MITRE ATT&CK Updates: Enterprise - Casey Knerr

MITRE ATT&CK® Updates:
Enterprise
Casey Knerr, ATT&CK Enterprise Lead, MITRE
© 2024 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 24-00779-13.

whoami
Casey Knerr
ATT&CK for Enterprise Lead
and...
• Cybersecurity engineer
• Cloud + web security enthusiast
• Collector of hobbies

These are the voyages…
(What have we been working on for v16?)

Cloud Platforms
Infrastructure as a Service
Software as a Service
Azure AD
Office 365
Google Workspace

Cloud Platforms
Azure AD
Office 365
Google Workspace
Identity Provider
Office Suite

Why?
• There’s more than one identity-as-service platform!
• Okta
• Ping Identity
• JumpCloud
• OneLogin
• etc.
• Office 365 ≈ Google Workspace

V15 Updates: By popular demand

V15 Updates: An Oldie but a Goodie

V15 Updates: A Breakup…

To Boldly Go…
(What are we planning to do next?)

Least Spicy: Content Updates
• Focus on Linux and Network
• More content
• More CTI
• Fill in the gaps

Medium Spicy: Metadata Refactor
Supports Remote
Permissions Required
Effective Permissions
Defense Bypassed
Impact Type
Accurate?
Consistently Applied?
Standardized?
Are these…
Useful?

Very Spicy: Another Breakup…

Very Spicy: Another breakup…
• Defense Evasion is very big
• Could it be smaller?
One of these things is not like
the others…
© 2024 The MITRE Corporation. All rights reserved. Approved for public release.
Distribution unlimited 24-00779-13.

Very Spicy: Another Breakup…
• Defense Evasion is really big
• Can we tear it apart?
• Evading detections versus mitigations?

Unclear Spicy: What is this?
Mandiant observed an unusual behavior by UNC5174
following their initial access on the compromised appliance.
After backdoor accounts were configured, they attempted to
self-patch the vulnerability using an F5-provided mitigation
script "mitigation.sh".Mandiant assesses that this was an
attempt to limit subsequent exploitation of the system by
additional unrelated threat actors attempting to access the
appliance.
https://cloud.google.com/blog/topics/threat-intelligence/initial-access-brokers-exploit-f5-screenconnect

The clean_cron function’s script makes the cron files mutable
and removes all the existing cron jobs from /etc/crontab,
/var/spool/cron, /etc/cron.d, and /var/spool/cron/crontabs to
disrupt the existing malware functionalities, as well as the
legitimate system functionalities.
https://www.trendmicro.com/en_us/research/22/j/teamtnt-returns-or-does-it.html

First, the threat actor creates a new user role with login
capability and high privileges.…Then, the current user
postgres is stripped of superuser privileges.This restricts the
privileges of other threat actors who might still gain access to
the system via the weak password.
https://www.aquasec.com/blog/pg_mem-a-malware-hidden-in-the-postgres-processes/

• Evading other threat actors rather than victim
• Patching vulnerabilities
• Killing malicious processes / cron jobs
• Removing privileges
• Changing credentials
• Closing ports
• Not quite Defense Evasion as currently scoped

How you can help
• Do you have Linux or Network CTI?
• Are you using the metadata fields currently?
• How do you feel about changes to Defense Evasion?
• Do you have CTI for ~weird~ not-quite-defense-evasion behavior?
• Do you have any other comments / complaints / questions?
attack@mitre.org
@MITREattack

https://attack.mitre.org
attack@mitre.org
@mitreattack
Casey Knerr

MITRE ATT&CK Updates: Enterprise - Casey Knerr

More Related Content

Similar to MITRE ATT&CK Updates: Enterprise - Casey Knerr

More from MITRE ATT&CK

Recently uploaded

MITRE ATT&CK Updates: Enterprise - Casey Knerr