shell T1003.008: /etc/passwd and /etc/shadow T1204.002: Malicious File T1003.007: Proc Filesystem T1552.001: Credentials In Files T1003.005: Cached Domain Credentials T1564.001: Hidden Files and Directories T1003.004: LSA Secrets Indicates technique is present in both sets Intelligence-Informed Detection Development
Emerging Tools & TTPs: Intelligence Summary Other Top Malware Categories: Loaders, Worms, Keyloggers, Cryptominers, Spyware, Rootkits, Packers, Exploit & DDOS Kits, Adware Threat Actor Categories: Advanced Cybercriminal (24%), Ransomware (18%), Russia APT (12%), China APT (6%), Iran APT (6%), APT - Unknown affiliation (6%), Hacktivist (3%) Top 15 Techniques: Malware & Actor Clustering
Visibility (Data Sources) Resources, Maturity, & Bandwidth (affects validation frequency) Threat Profile / Model Actual Control Coverage Threat Profile / Model Prioritizing Detections: Risk Profiling
Prioritizing Detections: A Compass to Guide You controlcompass.github.io Open source tool pointing cybersecurity teams to 9,000+ publicly-accessible detection rules and 2,100+ offensive security tests, aligned with over 500 ATT&CK (sub)techniques
controlcompass. github.io
Th&nk You!

More Related Content

PDF
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
PDF
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 
PDF
Threat Modelling - It's not just for developers
byMITRE ATT&CK
 
PDF
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
PDF
State of the ATT&CK
byMITRE ATT&CK
 
PDF
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
PDF
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
PDF
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 
Threat Modelling - It's not just for developers
byMITRE ATT&CK
 
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
State of the ATT&CK
byMITRE ATT&CK
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 

What's hot

PDF
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
PDF
Projects to Impact- Operationalizing Work from the Center
byMITRE ATT&CK
 
PDF
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 
PDF
The ATT&CK Philharmonic
byMITRE ATT&CK
 
PDF
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
PDF
When Insiders ATT&CK!
byMITRE ATT&CK
 
PDF
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
byMITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK for ICS
byMITRE ATT&CK
 
PDF
ATT&CKING Containers in The Cloud
byMITRE ATT&CK
 
PDF
ATT&CKcon Intro
byMITRE ATT&CK
 
PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
PDF
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
byKatie Nickels
 
PDF
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
 
PPTX
Effective Threat Hunting with Tactical Threat Intelligence
byDhruv Majumdar
 
PPTX
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
PDF
Cyber Threat hunting workshop
byArpan Raval
 
PPTX
Bsides 2019 - Intelligent Threat Hunting
byDhruv Majumdar
 
PDF
How MITRE ATT&CK helps security operations
bySergey Soldatov
 
PDF
Welcome to the world of Cyber Threat Intelligence
byAndreas Sfakianakis
 
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
Projects to Impact- Operationalizing Work from the Center
byMITRE ATT&CK
 
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 
The ATT&CK Philharmonic
byMITRE ATT&CK
 
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
When Insiders ATT&CK!
byMITRE ATT&CK
 
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
byMITRE ATT&CK
 
ATT&CK Updates- ATT&CK for ICS
byMITRE ATT&CK
 
ATT&CKING Containers in The Cloud
byMITRE ATT&CK
 
ATT&CKcon Intro
byMITRE ATT&CK
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
byKatie Nickels
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
 
Effective Threat Hunting with Tactical Threat Intelligence
byDhruv Majumdar
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
Cyber Threat hunting workshop
byArpan Raval
 
Bsides 2019 - Intelligent Threat Hunting
byDhruv Majumdar
 
How MITRE ATT&CK helps security operations
bySergey Soldatov
 
Welcome to the world of Cyber Threat Intelligence
byAndreas Sfakianakis
 

Similar to It's just a jump to the left (of boom): Prioritizing detection implementation with intelligence and ATT&CK

PDF
ScotSecure West Summit 2024 - Glasgow 11th Sept
byRay Bugg
 
PPTX
Jim Wojno: Incident Response - No Pain, No Gain!
bycentralohioissa
 
PDF
Caccia alle Minacce: Intelligence e Hunting nel cyberspace
bySpeck&Tech
 
PDF
Purple Team Use Case - Security Weekly
byJorge Orchilles
 
PDF
Pitfalls of Cyber Data
byPhil Huggins FBCS CITP
 
PPTX
Paranoia 2018: A Process is No One
byJared Atkinson
 
PPTX
Detection Rules Coverage
bySunny Neo
 
PDF
How To Turbo-Charge Incident Response With Threat Intelligence
byResilient Systems
 
PPTX
Operationalizing Security Intelligence
bySplunk
 
PDF
Exploring the Defender's Advantage
byRaffael Marty
 
PDF
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
byMITRE - ATT&CKcon
 
PPTX
Actionable Threat Intelligence
byOWASP Delhi
 
PDF
Sans cyber-threat-intelligence-survey-2015
byRoy Ramkrishna
 
PDF
RED-TEAM_Conclave
byNSConclave
 
PDF
MITRE ATT&CKcon 2.0: Keynote Address - The Friends We Made Along the Way; Ton...
byMITRE - ATT&CKcon
 
PPTX
How To Turbo-Charge Incident Response With Threat Intelligence
byResilient Systems
 
DOC
Cyber Threat Intelligence - Staying Ahead of Attacks.doc
byTCCI Computer Coaching
 
PDF
Data-Driven Threat Intelligence: Metrics on Indicator Dissemination and Sharing
byAlex Pinto
 
PDF
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
PPTX
How Threat Intelligence Fuels a Modern SOC
bywininlifeacademy5
 
ScotSecure West Summit 2024 - Glasgow 11th Sept
byRay Bugg
 
Jim Wojno: Incident Response - No Pain, No Gain!
bycentralohioissa
 
Caccia alle Minacce: Intelligence e Hunting nel cyberspace
bySpeck&Tech
 
Purple Team Use Case - Security Weekly
byJorge Orchilles
 
Pitfalls of Cyber Data
byPhil Huggins FBCS CITP
 
Paranoia 2018: A Process is No One
byJared Atkinson
 
Detection Rules Coverage
bySunny Neo
 
How To Turbo-Charge Incident Response With Threat Intelligence
byResilient Systems
 
Operationalizing Security Intelligence
bySplunk
 
Exploring the Defender's Advantage
byRaffael Marty
 
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
byMITRE - ATT&CKcon
 
Actionable Threat Intelligence
byOWASP Delhi
 
Sans cyber-threat-intelligence-survey-2015
byRoy Ramkrishna
 
RED-TEAM_Conclave
byNSConclave
 
MITRE ATT&CKcon 2.0: Keynote Address - The Friends We Made Along the Way; Ton...
byMITRE - ATT&CKcon
 
How To Turbo-Charge Incident Response With Threat Intelligence
byResilient Systems
 
Cyber Threat Intelligence - Staying Ahead of Attacks.doc
byTCCI Computer Coaching
 
Data-Driven Threat Intelligence: Metrics on Indicator Dissemination and Sharing
byAlex Pinto
 
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
How Threat Intelligence Fuels a Modern SOC
bywininlifeacademy5
 

More from MITRE ATT&CK

PDF
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
PDF
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
PDF
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
PDF
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
PDF
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
PDF
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
PDF
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
PDF
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
PDF
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
PDF
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
PDF
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
PDF
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
PDF
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 
PDF
ATT&CK From Basic Principles - Tareq AlKhatib
byMITRE ATT&CK
 
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 
ATT&CK From Basic Principles - Tareq AlKhatib
byMITRE ATT&CK
 

Recently uploaded

PDF
[BDD 2025 - Artificial Intelligence] Building AI Systems That Users (and Comp...
byWintari Yasmin
 
PDF
[BDD 2025 - Mobile Development] Crafting Immersive UI with E2E and AGSL Shade...
byWintari Yasmin
 
PDF
[BDD 2025 - Artificial Intelligence] AI for the Underdogs: Innovation for Sma...
byWintari Yasmin
 
PDF
KMWorld - KM & AI Bring Collectivity, Nostalgia, & Selectivity
byJonathan Ralton
 
PDF
10 Best Automation QA Testing Software Tools in 2025.pdf
byRohitBhandari66
 
PDF
The partnership effect: Libraries and publishers on collaborating and thrivin...
byBookNet Canada
 
PDF
Lets Build a Serverless Function with Kiro
byChris Bingham
 
PDF
Transcript: The partnership effect: Libraries and publishers on collaborating...
byBookNet Canada
 
PDF
How Much Does It Cost to Build an eCommerce Website in 2025.pdf
byPixlogix Infotech
 
PDF
Cheryl Hung, Vibe Coding Auth Without Melting Down! isaqb Software Architectu...
byCheryl Hung
 
PDF
Mulesoft Meetup Online Portuguese: MCP e IA
byPedro Baroni
 
PPTX
Support, Monitoring, Continuous Improvement & Scaling Agentic Automation [3/3]
byUiPathCommunity
 
PDF
Open Source Post-Quantum Cryptography - Matt Caswell
byAll Things Open
 
PDF
Top Crypto Supers 15th Report November 2025
byStephen Perrenod
 
PDF
DUBAI IT MODERNIZATION WITH AZURE MANAGED SERVICES.pdf
byLogicEra
 
PDF
[BDD 2025 - Full-Stack Development] Digital Accessibility: Why Developers nee...
bywintari3
 
PDF
Agentic Intro and Hands-on: Build your first Coded Agent
byUiPathCommunity
 
PDF
[BDD 2025 - Mobile Development] Exploring Apple’s On-Device FoundationModels
byWintari Yasmin
 
PDF
So You Want to Work at Google | DevFest Seattle 2025
byMargaret Maynard-Reid
 
PDF
[BDD 2025 - Mobile Development] Mobile Engineer and Software Engineer: Are we...
bywintari3
 
[BDD 2025 - Artificial Intelligence] Building AI Systems That Users (and Comp...
byWintari Yasmin
 
[BDD 2025 - Mobile Development] Crafting Immersive UI with E2E and AGSL Shade...
byWintari Yasmin
 
[BDD 2025 - Artificial Intelligence] AI for the Underdogs: Innovation for Sma...
byWintari Yasmin
 
KMWorld - KM & AI Bring Collectivity, Nostalgia, & Selectivity
byJonathan Ralton
 
10 Best Automation QA Testing Software Tools in 2025.pdf
byRohitBhandari66
 
The partnership effect: Libraries and publishers on collaborating and thrivin...
byBookNet Canada
 
Lets Build a Serverless Function with Kiro
byChris Bingham
 
Transcript: The partnership effect: Libraries and publishers on collaborating...
byBookNet Canada
 
How Much Does It Cost to Build an eCommerce Website in 2025.pdf
byPixlogix Infotech
 
Cheryl Hung, Vibe Coding Auth Without Melting Down! isaqb Software Architectu...
byCheryl Hung
 
Mulesoft Meetup Online Portuguese: MCP e IA
byPedro Baroni
 
Support, Monitoring, Continuous Improvement & Scaling Agentic Automation [3/3]
byUiPathCommunity
 
Open Source Post-Quantum Cryptography - Matt Caswell
byAll Things Open
 
Top Crypto Supers 15th Report November 2025
byStephen Perrenod
 
DUBAI IT MODERNIZATION WITH AZURE MANAGED SERVICES.pdf
byLogicEra
 
[BDD 2025 - Full-Stack Development] Digital Accessibility: Why Developers nee...
bywintari3
 
Agentic Intro and Hands-on: Build your first Coded Agent
byUiPathCommunity
 
[BDD 2025 - Mobile Development] Exploring Apple’s On-Device FoundationModels
byWintari Yasmin
 
So You Want to Work at Google | DevFest Seattle 2025
byMargaret Maynard-Reid
 
[BDD 2025 - Mobile Development] Mobile Engineer and Software Engineer: Are we...
bywintari3
 
In this document
Powered by AI

Introduction to the presentation and speakers discussing the importance of detection implementation in cybersecurity.

Overview of nearly 600 techniques and 9,000+ detection rules, focusing on the challenges in implementing effective behavioral detections.

Explains how intelligence can bridge the gap between offense and defense, enhancing security controls and threat management.

Different sources of intelligence provide varying operational value, stressing the need for validation against TTPs in a proactive cybersecurity posture.

Detailed case study of ransomware attacks and the evolution of threats like Jester Stealer, demonstrating rule development based on intelligence.

Insight into top techniques in threat intelligence and corresponding Insikt Sigma rules, showing common tactics used by threat actors.

Summary of emerging malware categories and threat actor profiles, highlighting critical techniques utilized in cyber threats.

Discusses factors influencing detection prioritization, emphasizing resource management, threat profiles, and maturity.

Final thoughts and acknowledgment, urging continued focus on improving detection frameworks in cybersecurity.

It's just a jump to the left (of boom): Prioritizing detection implementation with intelligence and ATT&CK

  • 1.
    It’s Just aJump To The Left (of Boom) Prioritizing Detection Implementation With Intelligence and ATT&CK
  • 2.
    Introduction Lindsay Kaye Director, OperationalOutcomes, Insikt Group Recorded Future @TheQueenofELF Scott Small Threat Intelligence Consultant Recorded Future @IntelScott
  • 3.
    Nearly 600 techniques& sub-techniques 9,000+ detection rules, 2,100+ tests
  • 4.
    For defenders, decidingwhere to start when implementing behavioral detections can be daunting Ideally, a “best practice” approach involves closing the gap between existing controls and relevant threats - but this is easier said than done Background
  • 5.
  • 6.
    Intelligence as aBridge Assets, IP, PII Technology, Processes Bridge between External & Internal Bridge between Offense & Defense (Threats & Controls) Intelligence- Informed Control Validation Bridge between Strategic & Tactical Threat Security Controls
  • 7.
    Different sources providedifferent operational value Coverage across the entire attack chain ATT&CK hierarchy Layer behavior groupings to identify overlap Emerging Tools & TTPs Closed Sources Open Sources Technical Sourcing Emerging Tools & TTPs Open-sourced tools are routinely used by bad actors Validate controls against these TTPs for a proactive posture Closed Sources High-tier criminal & special access forums TTPs used to gain illicit network access Internal telemetry, alerts, hunting, sandbox, proprietary sourcing Open Sources Government & vendor reporting, social media (researchers), publicly reported events & incident analyses Technical Sourcing Publicly accessible malware sandbox results Behavioral analysis More proactive More reactive Sourcing TTP-Focused Intelligence
  • 8.
    Lateral Movement, Discovery, Privilege Escalation, Persistence, Reconnaissance CaseStudy: Anatomy of a Ransomware Attack Initial Access Exfiltrate Data Drop Ransomware Cobalt Strike Active Directory Enumeration RClone 7Zip Phishing Exploits VPN appliances Credential Harvesting Stolen Credentials MEGA.nz Other Purchased Accesses Domain Access Living off the Land Kerberoasting WinSCP ←Lots of opportunity for detections here
  • 9.
    ATT&CK serves asa common language between highly technical concepts or reports and defenders’/operators’ needs Intel driving rule development (Insikt’s process) Open Source Data Closed Source Data Technical Sources Insikt Group’s Tools and TTPs Team “TTP Note” Insikt Validated TTP Aligned to ATT&CK!
  • 10.
    Case Study: IntelligenceDriving Rule Development We saw a threat actor “release” Jester Stealer on the dark web in August 2021 - produced a “note” Then, in January 2022, we saw a user on social media shared a sample of Jester Stealer on MalwareBazaar….
  • 11.
    Now that JesterStealer was openly in use, an Insikt Validated TTP was created to provide a Sigma rule to our clients, to help detect the malware Case Study: Intelligence Driving Rule Development
  • 12.
    One month later,other vendors identified Jester Stealer as a priority threat Case Study: Intelligence Driving Rule Development
  • 13.
    Intelligence-Informed Detection Development TopTechniques in Threat Intel & Our Rules
  • 14.
    Top Techniques inEmerging Tools & TTP Reports Top Techniques in Insikt Sigma Rules T1562.001: Disable or Modify Tools T1059.003: Windows Command Shell T1518.001: Security Software Discovery T1562.001: Disable or Modify Tools T1547.001: Registry Run Keys / Startup Folder T1543.003: Windows Service T1555.003: Credentials from Web Browsers T1070.004: File Deletion T1070.004: File Deletion T1547.001: Registry Run Keys / Startup Folder T1059.001: PowerShell T1518.001: Security Software Discovery T1548.002: Bypass User Account Control T1204.002: Malicious File T1056.001: Keylogging T1059.001: PowerShell T1037.005: Startup Items T1555.003: Credentials from Web Browsers T1027.002: Software Packing T1555.001: Keychain T1574.002: DLL Side-Loading T1552.004: Private Keys T1059.003: Windows Command Shell T1003.008: /etc/passwd and /etc/shadow T1204.002: Malicious File T1003.007: Proc Filesystem T1552.001: Credentials In Files T1003.005: Cached Domain Credentials T1564.001: Hidden Files and Directories T1003.004: LSA Secrets Indicates technique is present in both sets Intelligence-Informed Detection Development
  • 15.
    Emerging Tools &TTPs: Intelligence Summary Other Top Malware Categories: Loaders, Worms, Keyloggers, Cryptominers, Spyware, Rootkits, Packers, Exploit & DDOS Kits, Adware Threat Actor Categories: Advanced Cybercriminal (24%), Ransomware (18%), Russia APT (12%), China APT (6%), Iran APT (6%), APT - Unknown affiliation (6%), Hacktivist (3%) Top 15 Techniques: Malware & Actor Clustering
  • 16.
    Visibility (Data Sources) Resources, Maturity,& Bandwidth (affects validation frequency) Threat Profile / Model Actual Control Coverage Threat Profile / Model Prioritizing Detections: Risk Profiling
  • 17.
    Prioritizing Detections: ACompass to Guide You controlcompass.github.io Open source tool pointing cybersecurity teams to 9,000+ publicly-accessible detection rules and 2,100+ offensive security tests, aligned with over 500 ATT&CK (sub)techniques
  • 18.
  • 19.