Michael Gough, profile picture
Uploaded byMichael Gough
PDF, PPTX3,713 views

MITRE AttACK framework it is time you took notice_v1.0

The document discusses the importance of the MITRE ATT&CK framework in enhancing cybersecurity practices, emphasizing its role in identifying security gaps and improving defense mechanisms based on actual adversary behaviors. It outlines how ATT&CK acts as a baseline for security improvements, allowing organizations to map their tools and capabilities against known tactics and techniques. Additionally, resources such as cheat sheets and tools for mapping and hunting within the ATT&CK framework are provided to assist security professionals in their efforts to fortify defenses.

Technology◦
Related topics:
Blue Team• Incident Response• Information Security•
In this document
Powered by AI

Introduction to MITRE ATT&CK framework, importance of awareness, and context for the discussion.

Discussion on the importance of knowing what to look for in cybersecurity, mapping defenses, and potential budget implications.

Overview of the MITRE ATT&CK model, its purpose, tactics, and the extensive resource it offers.

Need for foundational security practices to achieve comprehensive coverage and focus on high-impact areas.

Examination of Credential Access tactics and techniques within ATT&CK and their implications for cybersecurity.

Mapping application security tools and practices to MITRE ATT&CK for better risk management.

Instructions on mapping various detection, prevention, and logging activities directly to MITRE ATT&CK.

Using the ATT&CK matrix to identify cyber capabilities and gaps related to expected adversary tactics.

Introduction of various tools and resources available for implementing and using the ATT&CK framework.

Strategies for effective threat hunting, utilizing the ATT&CK framework, and emphasizing its importance in cybersecurity.

Wrap-up of presentation, inviting questions and providing resources for further engagement.

Embed presentation

Download as PDF, PPTX
Mitre ATT&CK is for all of us, and it is time to pay attention to it Michael Gough – Co-Founder IMFSecurity.com LOG-MD.com
Whoami • Blue Team Defender Ninja, Incident Responder, Logaholic • Creator of all those “Windows Logging Cheat Sheets” and the Malware Management Framework • Including LOG-MD and Windows Logging ATT&CK cheat sheets • Co-Creator of “Log-MD” – The Log and Malicious Discovery Tool • Co-Host – “Brakeing Down Incident Response” LOG-MD.com
HOMEWORK LOG-MD.com
There is more than this talk • But we only have 50 minutes • Brakeing Down Incident Response Podcast – Episode 007 BDIRPodcast.com – https://www.imfsecurity.com/podcasts/2018/9/16/bd ir-podcast-episode-007 • SANS Threat Hunting and Incident Response Summit New Orleans 2018 – My talk and many others covered ATT&CK, find the PDF’s and videos as SANS releases them • MITRE ATT&CKcon is this week !!! – I was invited, but I am here educating my peeps LOG-MD.com
Why do we care? • People ask me all the time • “How do you know what to look for”? – Experience – Because Hacker Hurricane said so ;-) – The Malware Management Framework • Reports that show what the bad guys actually did • So how or what do we map our defenses to? – PCI? – OWASP? – Compliance XYZ? – Because InfoSec or WebAppSec says so? LOG-MD.com
Why do we care? • If you can identify your gaps • Whether a consultant or an employee • You can define potential budget needs • You may have to admit a tool is not mapping well, so an opportunity to recommend a replacement that has better coverage • Budget re-allocation is always a bonus • The goal is to IMPROVE your security posture LOG-MD.com
Why do we care? • ATT&CK is your new baseline • You heard me • We FINALLY have a goal of what to achieve • Map to ATT&CK and you WILL pass or exceed any and all compliance requirements if you are doing them! • Forget the Cyber Kill Chain – https://www.lockheedmartin.com/en- us/capabilities/cyber/cyber-kill-chain.html • ATT&CK is more detailed at what you should detect… along the Cyber Kill Chain LOG-MD.com
What is ATT&CK ? LOG-MD.com
MITRE ATT&CK • MITRE’s Adversarial Tactics, Techniques, & Common Knowledge (ATT&CK™) is a curated knowledge base and model for cyber adversary behavior, reflecting the various phases of an adversary’s lifecycle and the platforms they are known to target. • ATT&CK is useful for understanding security risk against known adversary behavior, for planning security improvements, and verifying defenses work as expected. LOG-MD.com
ATT&CK Tactics and Techniques • 11 Tactics • 283 Techniques • Covers the following Operating Systems – Windows – MAC OS – Linux LOG-MD.com 11
Why care about ATT&CK • It is HUGE… extensive information of what the adversaries actually do to YOUR systems LOG-MD.com
ATT&CK requires some ‘Back to Basics’ to achieve “Totality” MalwareArchaeology.com
Achieve Totality Coverage - Asset Management • Can you see every host? • Do you have ghost assets? • Remote systems (Road Warriors) • Powered down VM’s/Systems • IP Scan all devices and identify the OS Completeness - Deployment • Are your agent(s) installed and running properly Configuration – System Settings • Are the systems configured correctly • Enable all that you want and expect MalwareArchaeology.com Coverage Completeness Configuration
80/20 rule • A VERY important point is we need to ignore or not worry about the 20% that you don’t, or can’t cover. • Don’t get hung up on the 20% or you will continue to flounder • Worry about the 80% you CAN or COULD do • You have to learn to walk before you worry about trying to be, or cover 100% (run) • Being good at 80% should be a goal • You will improve over time as you get better • It’s really more 74%-26% – You must accept more false positives to reach 80% or higher (Devon Kerr EndGame) MalwareArchaeology.com
Let’s Look at an Example MalwareArchaeology.com
Credential Access • Tactic - Credential Access – Guessing – Cred Dump – Keystroke logging – Off the wire LOG-MD.com
Technique – Brute Force • Technique ID – T1110 • Tactic – Credential Access • Lists Platforms • Shows Data Sources LOG-MD.com
Examples – More Data • Groups that used it • Tools or kits • Good for background information • Read the reports (aka Malware Management) and on the actors campaign(s) LOG-MD.com
ATT&CK Provides Guidance • Mitigation examples • Detection examples • References • You must translate them into what Processes, Procedures, Products you have LOG-MD.com
What about APPSEC? How does this apply to us? MalwareArchaeology.com
Map your capabilities to ATT&CK • Map the tools you have to the ATT&CK Matrix • This will give you a place to start and a way to track and rate your activities MalwareArchaeology.com
Sample of ATT&CK and Applications LOG-MD.com
Mitre Att@ck • This is a good place to start and map all your detection, prevention, and hunt activities to • Not enough details as to how – You will need to map them – Or find someone that has, maybe a product(s) • Add your Web Proxy • Add your WAF • Add your IPS • Add Network tools • Add code scanners • Fill any other gaps • Of course…. ADD YOUR LOGGING !!! MalwareArchaeology.com
Mitre Att@ck - Logging Let’s look at Windows Logging, my personal favorite • Most Techniques can be mapped to logging • Add Log Management • Add some Sysmon or WLS to the logs for more details • Add LOG-MD-Pro, and other tools or script(s) • Add a solution to query the OS ( I love BigFix) • Add Network tools • Fill other gaps • See the previous slide for application stuff MalwareArchaeology.com
Map your capabilities to ATT&CK • The Windows ATT&CK Logging Cheat Sheet • 11 Tactics and 187 Techniques mapped to Windows Event IDs MalwareArchaeology.com
Map your capabilities to ATT&CK • The Windows LOG-MD ATT&CK Cheat Sheet • 11 Tactics and 187 Techniques mapped to Windows Event IDs, LOG-MD, and Sysmon MalwareArchaeology.com
Find your Gaps, and Strengths • By filling out the ATT&CK matrix to YOUR capabilities, you begin to understand what you CAN and CAN NOT do against the actual tactics and techniques the bad guys use against you • I was shocked, I mean SHOCKED at how much I do in Windows logging mapped to actual tactics and techniques • But then again I have been practicing Malware Management since I created it over 6 years ago LOG-MD.com
Example Suspicious PowerShell Hunt MalwareArchaeology.com
How do I Hunt for PS? • Without Log Management? • Or with it, we consume LOG-MD-Pro logs into Log Management too MalwareArchaeology.com
TOOLS LOG-MD.com
What is available to you • MITRE ATT&CK Navigator • You select items you have, select colors and export it LOG-MD.com
ATT&CK Navigator • ATT&CK Navigator – Https://mitre.github.io/attack-navigator/enterprise/ • Mobile too – https://mitre.github.io/attack-navigator/mobile/ • Pre-ATT&CK – https://attack.mitre.org/pre-attack/index.php/Main_Page LOG-MD.com
SOCPrime LOG-MD.com
SOCPrime • TDM – Threat Detection Marketplace • SIGMA Rules – Generic Signature Format for SIEM Systems • ATT&CK mappings • Lots of log solution options • Convert from one platform to another • SIGMA rule convertor • Subscription service to gain access • Some free SIGMA based rules LOG-MD.com
Tools • Unfetter – https://nsacyber.github.io/unfetter/ – https://mitre.github.io/unfetter/getting-started/ • Tanium – https://www.tanium.com/blog/getting-started-with- the-mitre-attack-framework-improving-detection- capabilities/ • SIGMA – https://github.com/Neo23x0/sigma – https://github.com/Neo23x0/sigma/wiki/Specification LOG-MD.com
API • MITRE has an API for ATT&CK – https://attack.mitre.org/wiki/Using_the_API • Cyb3rWarD0g – Invoke-ATTACKAPI – https://github.com/Cyb3rWard0g/Invoke-ATTACKAPI • https://github.com/annamcabee/Mitre-Attack-API Mitre Pre-ATT&CK Mappings • https://github.com/rmusser01/Infosec_Reference/tree/master/Dra ft/ATT%26CK-Stuff • Blog on Brute Force example with ATT&CK – https://thehackerwhorolls.blogspot.com/2018/10/home-lab-att-use- case.html LOG-MD.com
RECOMMENDATIONS LOG-MD.com
HUNT ! • Some say create a hypothesis • I say start by eliminating things you CAN hunt for and know you do NOT have • Then build more hypothesis • Map your capabilities to ATT&CK • For Windows logging and LOG-MD there are 2 Cheat Sheets mapped to ATT&CK – MalwareArchaeology.com/cheat-sheets LOG-MD.com
Conclusion • MITRE ATT&CK is GREAT stuff • It gives you a way to measure what you have and can detect, based on what your adversaries ACTUALLY do, not what compliance, an auditor or consultant says • You don’t have to get very detailed at first • Use simple coloring at first – Green (good), Yellow (needs work), Red (poor), no color (we got nuttin) • Expand it once you map it • Then expand as you rate your capabilities • But get to know this framework! LOG-MD.com
Additional Reading This Is the Fastest Way to Hunt Windows Endpoints – https://www.slideshare.net/Hackerhurricane/mwarch- fastestwaytohuntonwindowsv101 – SANS will post the video at some point SANS THIR 2018 PDF’s and videos Most of the talks had ATT&CK involved Quantify your hunt not your parents red teaming Devon Kerr – https://www.youtube.com/watch?v=w_kByDwB6J0 Quantify Your Hunt: Not Your Parents' Red Team– Devon and Roberto – https://www.sans.org/summit-archives/file/summit-archive- 1536351477.pdf Finding Related ATT&CK Techniques – https://medium.com/mitre-attack/finding-related-att-ck-techniques- f1a4e8dfe2b6 LOG-MD.com
Questions • You can find us on the Twitters – @HackerHurricane • LOG-MD.com • MalwareArchaeology.com • Preso will be on SlideShare and linked on MalwareArchaeology.com • Listen to the PodCast to hear the rest of this topic – BDIRPodcast.com LOG-MD.com

More Related Content

PPTX
Bsides 2019 - Intelligent Threat Hunting
byDhruv Majumdar
 
PPTX
Cyber Threat Hunting Workshop
byDigit Oktavianto
 
PDF
Adversary Emulation and Red Team Exercises - EDUCAUSE
byJorge Orchilles
 
PDF
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
PPTX
Leveraging MITRE ATT&CK - Speaking the Common Language
byErik Van Buggenhout
 
PDF
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
byMITRE - ATT&CKcon
 
PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
PDF
Threat Hunting with Splunk Hands-on
bySplunk
 
Bsides 2019 - Intelligent Threat Hunting
byDhruv Majumdar
 
Cyber Threat Hunting Workshop
byDigit Oktavianto
 
Adversary Emulation and Red Team Exercises - EDUCAUSE
byJorge Orchilles
 
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
Leveraging MITRE ATT&CK - Speaking the Common Language
byErik Van Buggenhout
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
byMITRE - ATT&CKcon
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
Threat Hunting with Splunk Hands-on
bySplunk
 

What's hot

PDF
Cyber Threat hunting workshop
byArpan Raval
 
PDF
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 
PPTX
Threat hunting - Every day is hunting season
byBen Boyd
 
PPTX
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
PDF
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
byKatie Nickels
 
PPTX
Threat Hunting with Splunk Hands-on
bySplunk
 
PPTX
Threat hunting for Beginners
bySKMohamedKasim
 
PPTX
What is Threat Hunting? - Panda Security
byPanda Security
 
PDF
The ATT&CK Philharmonic
byMITRE ATT&CK
 
PDF
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
PDF
Threat Hunting
bySplunk
 
PDF
Threat Intelligence 101 - Steve Lodin - Submitted
bySteve Lodin
 
PDF
Threat hunting 101 by Sandeep Singh
byOWASP Delhi
 
PPTX
Effective Threat Hunting with Tactical Threat Intelligence
byDhruv Majumdar
 
PDF
PHDays 2018 Threat Hunting Hands-On Lab
byTeymur Kheirkhabarov
 
PDF
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
PDF
Threat Hunting Report
byMorane Decriem
 
PDF
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
PDF
SOC Architecture - Building the NextGen SOC
byPriyanka Aash
 
PDF
Building an InfoSec RedTeam
byDan Vasile
 
Cyber Threat hunting workshop
byArpan Raval
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 
Threat hunting - Every day is hunting season
byBen Boyd
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
byKatie Nickels
 
Threat Hunting with Splunk Hands-on
bySplunk
 
Threat hunting for Beginners
bySKMohamedKasim
 
What is Threat Hunting? - Panda Security
byPanda Security
 
The ATT&CK Philharmonic
byMITRE ATT&CK
 
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
Threat Hunting
bySplunk
 
Threat Intelligence 101 - Steve Lodin - Submitted
bySteve Lodin
 
Threat hunting 101 by Sandeep Singh
byOWASP Delhi
 
Effective Threat Hunting with Tactical Threat Intelligence
byDhruv Majumdar
 
PHDays 2018 Threat Hunting Hands-On Lab
byTeymur Kheirkhabarov
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
Threat Hunting Report
byMorane Decriem
 
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
SOC Architecture - Building the NextGen SOC
byPriyanka Aash
 
Building an InfoSec RedTeam
byDan Vasile
 

Similar to MITRE AttACK framework it is time you took notice_v1.0

PDF
How MITRE ATT&CK helps security operations
bySergey Soldatov
 
PPTX
MITRE ATT&CK framework
byBhushan Gurav
 
PPTX
ATT&CKing with Threat Intelligence
byChristopher Korban
 
PDF
MITRE-Module 2 Slides.pdf
byReZa AdineH
 
PDF
The top 10 windows logs event id's used v1.0
byMichael Gough
 
PDF
MW_Arch Fastest_way_to_hunt_on_Windows_v1.01
byMichael Gough
 
PDF
Windows Incident Response is hard, but doesn't have to be
byMichael Gough
 
PDF
Can_We_Really_Detect_These_So_Called_Sophisticated_Attacks?
byMichael Gough
 
PDF
Sophisticated Attacks - Can We Really Detect Them _v1.2.pdf
byMichael Gough
 
PPTX
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
byHarry McLaren
 
PDF
MITRE ATT&CKcon Power Hour - November
byMITRE - ATT&CKcon
 
PDF
MITRE-Module 1 Slides.pdf
byReZa AdineH
 
PDF
Best practices fore MITRE EMERSON EDUARDO RODRIGUES
byEMERSON EDUARDO RODRIGUES
 
PDF
Introduction to MITRE’s ATT&CK Framework.pdf
byseyohah504
 
PDF
Mitre getting-started-with-attack-october-2019
byThang Nguyen
 
PDF
MITRE ATTACKcon Power Hour - October
byMITRE - ATT&CKcon
 
PPTX
Presentazione tesi magistrale procentese.pptx
byAntonioProcentese1
 
PDF
MITRE_ATTACK_Enterprise_11x17.pdf
byAisyiFree
 
PDF
MITRE-Module 4 Slides.pdf
byReZa AdineH
 
PDF
One Technique, Two Techniques, Red Technique, Blue Technique
byDaniel Weiss
 
How MITRE ATT&CK helps security operations
bySergey Soldatov
 
MITRE ATT&CK framework
byBhushan Gurav
 
ATT&CKing with Threat Intelligence
byChristopher Korban
 
MITRE-Module 2 Slides.pdf
byReZa AdineH
 
The top 10 windows logs event id's used v1.0
byMichael Gough
 
MW_Arch Fastest_way_to_hunt_on_Windows_v1.01
byMichael Gough
 
Windows Incident Response is hard, but doesn't have to be
byMichael Gough
 
Can_We_Really_Detect_These_So_Called_Sophisticated_Attacks?
byMichael Gough
 
Sophisticated Attacks - Can We Really Detect Them _v1.2.pdf
byMichael Gough
 
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
byHarry McLaren
 
MITRE ATT&CKcon Power Hour - November
byMITRE - ATT&CKcon
 
MITRE-Module 1 Slides.pdf
byReZa AdineH
 
Best practices fore MITRE EMERSON EDUARDO RODRIGUES
byEMERSON EDUARDO RODRIGUES
 
Introduction to MITRE’s ATT&CK Framework.pdf
byseyohah504
 
Mitre getting-started-with-attack-october-2019
byThang Nguyen
 
MITRE ATTACKcon Power Hour - October
byMITRE - ATT&CKcon
 
Presentazione tesi magistrale procentese.pptx
byAntonioProcentese1
 
MITRE_ATTACK_Enterprise_11x17.pdf
byAisyiFree
 
MITRE-Module 4 Slides.pdf
byReZa AdineH
 
One Technique, Two Techniques, Red Technique, Blue Technique
byDaniel Weiss
 

More from Michael Gough

PDF
You can detect PowerShell attacks
byMichael Gough
 
PDF
Introducing ArTHIR - ATT&CK Remote Threat Hunting Incident Response Windows tool
byMichael Gough
 
PDF
When Security Tools Fail You
byMichael Gough
 
PPTX
Incident Response Fails
byMichael Gough
 
PDF
Detecting WMI Exploitation v1.1
byMichael Gough
 
PDF
You need a PROcess to catch running processes and their modules_v2.0
byMichael Gough
 
PDF
Sandbox vs manual analysis v2.1
byMichael Gough
 
PDF
Windows IR made easier and faster v1.0
byMichael Gough
 
PDF
My InfoSec journey led me to create my own IR tools, how, and why you should too
byMichael Gough
 
PDF
InnoTech 2017_Defend_Against_Ransomware 3.0
byMichael Gough
 
PDF
Email keeps getting us pwned - Avoiding Ransomware and malware
byMichael Gough
 
PDF
LasCon - Hacking a backup power solution(s) for your home, Tornado tested! v2
byMichael Gough
 
PDF
Hacking a backup power solution(s) for your home, Tornado tested!
byMichael Gough
 
PDF
What can you do about ransomware
byMichael Gough
 
PDF
EDR, ETDR, Next Gen AV is all the rage, so why am I ENRAGED?
byMichael Gough
 
PDF
Cred stealing emails bsides austin_2018 v1.0
byMichael Gough
 
PDF
DIR ISF - Email keeps getting us pwned v1.1
byMichael Gough
 
PDF
Email keeps getting us pwned v1.1
byMichael Gough
 
PDF
Email keeps getting us pwned v1.0
byMichael Gough
 
PDF
BSidesOK_You_CAN_detect_PowerShell_attacks_v1.1
byMichael Gough
 
You can detect PowerShell attacks
byMichael Gough
 
Introducing ArTHIR - ATT&CK Remote Threat Hunting Incident Response Windows tool
byMichael Gough
 
When Security Tools Fail You
byMichael Gough
 
Incident Response Fails
byMichael Gough
 
Detecting WMI Exploitation v1.1
byMichael Gough
 
You need a PROcess to catch running processes and their modules_v2.0
byMichael Gough
 
Sandbox vs manual analysis v2.1
byMichael Gough
 
Windows IR made easier and faster v1.0
byMichael Gough
 
My InfoSec journey led me to create my own IR tools, how, and why you should too
byMichael Gough
 
InnoTech 2017_Defend_Against_Ransomware 3.0
byMichael Gough
 
Email keeps getting us pwned - Avoiding Ransomware and malware
byMichael Gough
 
LasCon - Hacking a backup power solution(s) for your home, Tornado tested! v2
byMichael Gough
 
Hacking a backup power solution(s) for your home, Tornado tested!
byMichael Gough
 
What can you do about ransomware
byMichael Gough
 
EDR, ETDR, Next Gen AV is all the rage, so why am I ENRAGED?
byMichael Gough
 
Cred stealing emails bsides austin_2018 v1.0
byMichael Gough
 
DIR ISF - Email keeps getting us pwned v1.1
byMichael Gough
 
Email keeps getting us pwned v1.1
byMichael Gough
 
Email keeps getting us pwned v1.0
byMichael Gough
 
BSidesOK_You_CAN_detect_PowerShell_attacks_v1.1
byMichael Gough
 

Recently uploaded

PDF
Cheryl Hung, Vibe Coding Auth Without Melting Down! isaqb Software Architectu...
byCheryl Hung
 
PDF
Mulesoft Meetup Online Portuguese: MCP e IA
byPedro Baroni
 
PDF
[BDD 2025 - Artificial Intelligence] Building AI Systems That Users (and Comp...
byWintari Yasmin
 
PDF
ODSC AI West: Agent Optimization: Beyond Context engineering
byShashikant Jagtap
 
PDF
Dev Dives: Build smarter agents with UiPath Agent Builder
byUiPathCommunity
 
PDF
[BDD 2025 - Full-Stack Development] Agentic AI Architecture: Redefining Syste...
byWintari Yasmin
 
PDF
[BDD 2025 - Full-Stack Development] PHP in AI Age: The Laravel Way. (Rizqy Hi...
byWintari Yasmin
 
PPTX
Support, Monitoring, Continuous Improvement & Scaling Agentic Automation [3/3]
byUiPathCommunity
 
PDF
Transforming Content Operations in the Age of AI
byEnterprise Knowledge
 
PPTX
Guardrails in Action - Ensuring Safe AI with Azure AI Content Safety.pptx
byUdaiappa Ramachandran
 
PDF
MuleSoft Meetup: Dreamforce'25 Tour- Vibing With AI & Agents.pdf
byTintu Jacob Shaji
 
PDF
Mastering Agentic Orchestration with UiPath Maestro | Hands on Workshop
byUiPathCommunity
 
PDF
Mastering UiPath Maestro – Session 2 – Building a Live Use Case - Session 2
byDianaGray10
 
PDF
Transforming Supply Chains with Amazon Bedrock AgentCore (AWS Swiss User Grou...
byChris Bingham
 
PPTX
Leon Brands - Intro to GPU Occlusion (Graphics Programming Conference 2024)
byleonbrands1998
 
PDF
[DevFest Strasbourg 2025] - NodeJs Can do that !!
bymoassiongbon
 
PDF
PCCC25（設立25年記念PCクラスタシンポジウム）：エヌビディア合同会社 テーマ２「NVIDIA BlueField-4 DPU」
byPC Cluster Consortium
 
PDF
[BDD 2025 - Full-Stack Development] Digital Accessibility: Why Developers nee...
bywintari3
 
PDF
Transcript: The partnership effect: Libraries and publishers on collaborating...
byBookNet Canada
 
PDF
How Much Does It Cost To Build Software
bycollinmishell2
 
Cheryl Hung, Vibe Coding Auth Without Melting Down! isaqb Software Architectu...
byCheryl Hung
 
Mulesoft Meetup Online Portuguese: MCP e IA
byPedro Baroni
 
[BDD 2025 - Artificial Intelligence] Building AI Systems That Users (and Comp...
byWintari Yasmin
 
ODSC AI West: Agent Optimization: Beyond Context engineering
byShashikant Jagtap
 
Dev Dives: Build smarter agents with UiPath Agent Builder
byUiPathCommunity
 
[BDD 2025 - Full-Stack Development] Agentic AI Architecture: Redefining Syste...
byWintari Yasmin
 
[BDD 2025 - Full-Stack Development] PHP in AI Age: The Laravel Way. (Rizqy Hi...
byWintari Yasmin
 
Support, Monitoring, Continuous Improvement & Scaling Agentic Automation [3/3]
byUiPathCommunity
 
Transforming Content Operations in the Age of AI
byEnterprise Knowledge
 
Guardrails in Action - Ensuring Safe AI with Azure AI Content Safety.pptx
byUdaiappa Ramachandran
 
MuleSoft Meetup: Dreamforce'25 Tour- Vibing With AI & Agents.pdf
byTintu Jacob Shaji
 
Mastering Agentic Orchestration with UiPath Maestro | Hands on Workshop
byUiPathCommunity
 
Mastering UiPath Maestro – Session 2 – Building a Live Use Case - Session 2
byDianaGray10
 
Transforming Supply Chains with Amazon Bedrock AgentCore (AWS Swiss User Grou...
byChris Bingham
 
Leon Brands - Intro to GPU Occlusion (Graphics Programming Conference 2024)
byleonbrands1998
 
[DevFest Strasbourg 2025] - NodeJs Can do that !!
bymoassiongbon
 
PCCC25（設立25年記念PCクラスタシンポジウム）：エヌビディア合同会社 テーマ２「NVIDIA BlueField-4 DPU」
byPC Cluster Consortium
 
[BDD 2025 - Full-Stack Development] Digital Accessibility: Why Developers nee...
bywintari3
 
Transcript: The partnership effect: Libraries and publishers on collaborating...
byBookNet Canada
 
How Much Does It Cost To Build Software
bycollinmishell2
 

MITRE AttACK framework it is time you took notice_v1.0

  • 1.
    Mitre ATT&CK isfor all of us, and it is time to pay attention to it Michael Gough – Co-Founder IMFSecurity.com LOG-MD.com
  • 2.
    Whoami • Blue TeamDefender Ninja, Incident Responder, Logaholic • Creator of all those “Windows Logging Cheat Sheets” and the Malware Management Framework • Including LOG-MD and Windows Logging ATT&CK cheat sheets • Co-Creator of “Log-MD” – The Log and Malicious Discovery Tool • Co-Host – “Brakeing Down Incident Response” LOG-MD.com
  • 3.
  • 4.
    There is morethan this talk • But we only have 50 minutes • Brakeing Down Incident Response Podcast – Episode 007 BDIRPodcast.com – https://www.imfsecurity.com/podcasts/2018/9/16/bd ir-podcast-episode-007 • SANS Threat Hunting and Incident Response Summit New Orleans 2018 – My talk and many others covered ATT&CK, find the PDF’s and videos as SANS releases them • MITRE ATT&CKcon is this week !!! – I was invited, but I am here educating my peeps LOG-MD.com
  • 5.
    Why do wecare? • People ask me all the time • “How do you know what to look for”? – Experience – Because Hacker Hurricane said so ;-) – The Malware Management Framework • Reports that show what the bad guys actually did • So how or what do we map our defenses to? – PCI? – OWASP? – Compliance XYZ? – Because InfoSec or WebAppSec says so? LOG-MD.com
  • 6.
    Why do wecare? • If you can identify your gaps • Whether a consultant or an employee • You can define potential budget needs • You may have to admit a tool is not mapping well, so an opportunity to recommend a replacement that has better coverage • Budget re-allocation is always a bonus • The goal is to IMPROVE your security posture LOG-MD.com
  • 7.
    Why do wecare? • ATT&CK is your new baseline • You heard me • We FINALLY have a goal of what to achieve • Map to ATT&CK and you WILL pass or exceed any and all compliance requirements if you are doing them! • Forget the Cyber Kill Chain – https://www.lockheedmartin.com/en- us/capabilities/cyber/cyber-kill-chain.html • ATT&CK is more detailed at what you should detect… along the Cyber Kill Chain LOG-MD.com
  • 8.
    What is ATT&CK? LOG-MD.com
  • 9.
    MITRE ATT&CK • MITRE’sAdversarial Tactics, Techniques, & Common Knowledge (ATT&CK™) is a curated knowledge base and model for cyber adversary behavior, reflecting the various phases of an adversary’s lifecycle and the platforms they are known to target. • ATT&CK is useful for understanding security risk against known adversary behavior, for planning security improvements, and verifying defenses work as expected. LOG-MD.com
  • 10.
    ATT&CK Tactics andTechniques • 11 Tactics • 283 Techniques • Covers the following Operating Systems – Windows – MAC OS – Linux LOG-MD.com 11
  • 11.
    Why care aboutATT&CK • It is HUGE… extensive information of what the adversaries actually do to YOUR systems LOG-MD.com
  • 12.
    ATT&CK requires some ‘Backto Basics’ to achieve “Totality” MalwareArchaeology.com
  • 13.
    Achieve Totality Coverage -Asset Management • Can you see every host? • Do you have ghost assets? • Remote systems (Road Warriors) • Powered down VM’s/Systems • IP Scan all devices and identify the OS Completeness - Deployment • Are your agent(s) installed and running properly Configuration – System Settings • Are the systems configured correctly • Enable all that you want and expect MalwareArchaeology.com Coverage Completeness Configuration
  • 14.
    80/20 rule • AVERY important point is we need to ignore or not worry about the 20% that you don’t, or can’t cover. • Don’t get hung up on the 20% or you will continue to flounder • Worry about the 80% you CAN or COULD do • You have to learn to walk before you worry about trying to be, or cover 100% (run) • Being good at 80% should be a goal • You will improve over time as you get better • It’s really more 74%-26% – You must accept more false positives to reach 80% or higher (Devon Kerr EndGame) MalwareArchaeology.com
  • 15.
    Let’s Look atan Example MalwareArchaeology.com
  • 16.
    Credential Access • Tactic- Credential Access – Guessing – Cred Dump – Keystroke logging – Off the wire LOG-MD.com
  • 17.
    Technique – BruteForce • Technique ID – T1110 • Tactic – Credential Access • Lists Platforms • Shows Data Sources LOG-MD.com
  • 18.
    Examples – MoreData • Groups that used it • Tools or kits • Good for background information • Read the reports (aka Malware Management) and on the actors campaign(s) LOG-MD.com
  • 19.
    ATT&CK Provides Guidance •Mitigation examples • Detection examples • References • You must translate them into what Processes, Procedures, Products you have LOG-MD.com
  • 20.
    What about APPSEC? Howdoes this apply to us? MalwareArchaeology.com
  • 21.
    Map your capabilitiesto ATT&CK • Map the tools you have to the ATT&CK Matrix • This will give you a place to start and a way to track and rate your activities MalwareArchaeology.com
  • 22.
    Sample of ATT&CKand Applications LOG-MD.com
  • 23.
    Mitre Att@ck • Thisis a good place to start and map all your detection, prevention, and hunt activities to • Not enough details as to how – You will need to map them – Or find someone that has, maybe a product(s) • Add your Web Proxy • Add your WAF • Add your IPS • Add Network tools • Add code scanners • Fill any other gaps • Of course…. ADD YOUR LOGGING !!! MalwareArchaeology.com
  • 24.
    Mitre Att@ck -Logging Let’s look at Windows Logging, my personal favorite • Most Techniques can be mapped to logging • Add Log Management • Add some Sysmon or WLS to the logs for more details • Add LOG-MD-Pro, and other tools or script(s) • Add a solution to query the OS ( I love BigFix) • Add Network tools • Fill other gaps • See the previous slide for application stuff MalwareArchaeology.com
  • 25.
    Map your capabilitiesto ATT&CK • The Windows ATT&CK Logging Cheat Sheet • 11 Tactics and 187 Techniques mapped to Windows Event IDs MalwareArchaeology.com
  • 26.
    Map your capabilitiesto ATT&CK • The Windows LOG-MD ATT&CK Cheat Sheet • 11 Tactics and 187 Techniques mapped to Windows Event IDs, LOG-MD, and Sysmon MalwareArchaeology.com
  • 27.
    Find your Gaps,and Strengths • By filling out the ATT&CK matrix to YOUR capabilities, you begin to understand what you CAN and CAN NOT do against the actual tactics and techniques the bad guys use against you • I was shocked, I mean SHOCKED at how much I do in Windows logging mapped to actual tactics and techniques • But then again I have been practicing Malware Management since I created it over 6 years ago LOG-MD.com
  • 28.
  • 29.
    How do IHunt for PS? • Without Log Management? • Or with it, we consume LOG-MD-Pro logs into Log Management too MalwareArchaeology.com
  • 30.
  • 31.
    What is availableto you • MITRE ATT&CK Navigator • You select items you have, select colors and export it LOG-MD.com
  • 32.
    ATT&CK Navigator • ATT&CKNavigator – Https://mitre.github.io/attack-navigator/enterprise/ • Mobile too – https://mitre.github.io/attack-navigator/mobile/ • Pre-ATT&CK – https://attack.mitre.org/pre-attack/index.php/Main_Page LOG-MD.com
  • 33.
  • 34.
    SOCPrime • TDM –Threat Detection Marketplace • SIGMA Rules – Generic Signature Format for SIEM Systems • ATT&CK mappings • Lots of log solution options • Convert from one platform to another • SIGMA rule convertor • Subscription service to gain access • Some free SIGMA based rules LOG-MD.com
  • 35.
    Tools • Unfetter – https://nsacyber.github.io/unfetter/ –https://mitre.github.io/unfetter/getting-started/ • Tanium – https://www.tanium.com/blog/getting-started-with- the-mitre-attack-framework-improving-detection- capabilities/ • SIGMA – https://github.com/Neo23x0/sigma – https://github.com/Neo23x0/sigma/wiki/Specification LOG-MD.com
  • 36.
    API • MITRE hasan API for ATT&CK – https://attack.mitre.org/wiki/Using_the_API • Cyb3rWarD0g – Invoke-ATTACKAPI – https://github.com/Cyb3rWard0g/Invoke-ATTACKAPI • https://github.com/annamcabee/Mitre-Attack-API Mitre Pre-ATT&CK Mappings • https://github.com/rmusser01/Infosec_Reference/tree/master/Dra ft/ATT%26CK-Stuff • Blog on Brute Force example with ATT&CK – https://thehackerwhorolls.blogspot.com/2018/10/home-lab-att-use- case.html LOG-MD.com
  • 37.
  • 38.
    HUNT ! • Somesay create a hypothesis • I say start by eliminating things you CAN hunt for and know you do NOT have • Then build more hypothesis • Map your capabilities to ATT&CK • For Windows logging and LOG-MD there are 2 Cheat Sheets mapped to ATT&CK – MalwareArchaeology.com/cheat-sheets LOG-MD.com
  • 39.
    Conclusion • MITRE ATT&CKis GREAT stuff • It gives you a way to measure what you have and can detect, based on what your adversaries ACTUALLY do, not what compliance, an auditor or consultant says • You don’t have to get very detailed at first • Use simple coloring at first – Green (good), Yellow (needs work), Red (poor), no color (we got nuttin) • Expand it once you map it • Then expand as you rate your capabilities • But get to know this framework! LOG-MD.com
  • 40.
    Additional Reading This Isthe Fastest Way to Hunt Windows Endpoints – https://www.slideshare.net/Hackerhurricane/mwarch- fastestwaytohuntonwindowsv101 – SANS will post the video at some point SANS THIR 2018 PDF’s and videos Most of the talks had ATT&CK involved Quantify your hunt not your parents red teaming Devon Kerr – https://www.youtube.com/watch?v=w_kByDwB6J0 Quantify Your Hunt: Not Your Parents' Red Team– Devon and Roberto – https://www.sans.org/summit-archives/file/summit-archive- 1536351477.pdf Finding Related ATT&CK Techniques – https://medium.com/mitre-attack/finding-related-att-ck-techniques- f1a4e8dfe2b6 LOG-MD.com
  • 41.
    Questions • You canfind us on the Twitters – @HackerHurricane • LOG-MD.com • MalwareArchaeology.com • Preso will be on SlideShare and linked on MalwareArchaeology.com • Listen to the PodCast to hear the rest of this topic – BDIRPodcast.com LOG-MD.com