MA
Uploaded byMITRE ATT&CK
PDF, PPTX122 views

MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik

The document outlines MITRE ATT&CK CTI's goals to enhance the understanding of the threat landscape, focusing on expanding geographic and actor representation. It emphasizes the importance of accurately capturing state-directed threats, crimeware groups, and critical malware, while acknowledging the challenges of covering the vast array of adversary tools. Additionally, it highlights the need to utilize campaign objects more effectively for representing long-running groups and ecrime operations.

Embed presentation

Download as PDF, PPTX
MITRE ATT&CK® Updates: CTI – Path Forward Joe Slowik, ATT&CK CTI Lead, MITRE @jfslowik /joe-slowik © 2024 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 24-00134-12.
Overall ATT&CK CTI Goals Capture The RELEVANT Threat Landscape In A TIMELY Fashion* Work To Improve Coverage On Additional Geographies & ECrime Actors Leverage Campaign Objects For More Accurate Representation Of How Activity Changes Over Time © 2024 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 24-00134-12.
Defining ATT&CK CTI Groups Software Campaigns © 2024 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 24-00134-12.
Group Priorities APT • Continue Capturing New & Emerging State- Directed Threats • Ensure ATT&CK Has Most Up-To-Date Info As Possible Crimeware • Continue Expanding Representation Of Crimeware Entities • Work To Disambiguate Between Groups, Software, & Campaigns © 2024 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 24-00134-12.
Software Priorities • Ensure Important, Unique Malware Is Captured In ATT&CK • Expand Coverage Of Stealers & Intermediate Tools • Hard Decisions Necessary Given Sheer Volume Of Adversary Tooling Malware • Improve Coverage Of Ransomware Families • Actual Technical Interest Is Low As Capabilities Are Fairly Consistent • However, High Levels Of Industry Demand Ransomware • Capture Relevant Non-Malware Tools Used In Intrusions • RMM Tools Are A Tricky Area - Lots Of Them, We'll Never Cover Them All! Tools & Utilities © 2024 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 24-00134-12.
Campaign Priorities Campaigns Remain Underutilized In ATT&CK, This Will Be Changing Including Modifying Community Submissions Into Campaign Objects Problem With Long-Running Groups Where They Increasingly Seem To Use "All Techniques" As Updates Are Applied Murky Relationships Among Multiple Actors In ECrime Operations Make Campaign Representation Often More Applicable Than Explicit Groups © 2024 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 24-00134-12.
https://attack.mitre.org attack@mitre.org @mitreattack Joe Slowik @jfslowik /joe-slowik © 2024 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 24-00134-12.

More Related Content

PDF
Leveraging Campaigns to Untangle the Threat Group Ship of Theseus
byAdam Pennington
 
PDF
State of ATT&CK
byAdam Pennington
 
PDF
Picking Up the Pieces: How Campaigns Can Help Us Better Track Groups
byAdam Pennington
 
PDF
ATT&CK Updates- Campaigns
byMITRE ATT&CK
 
PPTX
Leveraging MITRE ATT&CK - Speaking the Common Language
byErik Van Buggenhout
 
PDF
Introduction to MITRE’s ATT&CK Framework.pdf
byseyohah504
 
PDF
MITRE ATT&CK Updates: New Ideas in Enterprise - Pushing the boundaries of ATT...
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Software
byMITRE ATT&CK
 
Leveraging Campaigns to Untangle the Threat Group Ship of Theseus
byAdam Pennington
 
State of ATT&CK
byAdam Pennington
 
Picking Up the Pieces: How Campaigns Can Help Us Better Track Groups
byAdam Pennington
 
ATT&CK Updates- Campaigns
byMITRE ATT&CK
 
Leveraging MITRE ATT&CK - Speaking the Common Language
byErik Van Buggenhout
 
Introduction to MITRE’s ATT&CK Framework.pdf
byseyohah504
 
MITRE ATT&CK Updates: New Ideas in Enterprise - Pushing the boundaries of ATT...
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Software
byMITRE ATT&CK
 

Similar to MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik

PDF
(SACON) Wayne Tufek - chapter five - attacks
byPriyanka Aash
 
PPTX
Enterprise-MITRE-ATTandCK-Threat-Hunting _ Updated.pptx
byBheemeshChowdary2
 
PDF
State of the ATT&CK May 2023
byAdam Pennington
 
PPTX
Leverage Endpooint Visibilit with MITRE ATT&CK Framework
byDigit Oktavianto
 
PDF
MITRE A-TAK Design Philosophy
bytom termini
 
PDF
MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)
byMITRE ATT&CK
 
PDF
Mitre ATT&CK by Mattias Almeflo Nixu
byNixu Corporation
 
PDF
MITRE Engenuity Center for Threat Informed Defense Impact Report 2022.pdf
byAdamAzrylJohan
 
PDF
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
PDF
Best practices fore MITRE EMERSON EDUARDO RODRIGUES
byEMERSON EDUARDO RODRIGUES
 
PDF
RED-TEAM_Conclave
byNSConclave
 
PPTX
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
byHarry McLaren
 
PPTX
MITRE ATT&CK framework
byBhushan Gurav
 
PDF
Using the MITRE ATT&CK framework to analyze real-world cyberattacks
bylucytyrteos
 
PDF
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
byMITRE - ATT&CKcon
 
PPTX
ATT&CKing with Threat Intelligence
byChristopher Korban
 
PDF
Cyber Threat hunting workshop
byArpan Raval
 
PDF
Projects to Impact- Operationalizing Work from the Center
byMITRE ATT&CK
 
PDF
MITRE ATTACKcon Power Hour - October
byMITRE - ATT&CKcon
 
PPT
NetWitness
byTechBiz Forense Digital
 
(SACON) Wayne Tufek - chapter five - attacks
byPriyanka Aash
 
Enterprise-MITRE-ATTandCK-Threat-Hunting _ Updated.pptx
byBheemeshChowdary2
 
State of the ATT&CK May 2023
byAdam Pennington
 
Leverage Endpooint Visibilit with MITRE ATT&CK Framework
byDigit Oktavianto
 
MITRE A-TAK Design Philosophy
bytom termini
 
MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)
byMITRE ATT&CK
 
Mitre ATT&CK by Mattias Almeflo Nixu
byNixu Corporation
 
MITRE Engenuity Center for Threat Informed Defense Impact Report 2022.pdf
byAdamAzrylJohan
 
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
Best practices fore MITRE EMERSON EDUARDO RODRIGUES
byEMERSON EDUARDO RODRIGUES
 
RED-TEAM_Conclave
byNSConclave
 
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
byHarry McLaren
 
MITRE ATT&CK framework
byBhushan Gurav
 
Using the MITRE ATT&CK framework to analyze real-world cyberattacks
bylucytyrteos
 
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
byMITRE - ATT&CKcon
 
ATT&CKing with Threat Intelligence
byChristopher Korban
 
Cyber Threat hunting workshop
byArpan Raval
 
Projects to Impact- Operationalizing Work from the Center
byMITRE ATT&CK
 
MITRE ATTACKcon Power Hour - October
byMITRE - ATT&CKcon
 
NetWitness
byTechBiz Forense Digital
 

More from MITRE ATT&CK

PDF
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
PDF
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
PDF
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
PDF
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
PDF
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
PDF
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
PDF
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
PDF
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
PDF
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
PDF
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
PDF
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
PDF
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
PDF
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 
PDF
ATT&CK From Basic Principles - Tareq AlKhatib
byMITRE ATT&CK
 
PDF
Lifecycle-Aware Power Side-Channel Malware Detection - Alexander Cathis
byMITRE ATT&CK
 
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 
ATT&CK From Basic Principles - Tareq AlKhatib
byMITRE ATT&CK
 
Lifecycle-Aware Power Side-Channel Malware Detection - Alexander Cathis
byMITRE ATT&CK
 

Recently uploaded

PDF
Antminer S23Hyd-580_Manual-V1.1-oneminers.pdf
byFranzhLawrenceBataan1
 
PPTX
PPTX game guess the logo with a twistppt
byAdrianAnig
 
PDF
Poročilo odbora CIS (CH08873) za leto 2025 na letni skupščini IEEE Slovenija ...
byUniversity of Maribor
 
PDF
Escape from the Forbidden Zone: Smuggling green and inclusive tech past the g...
byBookNet Canada
 
PDF
The Manifesto for AI-enabled Governance !
byYannis Charalabidis
 
PDF
UiPath Modern Automation Playbook -Session 2
bysuhanisingh58689
 
PDF
GTM-and-Sales-Plan for a cyber security product
byAshish Jangir
 
PDF
TrustArc Webinar - From Trends to Action: Fitting AI Governance into Privacy Ops
byTrustArc
 
PDF
Traditional-Security-Models-No-Longer-Work.pptx (1).pdf
byOhhproJunction
 
PPTX
Workflow and decision Automation with Flowable
bychakib ch
 
PDF
Founder & Tech Lead | Web Development & Digital Growth Consultant | Helping B...
byShyamal Das
 
PDF
Explaining the flow of purpose-specific BOM
byakipii ogaoga
 
PDF
Explaining specific examples of purpose-specific BOM
byakipii ogaoga
 
PDF
The Emergence of Empathic XR: AWE Asia 2026 keynote
byMark Billinghurst
 
PPTX
apidays Paris 2025 | Integration is Feminist: Building Peace in Distributed S...
byapidays
 
PDF
20260212 Security-JAWS activity results for 2025 and activity goals for 2026
byTyphon 666
 
PDF
Security-Fails-in-the-Gaps-Between-Systems.pptx.pdf
byOhhproJunction
 
PDF
How to Install XRDP on CentOS 10 .pdf
byGreen Webpage
 
PPTX
TravelTech Paris 2025 | Beyond the pipes: Why Channel Management isn’t really...
byapidays
 
PDF
How does MES(Manufacturing Execution System) work?
byakipii ogaoga
 
Antminer S23Hyd-580_Manual-V1.1-oneminers.pdf
byFranzhLawrenceBataan1
 
PPTX game guess the logo with a twistppt
byAdrianAnig
 
Poročilo odbora CIS (CH08873) za leto 2025 na letni skupščini IEEE Slovenija ...
byUniversity of Maribor
 
Escape from the Forbidden Zone: Smuggling green and inclusive tech past the g...
byBookNet Canada
 
The Manifesto for AI-enabled Governance !
byYannis Charalabidis
 
UiPath Modern Automation Playbook -Session 2
bysuhanisingh58689
 
GTM-and-Sales-Plan for a cyber security product
byAshish Jangir
 
TrustArc Webinar - From Trends to Action: Fitting AI Governance into Privacy Ops
byTrustArc
 
Traditional-Security-Models-No-Longer-Work.pptx (1).pdf
byOhhproJunction
 
Workflow and decision Automation with Flowable
bychakib ch
 
Founder & Tech Lead | Web Development & Digital Growth Consultant | Helping B...
byShyamal Das
 
Explaining the flow of purpose-specific BOM
byakipii ogaoga
 
Explaining specific examples of purpose-specific BOM
byakipii ogaoga
 
The Emergence of Empathic XR: AWE Asia 2026 keynote
byMark Billinghurst
 
apidays Paris 2025 | Integration is Feminist: Building Peace in Distributed S...
byapidays
 
20260212 Security-JAWS activity results for 2025 and activity goals for 2026
byTyphon 666
 
Security-Fails-in-the-Gaps-Between-Systems.pptx.pdf
byOhhproJunction
 
How to Install XRDP on CentOS 10 .pdf
byGreen Webpage
 
TravelTech Paris 2025 | Beyond the pipes: Why Channel Management isn’t really...
byapidays
 
How does MES(Manufacturing Execution System) work?
byakipii ogaoga
 

MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik

  • 1.
    MITRE ATT&CK® Updates: CTI– Path Forward Joe Slowik, ATT&CK CTI Lead, MITRE @jfslowik /joe-slowik © 2024 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 24-00134-12.
  • 2.
    Overall ATT&CK CTIGoals Capture The RELEVANT Threat Landscape In A TIMELY Fashion* Work To Improve Coverage On Additional Geographies & ECrime Actors Leverage Campaign Objects For More Accurate Representation Of How Activity Changes Over Time © 2024 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 24-00134-12.
  • 3.
    Defining ATT&CK CTI GroupsSoftware Campaigns © 2024 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 24-00134-12.
  • 4.
    Group Priorities APT • ContinueCapturing New & Emerging State- Directed Threats • Ensure ATT&CK Has Most Up-To-Date Info As Possible Crimeware • Continue Expanding Representation Of Crimeware Entities • Work To Disambiguate Between Groups, Software, & Campaigns © 2024 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 24-00134-12.
  • 5.
    Software Priorities • EnsureImportant, Unique Malware Is Captured In ATT&CK • Expand Coverage Of Stealers & Intermediate Tools • Hard Decisions Necessary Given Sheer Volume Of Adversary Tooling Malware • Improve Coverage Of Ransomware Families • Actual Technical Interest Is Low As Capabilities Are Fairly Consistent • However, High Levels Of Industry Demand Ransomware • Capture Relevant Non-Malware Tools Used In Intrusions • RMM Tools Are A Tricky Area - Lots Of Them, We'll Never Cover Them All! Tools & Utilities © 2024 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 24-00134-12.
  • 6.
    Campaign Priorities Campaigns RemainUnderutilized In ATT&CK, This Will Be Changing Including Modifying Community Submissions Into Campaign Objects Problem With Long-Running Groups Where They Increasingly Seem To Use "All Techniques" As Updates Are Applied Murky Relationships Among Multiple Actors In ECrime Operations Make Campaign Representation Often More Applicable Than Explicit Groups © 2024 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 24-00134-12.
  • 7.
    https://attack.mitre.org attack@mitre.org @mitreattack Joe Slowik @jfslowik /joe-slowik © 2024The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 24-00134-12.