SlideShare a Scribd company logo

Projects to Impact- Operationalizing Work from the Center

M
MITRE ATT&CK

The Center for Threat-Informed Defense conducts collaborative R&D projects to improve cyber defense. The Center's work includes developing standardized adversary emulation plans, mapping vulnerabilities to adversary tactics and techniques, and creating tools to help organizations integrate threat information. All of the Center's project outputs are made freely available to help defenders worldwide.

Technology
1 of 16
Downloaded 96 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
Projects to Impact: Operationalizing Work from the Center © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043 Ingrid Skoog March 30, 2022
The Center for Threat-Informed Defense conducts collaborative R&D projects that improve cyber defense at scale + Members as of November 2021 Membership is: ❑ Highly-sophisticated ❑ Global & cross-sector ❑ Non-governmental ❑ Committed to collaborative R&D in the public interest © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043 29 1 28 32 4 24
Our Focus: R&D The outputs of all Center R&D projects are made freely-available globally © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
Our repeatable,scalable,agile researchprojects are built on member-powered collaboration Flexibility Collaboration Openness Leadership Our values drive our research process Ideas submitted to the idea market Idea Market Based on priorities, insights, and funding Selection Member-funded projects assigned to dedicated MITRE experts Research R&D projects outputs released freely-available Completed Project © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
Selected R&D Projects ctid.mitre-engenuity.org/our-work © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
Adversary Emulation Library Problem Understanding defenses from the perspective of the adversary is critical, but often teams lack the resources (expertise and funding) to conduct adversary emulation exercises. Solution Impact Establish a library of standardized intelligence driven adversary emulation plans that can be easily leveraged by cyber defenders. Accelerate research into automated TTP identification in threat intel reports to greatly reduce the time and effort required to integrate new intelligence into cyber operations. FIN6 menuPass © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
Use Case: Red and Purple Team Operations Planning Implementing TTPs Execution Rewards Scope questions and metrics to of interest Explore and document findings Exploit results for innovations/ improvements Prepare emulation content from library © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
CVE-2018-17900 (Unsecure Credentials) allows T1190 (Exploit Public-Facing Application) enables T1552 (Unsecure Credentials) leads to T1078 (Valid Accounts) Vulnerability Adversary Behaviors from MITRE ATT&CK® Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, have Unsecure Credentials which could allow an attacker to gain access to Valid Accounts by Exploiting the Public-Facing Application. CVE® + MITRE ATT&CK® = Mapping ATT&CK to CVE for Impact Problem Defenders struggle to integrate vulnerability and threat information and lack a consistent view of how adversaries use vulnerabilities to achieve their goals. Without this context, it is difficult to appropriately prioritize vulnerabilities. Solution Impact Develop a repeatable methodology to use the adversary behaviors described in ATT&CK to characterize the impact of CVEs, providing much-needed context. CVEs linked to ATT&CK TTPs form a crucial contextual bridge between vulnerability and threat management, empowering defenders to better assess the true risk posed by specific vulnerabilities in their environment. © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
NIST 800-53 Controls to ATT&CK Mappings Problem Large and complex security control frameworks such as NIST 800-53 do not relate to actionable TTPS in ATT&CK. Solution Impact Create a comprehensive and open, curated set of mappings between 800-53 controls and ATT&CK techniques. Defenders can quickly focus on understanding how the controls in use in their environment relate to adversary TTPs of interest to them. https://ctid.mitre-engenuity.org/our- work/nist-800-53-control-mappings/ © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
Cloud Security Stack Mappings Problem Defenders lack a comprehensive view of how native cloud security controls defend against real-world adversary TTPs. Solution Impact Map the effectiveness of each AWS and Azure security control against specific ATT&CK techniques. Empowers defenders with independent assessments of which AWS and Azure security controls are effective to mitigate relevant adversary TTPs. Amazon Web Services Microsoft Azure © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
Use Case: Bridging Teams © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043 Protect Detect Respond Controls
ATT&CK Workbench Problem Defenders struggle to integrate their organization’s local knowledge of adversaries and their TTPs with the public ATT&CK knowledge base. Solution Impact Build an open-source software tool that allows organizations to manage and extend their own local version of ATT&CK and keep it in sync with MITRE’s knowledge base. Drastically reduces the barriers for defenders to ensure that their threat intelligence is aligned with the public ATT&CK knowledge base. Allow users to explore, create, annotate, and share extensions of MITRE ATT&CK. © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
Use Case: Expanded Group Tracking and/or ATT&CK New Objects ATT&CK with modified objects APT3+ FIN6+ MimiKatz+ Credential Dumping+ New Objects Are Added Existing objects within ATT&CK are updated + Fill in gaps in open-source reporting by creating new groups. Map new groups to new and existing techniques. © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
© 2022 MITRE Engenuity. Approved for public release. Document Number CT0043 Cyber Threat Intelligence Test & Evaluation Defensive Measures
Spread the word to help us increase the impact of our work. Use our work and tell us about it. Share your ideas and they may become Advance the research program by joining us. part of the research program. Check out the Impact Report Follow our R&D https://ctid.mitre-engenuity.org/impact-report/ https://ctid.mitre-engenuity.org/#keep-me-informed Advance threat-informed defense with us © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
© 2022 MITRE Engenuity. Approved for public release. Document Number CT0043

More Related Content

PDF
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
MITRE ATT&CK
 
PDF
It's just a jump to the left (of boom): Prioritizing detection implementation...
MITRE ATT&CK
 
PDF
ATT&CK Updates- Campaigns
MITRE ATT&CK
 
PDF
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
MITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK for mac/Linux
MITRE ATT&CK
 
PDF
Knowledge for the masses: Storytelling with ATT&CK
MITRE ATT&CK
 
PDF
Threat Modelling - It's not just for developers
MITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK's Open Source
MITRE ATT&CK
 
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
MITRE ATT&CK
 
It's just a jump to the left (of boom): Prioritizing detection implementation...
MITRE ATT&CK
 
ATT&CK Updates- Campaigns
MITRE ATT&CK
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
MITRE ATT&CK
 
ATT&CK Updates- ATT&CK for mac/Linux
MITRE ATT&CK
 
Knowledge for the masses: Storytelling with ATT&CK
MITRE ATT&CK
 
Threat Modelling - It's not just for developers
MITRE ATT&CK
 
ATT&CK Updates- ATT&CK's Open Source
MITRE ATT&CK
 

What's hot (20)

PDF
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
MITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK for ICS
MITRE ATT&CK
 
PDF
Mapping ATT&CK Techniques to ENGAGE Activities
MITRE ATT&CK
 
PDF
Automating the mundanity of technique IDs with ATT&CK Detections Collector
MITRE ATT&CK
 
PDF
ATT&CKing the Red/Blue Divide
MITRE ATT&CK
 
PDF
ATT&CK Updates- Defensive ATT&CK
MITRE ATT&CK
 
PDF
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
MITRE ATT&CK
 
PDF
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
MITRE ATT&CK
 
PDF
The ATT&CK Philharmonic
MITRE ATT&CK
 
PDF
The ATT&CK Latin American APT Playbook
MITRE ATT&CK
 
PDF
Landing on Jupyter: The transformative power of data-driven storytelling for ...
MITRE ATT&CK
 
PDF
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
MITRE ATT&CK
 
PDF
ATT&CKcon Intro
MITRE ATT&CK
 
PDF
State of the ATT&CK
MITRE ATT&CK
 
PDF
ATT&CKING Containers in The Cloud
MITRE ATT&CK
 
PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
MITRE ATT&CK
 
PDF
When Insiders ATT&CK!
MITRE ATT&CK
 
PDF
How MITRE ATT&CK helps security operations
Sergey Soldatov
 
PDF
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
MITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
MITRE - ATT&CKcon
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
MITRE ATT&CK
 
ATT&CK Updates- ATT&CK for ICS
MITRE ATT&CK
 
Mapping ATT&CK Techniques to ENGAGE Activities
MITRE ATT&CK
 
Automating the mundanity of technique IDs with ATT&CK Detections Collector
MITRE ATT&CK
 
ATT&CKing the Red/Blue Divide
MITRE ATT&CK
 
ATT&CK Updates- Defensive ATT&CK
MITRE ATT&CK
 
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
MITRE ATT&CK
 
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
MITRE ATT&CK
 
The ATT&CK Philharmonic
MITRE ATT&CK
 
The ATT&CK Latin American APT Playbook
MITRE ATT&CK
 
Landing on Jupyter: The transformative power of data-driven storytelling for ...
MITRE ATT&CK
 
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
MITRE ATT&CK
 
ATT&CKcon Intro
MITRE ATT&CK
 
State of the ATT&CK
MITRE ATT&CK
 
ATT&CKING Containers in The Cloud
MITRE ATT&CK
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
MITRE ATT&CK
 
When Insiders ATT&CK!
MITRE ATT&CK
 
How MITRE ATT&CK helps security operations
Sergey Soldatov
 
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
MITRE - ATT&CKcon
 
Ad

Similar to Projects to Impact- Operationalizing Work from the Center (20)

PDF
Updates from the Center for Threat-Informed Defense
MITRE ATT&CK
 
PDF
Updates from The Center for Threat Informed Defense - Jon Baker
MITRE ATT&CK
 
PPTX
Leveraging MITRE ATT&CK - Speaking the Common Language
Erik Van Buggenhout
 
PDF
MITRE ATT&CK framework and Managed XDR Position Paper
Marc St-Pierre
 
PDF
MITRE A-TAK Design Philosophy
tom termini
 
PPTX
ATT&CKing with Threat Intelligence
Christopher Korban
 
PPTX
Purple Teaming with ATT&CK - x33fcon 2018
Christopher Korban
 
PDF
MITRE ATT&CKcon 2.0: ATT&CK Updates - ICS; Otis Alexander, MITRE
MITRE - ATT&CKcon
 
PPTX
Leverage Endpooint Visibilit with MITRE ATT&CK Framework
Digit Oktavianto
 
PDF
Introduction to MITRE’s ATT&CK Framework.pdf
seyohah504
 
PDF
Secure 2019 - APT for Everyone - Adversary Simulations based on ATT&CK Framework
Leszek Mi?
 
PDF
Using the MITRE ATT&CK framework to analyze real-world cyberattacks
lucytyrteos
 
PDF
ATT&CKing Your Adversaries - Operationalizing cyber intelligence in your own ...
JamieWilliams130
 
PDF
MITRE ATTACKcon Power Hour - October
MITRE - ATT&CKcon
 
PDF
MITRE Engenuity Center for Threat Informed Defense Impact Report 2022.pdf
AdamAzrylJohan
 
PDF
State of the ATT&CK May 2023
Adam Pennington
 
PDF
State of ATT&CK
Adam Pennington
 
PDF
(SACON) Wayne Tufek - chapter five - attacks
Priyanka Aash
 
PDF
Mitre ATT&CK by Mattias Almeflo Nixu
Nixu Corporation
 
PDF
MITRE ATT&CKcon Power Hour - November
MITRE - ATT&CKcon
 
Updates from the Center for Threat-Informed Defense
MITRE ATT&CK
 
Updates from The Center for Threat Informed Defense - Jon Baker
MITRE ATT&CK
 
Leveraging MITRE ATT&CK - Speaking the Common Language
Erik Van Buggenhout
 
MITRE ATT&CK framework and Managed XDR Position Paper
Marc St-Pierre
 
MITRE A-TAK Design Philosophy
tom termini
 
ATT&CKing with Threat Intelligence
Christopher Korban
 
Purple Teaming with ATT&CK - x33fcon 2018
Christopher Korban
 
MITRE ATT&CKcon 2.0: ATT&CK Updates - ICS; Otis Alexander, MITRE
MITRE - ATT&CKcon
 
Leverage Endpooint Visibilit with MITRE ATT&CK Framework
Digit Oktavianto
 
Introduction to MITRE’s ATT&CK Framework.pdf
seyohah504
 
Secure 2019 - APT for Everyone - Adversary Simulations based on ATT&CK Framework
Leszek Mi?
 
Using the MITRE ATT&CK framework to analyze real-world cyberattacks
lucytyrteos
 
ATT&CKing Your Adversaries - Operationalizing cyber intelligence in your own ...
JamieWilliams130
 
MITRE ATTACKcon Power Hour - October
MITRE - ATT&CKcon
 
MITRE Engenuity Center for Threat Informed Defense Impact Report 2022.pdf
AdamAzrylJohan
 
State of the ATT&CK May 2023
Adam Pennington
 
State of ATT&CK
Adam Pennington
 
(SACON) Wayne Tufek - chapter five - attacks
Priyanka Aash
 
Mitre ATT&CK by Mattias Almeflo Nixu
Nixu Corporation
 
MITRE ATT&CKcon Power Hour - November
MITRE - ATT&CKcon
 
Ad

More from MITRE ATT&CK (20)

PDF
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
MITRE ATT&CK
 
PDF
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
MITRE ATT&CK
 
PDF
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
MITRE ATT&CK
 
PDF
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
MITRE ATT&CK
 
PDF
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
MITRE ATT&CK
 
PDF
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
MITRE ATT&CK
 
PDF
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
MITRE ATT&CK
 
PDF
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
MITRE ATT&CK
 
PDF
Every Cloud Has a Purple Lining - Arun Seelagan
MITRE ATT&CK
 
PDF
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
MITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
MITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Lightning Talks - Various Speakers
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Enterprise - Casey Knerr
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Software - Jared Ondricek
MITRE ATT&CK
 
PDF
State of the ATT&CK 2024 - Adam Pennington
MITRE ATT&CK
 
PDF
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
MITRE ATT&CK
 
PDF
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
MITRE ATT&CK
 
PDF
ATT&CK From Basic Principles - Tareq AlKhatib
MITRE ATT&CK
 
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
MITRE ATT&CK
 
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
MITRE ATT&CK
 
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
MITRE ATT&CK
 
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
MITRE ATT&CK
 
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
MITRE ATT&CK
 
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
MITRE ATT&CK
 
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
MITRE ATT&CK
 
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
MITRE ATT&CK
 
Every Cloud Has a Purple Lining - Arun Seelagan
MITRE ATT&CK
 
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
MITRE ATT&CK
 
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
MITRE ATT&CK
 
ATT&CKcon 5.0 Lightning Talks - Various Speakers
MITRE ATT&CK
 
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
MITRE ATT&CK
 
MITRE ATT&CK Updates: Enterprise - Casey Knerr
MITRE ATT&CK
 
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
MITRE ATT&CK
 
MITRE ATT&CK Updates: Software - Jared Ondricek
MITRE ATT&CK
 
State of the ATT&CK 2024 - Adam Pennington
MITRE ATT&CK
 
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
MITRE ATT&CK
 
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
MITRE ATT&CK
 
ATT&CK From Basic Principles - Tareq AlKhatib
MITRE ATT&CK
 

Recently uploaded (20)

PDF
Encapsulation theory and applications.pdf
gurumoop
 
PDF
A comparative study of natural language inference in Swahili using monolingua...
IAESIJAI
 
PDF
Accuracy of neural networks in brain wave diagnosis of schizophrenia
IAESIJAI
 
PPTX
OMC Textile Division Presentation 2021.pptx
JahangirAlam816069
 
PDF
Enhancing emotion recognition model for a student engagement use case through...
IAESIJAI
 
PPTX
A Presentation on Artificial Intelligence
memembruh336
 
PDF
Approach and Philosophy of On baking technology
30anthuong17
 
PPTX
Group 1 Presentation -Planning and Decision Making .pptx
MatthewLewis227954
 
PDF
Transform Your ITIL® 4 & ITSM Strategy with AI in 2025.pdf
PDCA Consulting
 
PDF
NewMind AI Weekly Chronicles - August'25-Week II
NewMind AI
 
PPTX
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
PPTX
SOPHOS-XG Firewall Administrator PPT.pptx
AgnesMunisi
 
PDF
ENT215_Completing-a-large-scale-migration-and-modernization-with-AWS.pdf
ssuser28425f
 
PDF
Video forgery: An extensive analysis of inter-and intra-frame manipulation al...
IAESIJAI
 
PDF
Unlocking AI with Model Context Protocol (MCP)
Brian McKeiver
 
PDF
From MVP to Full-Scale Product A Startup’s Software Journey.pdf
KodekX
 
PDF
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
PDF
Web App vs Mobile App What Should You Build First.pdf
KodekX
 
PDF
Mushroom cultivation and it's methods.pdf
mailmeonrishi
 
PDF
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 
Encapsulation theory and applications.pdf
gurumoop
 
A comparative study of natural language inference in Swahili using monolingua...
IAESIJAI
 
Accuracy of neural networks in brain wave diagnosis of schizophrenia
IAESIJAI
 
OMC Textile Division Presentation 2021.pptx
JahangirAlam816069
 
Enhancing emotion recognition model for a student engagement use case through...
IAESIJAI
 
A Presentation on Artificial Intelligence
memembruh336
 
Approach and Philosophy of On baking technology
30anthuong17
 
Group 1 Presentation -Planning and Decision Making .pptx
MatthewLewis227954
 
Transform Your ITIL® 4 & ITSM Strategy with AI in 2025.pdf
PDCA Consulting
 
NewMind AI Weekly Chronicles - August'25-Week II
NewMind AI
 
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
SOPHOS-XG Firewall Administrator PPT.pptx
AgnesMunisi
 
ENT215_Completing-a-large-scale-migration-and-modernization-with-AWS.pdf
ssuser28425f
 
Video forgery: An extensive analysis of inter-and intra-frame manipulation al...
IAESIJAI
 
Unlocking AI with Model Context Protocol (MCP)
Brian McKeiver
 
From MVP to Full-Scale Product A Startup’s Software Journey.pdf
KodekX
 
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
Web App vs Mobile App What Should You Build First.pdf
KodekX
 
Mushroom cultivation and it's methods.pdf
mailmeonrishi
 
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 

Projects to Impact- Operationalizing Work from the Center

  • 1. Projects to Impact: Operationalizing Work from the Center © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043 Ingrid Skoog March 30, 2022
  • 2. The Center for Threat-Informed Defense conducts collaborative R&D projects that improve cyber defense at scale + Members as of November 2021 Membership is: ❑ Highly-sophisticated ❑ Global & cross-sector ❑ Non-governmental ❑ Committed to collaborative R&D in the public interest © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043 29 1 28 32 4 24
  • 3. Our Focus: R&D The outputs of all Center R&D projects are made freely-available globally © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
  • 4. Our repeatable,scalable,agile researchprojects are built on member-powered collaboration Flexibility Collaboration Openness Leadership Our values drive our research process Ideas submitted to the idea market Idea Market Based on priorities, insights, and funding Selection Member-funded projects assigned to dedicated MITRE experts Research R&D projects outputs released freely-available Completed Project © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
  • 5. Selected R&D Projects ctid.mitre-engenuity.org/our-work © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
  • 6. Adversary Emulation Library Problem Understanding defenses from the perspective of the adversary is critical, but often teams lack the resources (expertise and funding) to conduct adversary emulation exercises. Solution Impact Establish a library of standardized intelligence driven adversary emulation plans that can be easily leveraged by cyber defenders. Accelerate research into automated TTP identification in threat intel reports to greatly reduce the time and effort required to integrate new intelligence into cyber operations. FIN6 menuPass © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
  • 7. Use Case: Red and Purple Team Operations Planning Implementing TTPs Execution Rewards Scope questions and metrics to of interest Explore and document findings Exploit results for innovations/ improvements Prepare emulation content from library © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
  • 8. CVE-2018-17900 (Unsecure Credentials) allows T1190 (Exploit Public-Facing Application) enables T1552 (Unsecure Credentials) leads to T1078 (Valid Accounts) Vulnerability Adversary Behaviors from MITRE ATT&CK® Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, have Unsecure Credentials which could allow an attacker to gain access to Valid Accounts by Exploiting the Public-Facing Application. CVE® + MITRE ATT&CK® = Mapping ATT&CK to CVE for Impact Problem Defenders struggle to integrate vulnerability and threat information and lack a consistent view of how adversaries use vulnerabilities to achieve their goals. Without this context, it is difficult to appropriately prioritize vulnerabilities. Solution Impact Develop a repeatable methodology to use the adversary behaviors described in ATT&CK to characterize the impact of CVEs, providing much-needed context. CVEs linked to ATT&CK TTPs form a crucial contextual bridge between vulnerability and threat management, empowering defenders to better assess the true risk posed by specific vulnerabilities in their environment. © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
  • 9. NIST 800-53 Controls to ATT&CK Mappings Problem Large and complex security control frameworks such as NIST 800-53 do not relate to actionable TTPS in ATT&CK. Solution Impact Create a comprehensive and open, curated set of mappings between 800-53 controls and ATT&CK techniques. Defenders can quickly focus on understanding how the controls in use in their environment relate to adversary TTPs of interest to them. https://ctid.mitre-engenuity.org/our- work/nist-800-53-control-mappings/ © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
  • 10. Cloud Security Stack Mappings Problem Defenders lack a comprehensive view of how native cloud security controls defend against real-world adversary TTPs. Solution Impact Map the effectiveness of each AWS and Azure security control against specific ATT&CK techniques. Empowers defenders with independent assessments of which AWS and Azure security controls are effective to mitigate relevant adversary TTPs. Amazon Web Services Microsoft Azure © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
  • 11. Use Case: Bridging Teams © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043 Protect Detect Respond Controls
  • 12. ATT&CK Workbench Problem Defenders struggle to integrate their organization’s local knowledge of adversaries and their TTPs with the public ATT&CK knowledge base. Solution Impact Build an open-source software tool that allows organizations to manage and extend their own local version of ATT&CK and keep it in sync with MITRE’s knowledge base. Drastically reduces the barriers for defenders to ensure that their threat intelligence is aligned with the public ATT&CK knowledge base. Allow users to explore, create, annotate, and share extensions of MITRE ATT&CK. © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
  • 13. Use Case: Expanded Group Tracking and/or ATT&CK New Objects ATT&CK with modified objects APT3+ FIN6+ MimiKatz+ Credential Dumping+ New Objects Are Added Existing objects within ATT&CK are updated + Fill in gaps in open-source reporting by creating new groups. Map new groups to new and existing techniques. © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
  • 14. © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043 Cyber Threat Intelligence Test & Evaluation Defensive Measures
  • 15. Spread the word to help us increase the impact of our work. Use our work and tell us about it. Share your ideas and they may become Advance the research program by joining us. part of the research program. Check out the Impact Report Follow our R&D https://ctid.mitre-engenuity.org/impact-report/ https://ctid.mitre-engenuity.org/#keep-me-informed Advance threat-informed defense with us © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
  • 16. © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043