MITRE - ATT&CKcon, profile picture
Uploaded byMITRE - ATT&CKcon
PDF, PPTX3,274 views

MITRE ATTACKcon Power Hour - October

Red Canary's lessons learned from remapping their detection analytics to the MITRE ATT&CK framework include figuring out where analytics are currently mapped, letting code do the work of remapping, reviewing mappings for consistency, finding and fixing legacy mapping issues, and considering conditional mapping approaches. The speaker also emphasizes giving back to the ATT&CK community and having fun with the remapping process.

Technology◦
Related topics:
MITRE ATT&CK Insights•

Embed presentation

Download as PDF, PPTX
1 / 102
2 / 102
3 / 102
4 / 102
5 / 102
6 / 102
7 / 102
8 / 102
9 / 102
10 / 102
11 / 102
12 / 102
13 / 102
14 / 102
15 / 102
16 / 102
17 / 102
18 / 102
19 / 102
20 / 102
21 / 102
22 / 102
23 / 102
24 / 102
25 / 102
26 / 102
27 / 102
28 / 102
29 / 102
30 / 102
31 / 102
32 / 102
33 / 102
34 / 102
35 / 102
36 / 102
37 / 102
38 / 102
39 / 102
40 / 102
41 / 102
42 / 102
43 / 102
44 / 102
45 / 102
46 / 102
47 / 102
48 / 102
49 / 102
50 / 102
51 / 102
52 / 102
53 / 102
54 / 102
55 / 102
56 / 102
57 / 102
58 / 102
59 / 102
60 / 102
61 / 102
62 / 102
63 / 102
64 / 102
65 / 102
66 / 102
67 / 102
68 / 102
69 / 102
70 / 102
71 / 102
72 / 102
73 / 102
74 / 102
75 / 102
76 / 102
77 / 102
78 / 102
79 / 102
80 / 102
81 / 102
82 / 102
83 / 102
84 / 102
85 / 102
86 / 102
87 / 102
88 / 102
89 / 102
90 / 102
91 / 102
92 / 102
93 / 102
94 / 102
95 / 102
96 / 102
97 / 102
98 / 102
99 / 102
100 / 102
101 / 102
102 / 102
Welcome Follow the conversation on #slack @MITREattack attack.mitre.org
Brian Donohue Security Evangelist Red Canary
Starting over with sub-techniques Lessons learned re-mapping detection analytics
▪ I publish things, support open source tools ▪ Former journalist and CTI analyst ▪ A lied in an interview in 2010 and here I am! Brian Donohue PONTIFICATOR RED CANARY @thebriandonohue Presenter
1. Who am I? 2. Background 3. Seven lessons learned 4. Questions and answers Agenda
Red Canary MDR
Detector-level (analytics) ▪ Highly scalable ▪ Bad at nuance Detection-level (human) ▪ Difficult at scale ▪ Good at nuance Why not both?! ATT&CK mapping options
Red Canary MDR
What this looks like in practice
LESSON ONE Figure out where you’re using ATT&CK
LESSON ONE The things Red Canary maps to ATT&CK: ▪ Behavioral analytics for detection ▪ Atomic Red Team tests ▪ Research and educational content Other things you might map to ATT&CK: ▪ Threat intelligence and other reports ▪ Charts and tables for tracking detection and detection coverage ▪ Various different kinds of security controls ▪ Signatures, rules, IOCs, alerts, etc. What do you need to remap?
LESSON TWO Let the code do the work for you!
JSON crosswalk script MITRE created a nifty JSON crosswalk script to help ease the sub- technique transition LESSON TWO
LESSON THREE Divide and conquer… or don’t
LESSON THREETeam vs. individual Dividing and conquering: ▪ Gets done faster ▪ Less consistency Assigning to an individual or small team: ▪ Takes longer ▪ More consistency
BY THE NUMBERS 1000s active analytics 500+ Atomic Red Team tests ~200 parent/sub-techniques
▪ Intelligence ▪ Research ▪ Detection engineering ▪ Importantly, not me Our remap team
LESSON FOUR ATT&CK mapping is an art; not a science
LESSON FOUR Create a mapping style guide ▪ People interpret techniques in different ways ▪ A style guide will help enforce consistency ▪ Learn on the fly Review, review, review ▪ A small subset of re-mapppers can review ▪ This will help catch errors and increase consistency It’s an art, not a science
LESSON FIVE Find and fix your legacy mapping issues
A tale of two analytics WIN-SUSPECT-SVCHOST-EXECUTED This detector identifies untrusted binaries spawning suspicious Windows Service Host `svchost.exe` processes. WIN-SVCHOST-SUSPECT-PARENT This detector identifies `svchost.exe` executing with a suspect parent process.
Top analytics for Masquerading Technique Behavioral Analytics Threats T1036: MASQUERADING WIN-SUSPECT-SVCHOST-EXECUTED 2626 T1036: MASQUERADING WIN-SUSPECT-SVCHOST-EXECUTED WIN-SVCHOST-SUSPECT-PARENT 1088 T1036: MASQUERADING WIN-SVCHOST-SUSPECT-PARENT 570
LESSON SIX Considering all of the alternatives
LESSON SIXConditional Mapping Mapping at the detection level ▪ Most accurate Mapping at the analytic level ▪ Fastest Conditional mapping ▪ Identify ambiguous analytics and require human reviews
LESSON SEVEN Have fun!
LESSON SEVEN Just kidding…
LESSON SEVEN Give back to the ATT&CK community
▪ Contribute techniques ▪ Offer feedback on what works/doesn’t ▪ Suggest improvements ▪ Write blogs; give talks Ways to give back
redcanary.com/blog/mitre-sub-techniques
FEEDBACK Q & A
Q&A Jamie Williams Lead Cyber Adversarial Engineer MITRE
Aunshul Rege Associate Professor Temple University Rachel Bleiman PhD Student/NSF Graduate Research Assistant Temple University
Using MITRE PRE-ATT&CK and ATT&CK in Cybercrime Education and Research 2020 ATT&CKcon Power Hour Aunshul Rege & Rachel Bleiman CAREER Award # 1453040 SaTC EDU Award # 2032292
Agenda • MITRE PRE-ATT&CK and cybercrime/security education • MITRE ATT&CK and research datasets • Summary
MITRE PRE-ATT&CK & cybercrime/security education • Cybercrime course • Human aspects of cyberattacks/security via social engineering (SE) • Multidisciplinary composition (8 groups) • Objectives • Applications of PRE-ATT&CK to SE • Conduct threat intelligence • Understand limitations • 6 SE case studies with rich details • Overall mapping to the PRE-ATT&CK matrix • Specific expansion on tactics and techniques • Identify PRE-ATT&CK mitigation strategies • First attempt at this project (Fall 2020)
Overall mapping to the PRE-ATT&CK matrix • What is the mapping %? • What does this mean for: • Case study? • PRE-ATT&CK matrix? https://attack.mitre.org/versions/v7/matrices/pre/
Specific expansion on tactics and techniques
Identify PRE-ATT&CK mitigation strategies If none exist, students recommend mitigations
Agenda • MITRE PRE-ATT&CK and cybercrime/security education • MITRE ATT&CK and research datasets • Summary
Cybersecurity in Action, Research and Education • Offer FREE downloadable course projects and datasets • Sites.temple.edu/care • Social Engineering (SE) incidents • Version 5; N=623; 2011 - August 2020 • Critical Infrastructure Ransomware (CIRW) incidents • Version 10.4; N=747; November 2013 - September 2020 • Both datasets based on publicly disclosed incidents • Feedback to map CIRW dataset to ATT&CK • Why not for SE dataset too?
Mapping SE dataset to ATT&CK framework • 50% (461/925) of the tactics mapped onto the ATT&CK technique or software • T1566: Phishing • T1566.001 • T1566.002 • 23% (23/100) of the attackers mapped onto the ATT&CK group- attacker • G0032 • G0059 • G0092 • G0094 Variables General Start Date General End Date Target Location Social Engineering Tactic MITRE ATT&CK Technique or Software Monetary Cost Attacker MITRE ATT&CK Group - Attacker Attacker posing as Ploy Source
Mapping CIRW dataset to ATT&CK framework Variables Year General Date Organization Name Location CIS Targeted Strain MITRE ATT&CK Software ID [if exists] Duration Duration Rank Ransom Amount Local Currency Ransom Amount Rank Paid Status Pay Method Amount Paid Source • V9→ V10 • NotPetya cases removed – ATT&CK defined it as wiperware • 56% of the strains mapped onto the ATT&CK software • S0366 • S0370 • S0372 • S0400 • S0446 • S0449 • S0457 • S0481
Mapping limitations/challenges • Many of the SE techniques do not currently exist (ex: whaling, vishing, etc). • Bulk of our data is phishing/spear phishing, skews mapping results • Major strains missing (could only map 56%) • Revil • RansomEXX • DoppelPaymer
Agenda • MITRE PRE-ATT&CK and cybercrime/security education • MITRE ATT&CK and research datasets • Summary
Summary: PRE-ATT&CK and ATT&CK uses • Education: PRE-ATT&CK benefits • Develop ability to map and understand threat intelligence • Develop ability to understand challenges/limitations • Map SE cases (not typically done) • All disciplines can engage • Research datasets: ATT&CK links • Educators: Class projects, research, publications • Students: Course projects, dissertation/thesis • Government: ICS training classes, raising awareness, assessing internal responses to CIRW attacks • Industry: Trends & patterns in TTPs across RW strains, comparing the data to their own internal datasets, threat modeling, awareness & training, risk & statistical analysis
Summary/future directions • Merging PRE-ATT&CK and ATT&CK • Data repository • Indictments • SE case studies • Focus groups/interviews • Weaving it into Collegiate SE CTF • Seeking collaboration! PRE- ATT&CK/ ATT&CK Social Science Education & Research
Using MITRE PRE-ATT&CK and ATT&CK in Cybercrime Education and Research 2020 ATT&CKcon Power Hour Aunshul Rege & Rachel Bleiman rege@temple.edu; rachel.bleiman@temple.edu @prof_rege; @rab1928 Q&A Feedback? Visit sites.temple.edu/care for downloading CIRW dataset; SE dataset - we welcome feedback and would love to engage with the community!
Matan Hart Co-Founder & CEO Cymptom
Transforming Adversary Emulation Into a Data Analysis Question : matan@cymptom.com: @machosec: matanhart
Who Am I ● Co-Founder, CEO @ Cymptom ● Security Researcher ● Speaker - Black Hat, BSides, etc. ● Content inspired by true events... During COVID...
Source: https://www.mitre.org/sites/default/files/publications/mitre-getting-started-with-attack-october-2019.pdf Adversary Emulation Tests how defenses fare against a specific threat Atomic testing cycle with ATT&CK
Adversary Emulation Does Not Scale Nor was it intended to...
Determining Exploitability By Detection Mitigation Capabilities
Validate Select Conclude Analyze ATT&CK technique and list mitigations effectiveness of each mitigation technique exploitability applicability of each mitigation The Methodology
Unbiased, Adversary-driven Prioritization Based on the no. of attack paths and the no. of attack techniques (steps) involved Test Case: Pass The Hash (T1550.002)
Unbiased, Adversary-driven Prioritization
Analyzing Exposure By Mitigation Mitigation What Where Effectiveness Privileged Account Management Credentials overlap SAM, LAPS, PAM solutions Mitigates all PtH scenarios Update Software KB2871997 patch existence Endpoint, WSUS, VM solutions Mitigates local non- administrative accounts PtH User Account Control Domain user is admin on both computers GPO, AD Mitigates domain user PtH User Account Management PtH UAC restrictions enabled Registry, GPO Mitigates local PtH except of built-in Administrator (RID 500) Great read: https://www.harmj0y.net/blog/redteaming/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy/
Defensive Gap Analysis Using ATT&CK Matrix
✓ Coverage ✓ Safety ✓ The real thing ✓ Test people & processes Adversary Emulation Data Analytics Pros and Cons x Business disruption x Resource intensive x Miss detective controls x Miss processes
Adversary Emulation is essential but should be practiced cautiously Takeaways Data Analytics is better for assessing defensive coverage can be assessed using ATT&CK mitigations Defensive Coverage
: matanhart : @machosec : matan@cymptom.com Let's Talk!
Brandon Levene Head of Applied Intelligence Google
TA505 A Study of High End Big Game Hunting in 2020 Brandon Levene ATT&CKCON October 9th, 2020
Proprietary + Confidential Opportunistically targeted ransomware deployments, aka Big Game Hunting (BGH), have caused a distinct disruption in the mechanics of monetizing crimeware compromises.
Agenda Context and background Threat actor process Lessons learned Operational details 02 01 03 04
Context and background Threat actor process Lessons learned Operational details 02 01 03 04
Who is TA505? Customer of Dridex banking Trojan as well as Locky and Jaff Ransomware families from 2014-2017 NOT the developers of the tools above (that would be ‘EvilCorp’) Shift to backdoors in 2018 which coincides with a decrease in bespoke banking trojans and non-targeted ransomware Rapidly shifted through initial loaders and secondary payloads throughout 2018 and 2019, slowly shifted towards “in house” tooling Users* of CLOP ransomware (first seen in Feb 2019) as primary monetization mechanism There do not appear to be any other users, so this is likely another in- house tool Context and background
Proprietary + Confidential TA505 activity since 2018 has lead to... Context and background
NETZSCH GROUP BASED IN GERMANY ALLEGEDLY BREACHED BY COP RANSOMWARE OPERATORS Hackers publish ExecuPharm internal data after ransomware attack CL0P Ransomware Breached UK’s Largest Privately-Owned Logistics Company--EV Cargo Logistics Ransomware Hits maastricht University, all Systems Taken Down Indiabulls Group hit by CLOP Ransomware, gets 24h leak deadline
Context and background Threat actor process02 01 Lessons learned Operational details03 04
Source: ANSSI https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-009.pdf Threat actor process Overview TA505 Legitimate compromised domain Malicious domain Malicious email HTML + Javascript Redirecting URL Phishing page Malicious office document Victim Malware 1 SENDS CONTAINS HOSTS HOSTSHOSTS 6 DROPS AND EXECUTES 2 3 4 5OPENS REDIRECTION DOWNLOADS AND ACTIVATES THE MACROS REDIRECTION
Context and background Threat actor process Operational details 02 01 03 Lessons learned04
Operational details Spear Phishing - T1192 + Spear Phishing Attachment - T1193 Initial Access
Operational details User Execution + T1204 [.002] Execution
Operational details Ingress Tool Transfer - T1055 Command and control
Operational details Process Injection - T1055 Defense Evasion and Priv Esc Application Layer Protocol - T1071 Command and control
Operational details Event Triggered Execution - T1546 (image file execution injections, sub .012) Persistence
Operational details Permission Groups Discovery - T1069 Discovery Subvert Trust Controls - T1553 Defense Evasion
Operational details Data Encrypted for Impact - T1486 Impact
Operational details Data Leak - Unmapped Impact
Context and background Threat actor process Lessons learned Operational details 02 01 03 04
Compliment defense in depth with detection in depth Study TTPs to seize interdiction opportunities Detecting the ransomware itself is too late Attackers use a blend of tools and techniques to get the job done: don’t overlook open source tools as too “amateur” Visibility is key
Jen Burns Lead Cybersecurity Engineer MITRE
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 What’s New with ATT&CK® for Cloud? Jen Burns @snarejen @MITREattack
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-000000 | 90 | for Cloud Credit to Dave Herrald and Ryan Kovar
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 ATT&CK for Cloud Beginnings • Initial Release October 2019 • Part of Enterprise ATT&CK • Almost 100% community- contributed techniques! • Input from: • A cloud service provider • Threat analysts • Detection analysts • Red teams
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 ATT&CK for Cloud Today
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 ATT&CK for Cloud Scope Add techniques generally visible via Cloud data sources • AWS CloudTrail Logs • Azure Activity Logs • Office365 Audit Logs • etc… Minimize duplication across Windows/Linux/macOS • Cloud is meant to add an additional layer to ATT&CK • Example: • An adversary may abuse Cron (T1053.003) on a Linux EC2 instance. That’s already covered by the Linux matrix, so we don’t add it to AWS.
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 Future of Cloud Platforms Current Future SaaS IaaS Additional SaaS platforms…. Additional SaaS platforms…. Additional SaaS platforms…. SaaS
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 Why generalize to IaaS? • Current IaaS platforms share most techniques • Differences between Cloud Service Providers (CSPs) can be documented within the technique • All CSPs can be represented • Community feedback favors a single platform
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 Cloud Data Sources Today • AWS CloudTrail logs • Azure activity logs • GCP audit logs • Oauth audit logs • Office 365 trace logs…
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 Future of Cloud Data Sources • Data Source • One or more Data Components • Mapping(s) to Relevant Azure Operation Name(s) • Mapping(s) to Relevant AWS CloudTrail Event Name(s) • Mapping(s) to Relevant GCP REST API Method(s) • Mapping(s) to Other CSPs or SaaS Events https://media.giphy.com/media/l41m6QYDHcEEwjo52/giphy.gif
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 Example IaaS Data Source Instance Data Source Data Component Events (API) Instance Creation Instance Modification Instance Deletion Instance Metadata Instance Enumeration Instance Start Instance Stop AWS: ListInstances AWS: ModifyInstanceAttribute AWS: TerminateInstances AWS: DescribeInstances AWS: RunInstances AWS: StartInstances AWS: StopInstances
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 Why the change? • Ensure approach is consistent with the rest of Enterprise • Suggest reading blog from Jose Luis Rodriguez • https://medium.com/mitre-attack/defining-attack-data-sources-part-i- 4c39e581454f • Create more meaningful data sources for Cloud • Move away from the “everything is logs” approach • Refactor to align to events and API calls within these logs instead • Align to future Cloud platform updates
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 We need your help! Do you have… • thoughts on how can we improve ATT&CK for Cloud? • “in the wild” visibility into adversaries in the Cloud? • opinions on our platform or data source plans?
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 attack@mitre.org @MITREattack Jen Burns @snarejen
Join our next session on November 12 Register now! https://na.eventscloud.com/ATTACKcon-november

More Related Content

PDF
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
byMITRE - ATT&CKcon
 
PDF
From Theory to Practice: How My ATTACK Perspectives Have Changed
byMITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
byMITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
byMITRE - ATT&CKcon
 
PDF
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
byMITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon 2018: Helping Your Non-Security Executives Understand ATT&CK ...
byMITRE - ATT&CKcon
 
PDF
ATT&CKcon Power Hour - ATT&CK-onomics - gert-jan bruggink
byGert-Jan Bruggink
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
byMITRE - ATT&CKcon
 
From Theory to Practice: How My ATTACK Perspectives Have Changed
byMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
byMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
byMITRE - ATT&CKcon
 
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
byMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: Helping Your Non-Security Executives Understand ATT&CK ...
byMITRE - ATT&CKcon
 
ATT&CKcon Power Hour - ATT&CK-onomics - gert-jan bruggink
byGert-Jan Bruggink
 

What's hot

PDF
MITRE ATTACKcon Power Hour - January
byMITRE - ATT&CKcon
 
PDF
MITRE ATTACKCon Power Hour - December
byMITRE - ATT&CKcon
 
PDF
MITRE AttACK framework it is time you took notice_v1.0
byMichael Gough
 
PDF
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
byMITRE - ATT&CKcon
 
PDF
How MITRE ATT&CK helps security operations
bySergey Soldatov
 
PDF
MITRE ATT&CKcon Power Hour - November
byMITRE - ATT&CKcon
 
PDF
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...
byMITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...
byMITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon 2018: ATT&CK: All the Things, Neelsen Cyrus and David Thompso...
byMITRE - ATT&CKcon
 
PDF
Mitre getting-started-with-attack-october-2019
byThang Nguyen
 
PDF
Dreaming of IoCs Adding Time Context to Threat Intelligence
byPriyanka Aash
 
PDF
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
PDF
MITRE ATT&CKcon 2018: From Red VS Blue to Red ♥ Blue, Olaf Hartong and Vincen...
byMITRE - ATT&CKcon
 
PDF
Helping Small Companies Leverage CTI with an Open Source Threat Mapping
byMITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon 2.0: The World's Most Dangerous ATT&CKers; Robert Lipovsky, ESET
byMITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...
byMITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...
byMITRE - ATT&CKcon
 
PDF
CTI ANT: Hunting for Chinese Threat Intelligence
byJacklynTsai
 
PDF
What's a MITRE with your Security?
byMITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon 2018: Decision Analysis Applications in Threat Analysis Frame...
byMITRE - ATT&CKcon
 
MITRE ATTACKcon Power Hour - January
byMITRE - ATT&CKcon
 
MITRE ATTACKCon Power Hour - December
byMITRE - ATT&CKcon
 
MITRE AttACK framework it is time you took notice_v1.0
byMichael Gough
 
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
byMITRE - ATT&CKcon
 
How MITRE ATT&CK helps security operations
bySergey Soldatov
 
MITRE ATT&CKcon Power Hour - November
byMITRE - ATT&CKcon
 
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...
byMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...
byMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: ATT&CK: All the Things, Neelsen Cyrus and David Thompso...
byMITRE - ATT&CKcon
 
Mitre getting-started-with-attack-october-2019
byThang Nguyen
 
Dreaming of IoCs Adding Time Context to Threat Intelligence
byPriyanka Aash
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
MITRE ATT&CKcon 2018: From Red VS Blue to Red ♥ Blue, Olaf Hartong and Vincen...
byMITRE - ATT&CKcon
 
Helping Small Companies Leverage CTI with an Open Source Threat Mapping
byMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: The World's Most Dangerous ATT&CKers; Robert Lipovsky, ESET
byMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...
byMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...
byMITRE - ATT&CKcon
 
CTI ANT: Hunting for Chinese Threat Intelligence
byJacklynTsai
 
What's a MITRE with your Security?
byMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: Decision Analysis Applications in Threat Analysis Frame...
byMITRE - ATT&CKcon
 

Similar to MITRE ATTACKcon Power Hour - October

PPTX
Leveraging MITRE ATT&CK - Speaking the Common Language
byErik Van Buggenhout
 
PPTX
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
byHarry McLaren
 
PDF
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
PDF
CTI Workshop Full Slides Workshop Full Slides.pdf
byseyohah504
 
PDF
MITRE-Module 2 Slides.pdf
byReZa AdineH
 
PDF
Introduction to MITRE’s ATT&CK Framework.pdf
byseyohah504
 
PPTX
Purple Teaming with ATT&CK - x33fcon 2018
byChristopher Korban
 
PDF
Best practices fore MITRE EMERSON EDUARDO RODRIGUES
byEMERSON EDUARDO RODRIGUES
 
PPTX
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
byAdam Pennington
 
PDF
MITRE-Module 3 Slides.pdf
byReZa AdineH
 
PPTX
ATT&CKing with Threat Intelligence
byChristopher Korban
 
PDF
MITRE-Module 1 Slides.pdf
byReZa AdineH
 
PDF
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
byAdam Pennington
 
PDF
MITRE ATT&CKcon 2.0: attckr - A Toolkit for Analysis and Visualization of ATT...
byMITRE - ATT&CKcon
 
PDF
Slideshare.net rh-isac summit 2019 - adam pennington - leveraging mitre at ta...
byRobert Brandel
 
PDF
MITRE A-TAK Design Philosophy
bytom termini
 
PDF
State of ATT&CK
byAdam Pennington
 
PDF
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
byMITRE - ATT&CKcon
 
PPTX
MITRE ATT&CK Triage Presentation 2024 3jlxksllslsslnxud
byjimihi8398
 
PDF
(SACON) Wayne Tufek - chapter five - attacks
byPriyanka Aash
 
Leveraging MITRE ATT&CK - Speaking the Common Language
byErik Van Buggenhout
 
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
byHarry McLaren
 
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
CTI Workshop Full Slides Workshop Full Slides.pdf
byseyohah504
 
MITRE-Module 2 Slides.pdf
byReZa AdineH
 
Introduction to MITRE’s ATT&CK Framework.pdf
byseyohah504
 
Purple Teaming with ATT&CK - x33fcon 2018
byChristopher Korban
 
Best practices fore MITRE EMERSON EDUARDO RODRIGUES
byEMERSON EDUARDO RODRIGUES
 
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
byAdam Pennington
 
MITRE-Module 3 Slides.pdf
byReZa AdineH
 
ATT&CKing with Threat Intelligence
byChristopher Korban
 
MITRE-Module 1 Slides.pdf
byReZa AdineH
 
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
byAdam Pennington
 
MITRE ATT&CKcon 2.0: attckr - A Toolkit for Analysis and Visualization of ATT...
byMITRE - ATT&CKcon
 
Slideshare.net rh-isac summit 2019 - adam pennington - leveraging mitre at ta...
byRobert Brandel
 
MITRE A-TAK Design Philosophy
bytom termini
 
State of ATT&CK
byAdam Pennington
 
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
byMITRE - ATT&CKcon
 
MITRE ATT&CK Triage Presentation 2024 3jlxksllslsslnxud
byjimihi8398
 
(SACON) Wayne Tufek - chapter five - attacks
byPriyanka Aash
 

More from MITRE - ATT&CKcon

PDF
Sharpening your Threat-Hunting Program with ATTACK Framework
byMITRE - ATT&CKcon
 
PDF
ATTACK-Onomics: Attacking the Economics Behind Techniques Used by Adversaries
byMITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
byMITRE - ATT&CKcon
 
PDF
State of the ATTACK
byMITRE - ATT&CKcon
 
PDF
Using ATTACK to Create Cyber DBTS for Nuclear Power Plants
byMITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon 2.0: ATT&CK Coverage Assessment from a Data Perspective; Olaf...
byMITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon 2.0: Alertable Techniques for Linux Using ATT&CK; Tony Lamber...
byMITRE - ATT&CKcon
 
PDF
What's New with ATTACK for ICS?
byMITRE - ATT&CKcon
 
PDF
ATTACKing the Cloud: Hopping Between the Matrices
byMITRE - ATT&CKcon
 
PDF
Transforming Adversary Emulation Into a Data Analysis Question
byMITRE - ATT&CKcon
 
PDF
TA505: A Study of High End Big Game Hunting in 2020
byMITRE - ATT&CKcon
 
PDF
Mapping the EventBot Mobile Banking Trojan with MITRE ATTACK for Mobile
byMITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon 2.0: Keynote Address - The Friends We Made Along the Way; Ton...
byMITRE - ATT&CKcon
 
PDF
Putting the PRE into ATTACK
byMITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon 2.0: From Susceptible to ATT&CK - A Threat Hunting Story; Chr...
byMITRE - ATT&CKcon
 
PDF
What's New with ATTACK for Cloud?
byMITRE - ATT&CKcon
 
PDF
Starting Over with Sub-Techniques
byMITRE - ATT&CKcon
 
Sharpening your Threat-Hunting Program with ATTACK Framework
byMITRE - ATT&CKcon
 
ATTACK-Onomics: Attacking the Economics Behind Techniques Used by Adversaries
byMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
byMITRE - ATT&CKcon
 
State of the ATTACK
byMITRE - ATT&CKcon
 
Using ATTACK to Create Cyber DBTS for Nuclear Power Plants
byMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: ATT&CK Coverage Assessment from a Data Perspective; Olaf...
byMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: Alertable Techniques for Linux Using ATT&CK; Tony Lamber...
byMITRE - ATT&CKcon
 
What's New with ATTACK for ICS?
byMITRE - ATT&CKcon
 
ATTACKing the Cloud: Hopping Between the Matrices
byMITRE - ATT&CKcon
 
Transforming Adversary Emulation Into a Data Analysis Question
byMITRE - ATT&CKcon
 
TA505: A Study of High End Big Game Hunting in 2020
byMITRE - ATT&CKcon
 
Mapping the EventBot Mobile Banking Trojan with MITRE ATTACK for Mobile
byMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: Keynote Address - The Friends We Made Along the Way; Ton...
byMITRE - ATT&CKcon
 
Putting the PRE into ATTACK
byMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: From Susceptible to ATT&CK - A Threat Hunting Story; Chr...
byMITRE - ATT&CKcon
 
What's New with ATTACK for Cloud?
byMITRE - ATT&CKcon
 
Starting Over with Sub-Techniques
byMITRE - ATT&CKcon
 

Recently uploaded

PDF
DIGITAL FORENSICS - Notes for Everything.pdf
bypankajkumavatbeit
 
PDF
TrustArc Webinar - Assessing AI Risk with Confidence
byTrustArc
 
PDF
Digit Expo 2025 - EICC Edinburgh 27th November
byRay Bugg
 
PDF
Vibe Coding vs. Spec-Driven Development [Free Meetup]
byHaim Michael
 
PDF
Safeguarding AI-Based Financial Infrastructure
byYasir Naveed Riaz
 
PPTX
THIS IS CYBER SECURITY NOTES USED IN CLASS ON VARIOUS TOPICS USED IN CYBERSEC...
byMelissaGblinwon
 
PDF
Knowing and Doing: Knowledge graphs, AI, and work
bymarainglezakis1
 
PDF
Accelerating Responsible AI Adoption in Public Sector and Private Organizations.
byYasir Naveed Riaz
 
PDF
Igniting the Future: Copilot trends, agentic transformation and product roadm...
byUni Systems S.M.S.A.
 
PDF
Usage Control for Process Discovery through a Trusted Execution Environment
byValerioGoretti
 
PDF
December Patch Tuesday
byIvanti
 
PDF
Making Sense of Raster: From Bit Depth to Better Workflows
bySafe Software
 
PDF
Decoding the DNA: The Digital Networks Act, the Open Internet, and IP interco...
byCSUC - Consorci de Serveis Universitaris de Catalunya
 
PDF
Incident Response Planning with a Foundation Model
byKim Hammar
 
PDF
How Mobile Apps Are Shaping the Future of Digital Innovation
byWilliam Taylor
 
PPTX
RISE with SAP for Automotive - S4 HANA Value.pptx
byAmira Jemi
 
DOCX
Introduction to the World of Computers (Hardware & Software)
byALIABBAS ABASOV
 
PDF
Recursive Self Improvement vs Continuous Learning
byBob Marcus
 
PDF
Top 7 Manufacturing Software for Small Businesses Boosting Growth in 2025
byEnvertis Software Solutions
 
PDF
8 LLM Surveys https://tinyurl.com/bdz8e6fp
byBob Marcus
 
DIGITAL FORENSICS - Notes for Everything.pdf
bypankajkumavatbeit
 
TrustArc Webinar - Assessing AI Risk with Confidence
byTrustArc
 
Digit Expo 2025 - EICC Edinburgh 27th November
byRay Bugg
 
Vibe Coding vs. Spec-Driven Development [Free Meetup]
byHaim Michael
 
Safeguarding AI-Based Financial Infrastructure
byYasir Naveed Riaz
 
THIS IS CYBER SECURITY NOTES USED IN CLASS ON VARIOUS TOPICS USED IN CYBERSEC...
byMelissaGblinwon
 
Knowing and Doing: Knowledge graphs, AI, and work
bymarainglezakis1
 
Accelerating Responsible AI Adoption in Public Sector and Private Organizations.
byYasir Naveed Riaz
 
Igniting the Future: Copilot trends, agentic transformation and product roadm...
byUni Systems S.M.S.A.
 
Usage Control for Process Discovery through a Trusted Execution Environment
byValerioGoretti
 
December Patch Tuesday
byIvanti
 
Making Sense of Raster: From Bit Depth to Better Workflows
bySafe Software
 
Decoding the DNA: The Digital Networks Act, the Open Internet, and IP interco...
byCSUC - Consorci de Serveis Universitaris de Catalunya
 
Incident Response Planning with a Foundation Model
byKim Hammar
 
How Mobile Apps Are Shaping the Future of Digital Innovation
byWilliam Taylor
 
RISE with SAP for Automotive - S4 HANA Value.pptx
byAmira Jemi
 
Introduction to the World of Computers (Hardware & Software)
byALIABBAS ABASOV
 
Recursive Self Improvement vs Continuous Learning
byBob Marcus
 
Top 7 Manufacturing Software for Small Businesses Boosting Growth in 2025
byEnvertis Software Solutions
 
8 LLM Surveys https://tinyurl.com/bdz8e6fp
byBob Marcus
 

MITRE ATTACKcon Power Hour - October

  • 1.
    Welcome Follow the conversationon #slack @MITREattack attack.mitre.org
  • 2.
  • 3.
    Starting over with sub-techniques Lessonslearned re-mapping detection analytics
  • 4.
    ▪ I publishthings, support open source tools ▪ Former journalist and CTI analyst ▪ A lied in an interview in 2010 and here I am! Brian Donohue PONTIFICATOR RED CANARY @thebriandonohue Presenter
  • 5.
    1. Who amI? 2. Background 3. Seven lessons learned 4. Questions and answers Agenda
  • 6.
  • 7.
    Detector-level (analytics) ▪ Highlyscalable ▪ Bad at nuance Detection-level (human) ▪ Difficult at scale ▪ Good at nuance Why not both?! ATT&CK mapping options
  • 8.
  • 9.
    What this lookslike in practice
  • 10.
    LESSON ONE Figure out whereyou’re using ATT&CK
  • 11.
    LESSON ONE The thingsRed Canary maps to ATT&CK: ▪ Behavioral analytics for detection ▪ Atomic Red Team tests ▪ Research and educational content Other things you might map to ATT&CK: ▪ Threat intelligence and other reports ▪ Charts and tables for tracking detection and detection coverage ▪ Various different kinds of security controls ▪ Signatures, rules, IOCs, alerts, etc. What do you need to remap?
  • 12.
    LESSON TWO Let thecode do the work for you!
  • 13.
    JSON crosswalk script MITREcreated a nifty JSON crosswalk script to help ease the sub- technique transition LESSON TWO
  • 14.
  • 15.
    LESSON THREETeam vs.individual Dividing and conquering: ▪ Gets done faster ▪ Less consistency Assigning to an individual or small team: ▪ Takes longer ▪ More consistency
  • 16.
    BY THE NUMBERS 1000s activeanalytics 500+ Atomic Red Team tests ~200 parent/sub-techniques
  • 17.
    ▪ Intelligence ▪ Research ▪Detection engineering ▪ Importantly, not me Our remap team
  • 18.
    LESSON FOUR ATT&CK mapping isan art; not a science
  • 19.
    LESSON FOUR Create amapping style guide ▪ People interpret techniques in different ways ▪ A style guide will help enforce consistency ▪ Learn on the fly Review, review, review ▪ A small subset of re-mapppers can review ▪ This will help catch errors and increase consistency It’s an art, not a science
  • 20.
    LESSON FIVE Find andfix your legacy mapping issues
  • 21.
    A tale oftwo analytics WIN-SUSPECT-SVCHOST-EXECUTED This detector identifies untrusted binaries spawning suspicious Windows Service Host `svchost.exe` processes. WIN-SVCHOST-SUSPECT-PARENT This detector identifies `svchost.exe` executing with a suspect parent process.
  • 22.
    Top analytics forMasquerading Technique Behavioral Analytics Threats T1036: MASQUERADING WIN-SUSPECT-SVCHOST-EXECUTED 2626 T1036: MASQUERADING WIN-SUSPECT-SVCHOST-EXECUTED WIN-SVCHOST-SUSPECT-PARENT 1088 T1036: MASQUERADING WIN-SVCHOST-SUSPECT-PARENT 570
  • 25.
  • 26.
    LESSON SIXConditional Mapping Mappingat the detection level ▪ Most accurate Mapping at the analytic level ▪ Fastest Conditional mapping ▪ Identify ambiguous analytics and require human reviews
  • 27.
  • 28.
  • 29.
    LESSON SEVEN Give backto the ATT&CK community
  • 30.
    ▪ Contribute techniques ▪Offer feedback on what works/doesn’t ▪ Suggest improvements ▪ Write blogs; give talks Ways to give back
  • 31.
  • 32.
  • 33.
    Q&A Jamie Williams Lead CyberAdversarial Engineer MITRE
  • 34.
    Aunshul Rege Associate Professor TempleUniversity Rachel Bleiman PhD Student/NSF Graduate Research Assistant Temple University
  • 35.
    Using MITRE PRE-ATT&CKand ATT&CK in Cybercrime Education and Research 2020 ATT&CKcon Power Hour Aunshul Rege & Rachel Bleiman CAREER Award # 1453040 SaTC EDU Award # 2032292
  • 36.
    Agenda • MITRE PRE-ATT&CKand cybercrime/security education • MITRE ATT&CK and research datasets • Summary
  • 37.
    MITRE PRE-ATT&CK &cybercrime/security education • Cybercrime course • Human aspects of cyberattacks/security via social engineering (SE) • Multidisciplinary composition (8 groups) • Objectives • Applications of PRE-ATT&CK to SE • Conduct threat intelligence • Understand limitations • 6 SE case studies with rich details • Overall mapping to the PRE-ATT&CK matrix • Specific expansion on tactics and techniques • Identify PRE-ATT&CK mitigation strategies • First attempt at this project (Fall 2020)
  • 38.
    Overall mapping tothe PRE-ATT&CK matrix • What is the mapping %? • What does this mean for: • Case study? • PRE-ATT&CK matrix? https://attack.mitre.org/versions/v7/matrices/pre/
  • 39.
    Specific expansion ontactics and techniques
  • 40.
    Identify PRE-ATT&CK mitigationstrategies If none exist, students recommend mitigations
  • 41.
    Agenda • MITRE PRE-ATT&CKand cybercrime/security education • MITRE ATT&CK and research datasets • Summary
  • 42.
    Cybersecurity in Action,Research and Education • Offer FREE downloadable course projects and datasets • Sites.temple.edu/care • Social Engineering (SE) incidents • Version 5; N=623; 2011 - August 2020 • Critical Infrastructure Ransomware (CIRW) incidents • Version 10.4; N=747; November 2013 - September 2020 • Both datasets based on publicly disclosed incidents • Feedback to map CIRW dataset to ATT&CK • Why not for SE dataset too?
  • 43.
    Mapping SE datasetto ATT&CK framework • 50% (461/925) of the tactics mapped onto the ATT&CK technique or software • T1566: Phishing • T1566.001 • T1566.002 • 23% (23/100) of the attackers mapped onto the ATT&CK group- attacker • G0032 • G0059 • G0092 • G0094 Variables General Start Date General End Date Target Location Social Engineering Tactic MITRE ATT&CK Technique or Software Monetary Cost Attacker MITRE ATT&CK Group - Attacker Attacker posing as Ploy Source
  • 44.
    Mapping CIRW datasetto ATT&CK framework Variables Year General Date Organization Name Location CIS Targeted Strain MITRE ATT&CK Software ID [if exists] Duration Duration Rank Ransom Amount Local Currency Ransom Amount Rank Paid Status Pay Method Amount Paid Source • V9→ V10 • NotPetya cases removed – ATT&CK defined it as wiperware • 56% of the strains mapped onto the ATT&CK software • S0366 • S0370 • S0372 • S0400 • S0446 • S0449 • S0457 • S0481
  • 45.
    Mapping limitations/challenges • Manyof the SE techniques do not currently exist (ex: whaling, vishing, etc). • Bulk of our data is phishing/spear phishing, skews mapping results • Major strains missing (could only map 56%) • Revil • RansomEXX • DoppelPaymer
  • 46.
    Agenda • MITRE PRE-ATT&CKand cybercrime/security education • MITRE ATT&CK and research datasets • Summary
  • 47.
    Summary: PRE-ATT&CK andATT&CK uses • Education: PRE-ATT&CK benefits • Develop ability to map and understand threat intelligence • Develop ability to understand challenges/limitations • Map SE cases (not typically done) • All disciplines can engage • Research datasets: ATT&CK links • Educators: Class projects, research, publications • Students: Course projects, dissertation/thesis • Government: ICS training classes, raising awareness, assessing internal responses to CIRW attacks • Industry: Trends & patterns in TTPs across RW strains, comparing the data to their own internal datasets, threat modeling, awareness & training, risk & statistical analysis
  • 49.
    Summary/future directions • MergingPRE-ATT&CK and ATT&CK • Data repository • Indictments • SE case studies • Focus groups/interviews • Weaving it into Collegiate SE CTF • Seeking collaboration! PRE- ATT&CK/ ATT&CK Social Science Education & Research
  • 50.
    Using MITRE PRE-ATT&CKand ATT&CK in Cybercrime Education and Research 2020 ATT&CKcon Power Hour Aunshul Rege & Rachel Bleiman rege@temple.edu; rachel.bleiman@temple.edu @prof_rege; @rab1928 Q&A Feedback? Visit sites.temple.edu/care for downloading CIRW dataset; SE dataset - we welcome feedback and would love to engage with the community!
  • 51.
  • 52.
    Transforming Adversary EmulationInto a Data Analysis Question : matan@cymptom.com: @machosec: matanhart
  • 53.
    Who Am I ●Co-Founder, CEO @ Cymptom ● Security Researcher ● Speaker - Black Hat, BSides, etc. ● Content inspired by true events... During COVID...
  • 54.
  • 55.
    Adversary Emulation DoesNot Scale Nor was it intended to...
  • 57.
  • 58.
    Validate Select Conclude Analyze ATT&CK technique andlist mitigations effectiveness of each mitigation technique exploitability applicability of each mitigation The Methodology
  • 59.
    Unbiased, Adversary-driven Prioritization Based on theno. of attack paths and the no. of attack techniques (steps) involved Test Case: Pass The Hash (T1550.002)
  • 60.
  • 61.
    Analyzing Exposure ByMitigation Mitigation What Where Effectiveness Privileged Account Management Credentials overlap SAM, LAPS, PAM solutions Mitigates all PtH scenarios Update Software KB2871997 patch existence Endpoint, WSUS, VM solutions Mitigates local non- administrative accounts PtH User Account Control Domain user is admin on both computers GPO, AD Mitigates domain user PtH User Account Management PtH UAC restrictions enabled Registry, GPO Mitigates local PtH except of built-in Administrator (RID 500) Great read: https://www.harmj0y.net/blog/redteaming/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy/
  • 63.
    Defensive Gap AnalysisUsing ATT&CK Matrix
  • 64.
    ✓ Coverage ✓ Safety ✓The real thing ✓ Test people & processes Adversary Emulation Data Analytics Pros and Cons x Business disruption x Resource intensive x Miss detective controls x Miss processes
  • 65.
    Adversary Emulation is essential butshould be practiced cautiously Takeaways Data Analytics is better for assessing defensive coverage can be assessed using ATT&CK mitigations Defensive Coverage
  • 66.
    : matanhart : @machosec :matan@cymptom.com Let's Talk!
  • 67.
    Brandon Levene Head ofApplied Intelligence Google
  • 68.
    TA505 A Study ofHigh End Big Game Hunting in 2020 Brandon Levene ATT&CKCON October 9th, 2020
  • 69.
    Proprietary + Confidential Opportunisticallytargeted ransomware deployments, aka Big Game Hunting (BGH), have caused a distinct disruption in the mechanics of monetizing crimeware compromises.
  • 70.
    Agenda Context andbackground Threat actor process Lessons learned Operational details 02 01 03 04
  • 71.
    Context and background Threatactor process Lessons learned Operational details 02 01 03 04
  • 72.
    Who is TA505? Customerof Dridex banking Trojan as well as Locky and Jaff Ransomware families from 2014-2017 NOT the developers of the tools above (that would be ‘EvilCorp’) Shift to backdoors in 2018 which coincides with a decrease in bespoke banking trojans and non-targeted ransomware Rapidly shifted through initial loaders and secondary payloads throughout 2018 and 2019, slowly shifted towards “in house” tooling Users* of CLOP ransomware (first seen in Feb 2019) as primary monetization mechanism There do not appear to be any other users, so this is likely another in- house tool Context and background
  • 73.
    Proprietary + Confidential TA505activity since 2018 has lead to... Context and background
  • 74.
    NETZSCH GROUP BASEDIN GERMANY ALLEGEDLY BREACHED BY COP RANSOMWARE OPERATORS Hackers publish ExecuPharm internal data after ransomware attack CL0P Ransomware Breached UK’s Largest Privately-Owned Logistics Company--EV Cargo Logistics Ransomware Hits maastricht University, all Systems Taken Down Indiabulls Group hit by CLOP Ransomware, gets 24h leak deadline
  • 75.
    Context and background Threatactor process02 01 Lessons learned Operational details03 04
  • 76.
    Source: ANSSI https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-009.pdf Threatactor process Overview TA505 Legitimate compromised domain Malicious domain Malicious email HTML + Javascript Redirecting URL Phishing page Malicious office document Victim Malware 1 SENDS CONTAINS HOSTS HOSTSHOSTS 6 DROPS AND EXECUTES 2 3 4 5OPENS REDIRECTION DOWNLOADS AND ACTIVATES THE MACROS REDIRECTION
  • 77.
    Context and background Threatactor process Operational details 02 01 03 Lessons learned04
  • 78.
    Operational details Spear Phishing- T1192 + Spear Phishing Attachment - T1193 Initial Access
  • 79.
    Operational details User Execution+ T1204 [.002] Execution
  • 80.
    Operational details Ingress ToolTransfer - T1055 Command and control
  • 81.
    Operational details Process Injection- T1055 Defense Evasion and Priv Esc Application Layer Protocol - T1071 Command and control
  • 82.
    Operational details Event TriggeredExecution - T1546 (image file execution injections, sub .012) Persistence
  • 83.
    Operational details Permission GroupsDiscovery - T1069 Discovery Subvert Trust Controls - T1553 Defense Evasion
  • 84.
    Operational details Data Encryptedfor Impact - T1486 Impact
  • 85.
  • 86.
    Context and background Threatactor process Lessons learned Operational details 02 01 03 04
  • 87.
    Compliment defense indepth with detection in depth Study TTPs to seize interdiction opportunities Detecting the ransomware itself is too late Attackers use a blend of tools and techniques to get the job done: don’t overlook open source tools as too “amateur” Visibility is key
  • 88.
  • 89.
    ©2020 The MITRECorporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 What’s New with ATT&CK® for Cloud? Jen Burns @snarejen @MITREattack
  • 90.
    ©2020 The MITRECorporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-000000 | 90 | for Cloud Credit to Dave Herrald and Ryan Kovar
  • 91.
    ©2020 The MITRECorporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 ATT&CK for Cloud Beginnings • Initial Release October 2019 • Part of Enterprise ATT&CK • Almost 100% community- contributed techniques! • Input from: • A cloud service provider • Threat analysts • Detection analysts • Red teams
  • 92.
    ©2020 The MITRECorporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 ATT&CK for Cloud Today
  • 93.
    ©2020 The MITRECorporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 ATT&CK for Cloud Scope Add techniques generally visible via Cloud data sources • AWS CloudTrail Logs • Azure Activity Logs • Office365 Audit Logs • etc… Minimize duplication across Windows/Linux/macOS • Cloud is meant to add an additional layer to ATT&CK • Example: • An adversary may abuse Cron (T1053.003) on a Linux EC2 instance. That’s already covered by the Linux matrix, so we don’t add it to AWS.
  • 94.
    ©2020 The MITRECorporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 Future of Cloud Platforms Current Future SaaS IaaS Additional SaaS platforms…. Additional SaaS platforms…. Additional SaaS platforms…. SaaS
  • 95.
    ©2020 The MITRECorporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 Why generalize to IaaS? • Current IaaS platforms share most techniques • Differences between Cloud Service Providers (CSPs) can be documented within the technique • All CSPs can be represented • Community feedback favors a single platform
  • 96.
    ©2020 The MITRECorporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 Cloud Data Sources Today • AWS CloudTrail logs • Azure activity logs • GCP audit logs • Oauth audit logs • Office 365 trace logs…
  • 97.
    ©2020 The MITRECorporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 Future of Cloud Data Sources • Data Source • One or more Data Components • Mapping(s) to Relevant Azure Operation Name(s) • Mapping(s) to Relevant AWS CloudTrail Event Name(s) • Mapping(s) to Relevant GCP REST API Method(s) • Mapping(s) to Other CSPs or SaaS Events https://media.giphy.com/media/l41m6QYDHcEEwjo52/giphy.gif
  • 98.
    ©2020 The MITRECorporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 Example IaaS Data Source Instance Data Source Data Component Events (API) Instance Creation Instance Modification Instance Deletion Instance Metadata Instance Enumeration Instance Start Instance Stop AWS: ListInstances AWS: ModifyInstanceAttribute AWS: TerminateInstances AWS: DescribeInstances AWS: RunInstances AWS: StartInstances AWS: StopInstances
  • 99.
    ©2020 The MITRECorporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 Why the change? • Ensure approach is consistent with the rest of Enterprise • Suggest reading blog from Jose Luis Rodriguez • https://medium.com/mitre-attack/defining-attack-data-sources-part-i- 4c39e581454f • Create more meaningful data sources for Cloud • Move away from the “everything is logs” approach • Refactor to align to events and API calls within these logs instead • Align to future Cloud platform updates
  • 100.
    ©2020 The MITRECorporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 We need your help! Do you have… • thoughts on how can we improve ATT&CK for Cloud? • “in the wild” visibility into adversaries in the Cloud? • opinions on our platform or data source plans?
  • 101.
    ©2020 The MITRECorporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-00841-13 attack@mitre.org @MITREattack Jen Burns @snarejen
  • 102.
    Join our nextsession on November 12 Register now! https://na.eventscloud.com/ATTACKcon-november