SlideShare a Scribd company logo

Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert Funches

M
MITRE ATT&CK

The document discusses the sources and prerequisites of the MITRE ATT&CK framework, emphasizing the importance of understanding adversarial perspectives and utilizing real-world data. It covers various sources of information that contribute to ATT&CK techniques and presents statistical insights on references across different domains and the evolution of ATT&CK objects. Additionally, it offers guidance for cyber threat intelligence producers, blue/red teamers, and PowerShell users on improving their engagement with ATT&CK resources.

Technology
1 of 46
Downloaded 20 times
1
2
Most read
3
4
Most read
5
6
7
8
9
10
11
12
13
14
15
16
Most read
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
Sources of ATT&CK A Bibliographic Journey Through Enterprise ATT&CK Robert J. Funches ATT&CKcon 5.0, October 22-23, 2024 Illustration by John Tenniel. Alice’s Adventures in Wonderland (1865) MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.
PS > $Env:USER • Senior Cyber Security Engineer* • CISSP® • Windows security • Detection engineering • API integration • Identity solutions • Commentary & photography: robertjfunches.com *This talk is presented on an independent basis and not affiliated with my employer. Any views or opinions expressed are my own. This document does not contain controlled technical data as defined within the International Traffic in Arms Regulations (ITAR), Part 120.10, or Export Administration Regulations (EAR), Part 734.7-10. (PRR ID806)
Pre[requisites of] ATT&CK There are three conceptual ideas that are core to the philosophy behind ATT&CK: •It maintains the adversary’s perspective; •It follows real-world use of activity through empirical use examples; •The level of abstraction is appropriate to bridge offensive action with possible defensive countermeasures. “ ” Pg. 20, MITRE ATT&CK: Design and Philosophy (2020)
Pre[requisites of] ATT&CK New information relevant to ATT&CK techniques can come from many different sources. These sources are used to help meet the empirical use criteria: •Threat intelligence reports •Conference presentations •Webinars •Social media •Blogs •Open source code repositories •Malware samples “ ” Pg. 21, MITRE ATT&CK: Design and Philosophy (2020)
…and what is the use of a book without pictures or conversations? “ ” Illustration by Arthur Rackham. Text by Lewis Carroll. Alice’s Adventures in Wonderland (n.d.) Alice
Illustration by Arthur Rackham. Alice’s Adventures in Wonderland (n.d.) Exfiltration Over Alternative Protocol ← (T1048) d
The rabbit asks: “What’s at the bottom of this page?”
ATT&CK Website ATT&CK Workbench Screenshot by MITRE Engenuity ATT&CK Navigator mitreattack-python pip install mitreattack-python from mitreattack.stix20 import MitreAttackData
ATT&CK STIX Data
• ATT&CK Website • ATT&CK Navigator • ATT&CK Workbench • mitreattack-python • ATT&CK in Excel ATT&CK STIX uses
PS C: > Install-Module –Name invoke-atomicredteam, powershell-yaml –Scope CurrentUser PS C: > Invoke-AtomicTest T1048 –CheckPrereqs PS C: > Invoke-AtomicTest T1048 Atomic Red Team / Invoke-Atomic Invoke-Atomic only accepts technique IDs (not a critique!)
Illustration by J.G. Sowerby and H.H. Emmerson. Afternoon Tea: Rhymes for Children (1880) Wouldn’t it be fun to perform adversary emulation by software instead of technique? Nobody asked your opinion.
How do we map Linux Rabbit to its techniques?
ATT&CK data ??? Illustration credit unk. Wikimedia Commons / Open Clipart Awesome Windows red teamer Atomic Red Team / Invoke-Atomic
Illustration credit unk. Wikimedia Commons / Open Clipart ATT&CK STIX JSON Awesome Windows red teamer Atomic Red Team / Invoke-Atomic PowerShell 7
Using ATT&CK STIX to Crosswalk Techniques (ex: get all techniques for malware “Linux Rabbit”)
external_references (a blob of nested JSON)
external_references (nicely formatted JSON objects)
The rabbit asks: “What’s at the bottom of this page?”
Answer: References
22981 Total references* 3268 Unique references* Data from Enterprise ATT&CK version 14.1. *Excludes identity, marking-definition, and x-mitre-* object types
What can we learn from these references?
Data from Enterprise ATT&CK version 14.1. References have been deduplicated. References by website top-level domain (TLD) 80% .com 7% .org 4% .gov 3% .io 47 total TLDs com 80% org 7% gov 4% io 3% net 2% other 2% uk 1% co 1%
welivesecurit y.com 2% securelist.co m 2% crowdstrike.c om 2% secureworks. com 2% symantec .com 1% archive.o rg 1% talosintel ligence.c om 1% cisa.gov 1% apple.co m 1% github.io 1% malware bytes.co m 1% mandiant.c om 1% amazon.c om 1% cisco.co m 1% medium .com 1% proofpo int.com 1% wikipedi a.org 1% google.co m 1% cert.gov 1% cybereaso n.com 1% mcafee .com 1% twitter. com 1% sentine lone.co m 1% checkpoint. com 1% bleepingco mputer.co… security.co m 1% other 59% microsoft.com 14% github.co m 4% paloaltonet works.com 4% fireeye.co m 4% trendmicro. com 3% Data from Enterprise ATT&CK version 14.1. References have been deduplicated. (580 domain names) References by domain name 14% microsoft.com 4% fireeye.com 4% paloaltonetworks.com 4% github.com 590 total domain names
Data from Enterprise ATT&CK version 14.1 References by year published, per ATT&CK object type 0 500 1000 1500 2000 2500 3000 3500 4000 1982 1986 1990 1994 1998 2002 2006 2010 2014 2018 2022 attack-pattern campaign course-of-action intrusion-set malware relationship tool
0 500 1000 1500 2000 2500 3000 3500 4000 1982 1986 1990 1994 1998 2002 2006 2010 2014 2018 2022 attack-pattern campaign course-of-action intrusion-set malware relationship tool Data from Enterprise ATT&CK version 14.1 References by year published, per ATT&CK object type
Data from Enterprise ATT&CK version 14.1
Data from Enterprise ATT&CK version 14.1. References have been deduplicated. References without publication dates Has Publication Date 2803 No Date 475 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Data from Enterprise ATT&CK version 14.1 References by year ATT&CK object was added 0 500 1000 1500 2000 2500 3000 3500 4000 4500 attack-pattern campaign course-of-action intrusion-set malware relationship tool 2017 2018 2019 2020 2021 2022 2023
Data from Enterprise ATT&CK version 14.1. References have been deduplicated ATT&CK objects by year added 0 500 1000 1500 2000 2500 3000 3500 4000 4500 attack-pattern campaign course-of-action intrusion-set malware relationship tool 2017 2018 2019 2020 2021 2022 2023
60 25 26 44 10 5 8 16 321 26 23 21 0 50 100 150 200 250 300 350 2017 2018 2019 2020 2021 2022 2023 Technique Sub-Technique Data from Enterprise ATT&CK version 14.1 Techniques vs. sub-techniques, year added
Sub-techniques were added in 2020 (versions 7.0-beta and 7.2)
Data from Enterprise ATT&CK version 14.1 102 106 95 85 55 37 42 21 17 8 6 5 0 2 3 1 0 20 40 60 80 100 120 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Technique objects Number of references Number of references per ATT&CK technique
Data from Enterprise ATT&CK version 14.1 Number of references per ATT&CK relationship object 11163 2178 534 183 68 48 19 15 10 5 0 2000 4000 6000 8000 10000 12000 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Relationship objects Number of references
0 100 200 300 400 500 600 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 ATT&CK objects Number of references attack-pattern campaign intrusion-set malware tool Number of references per ATT&CK object type Data from Enterprise ATT&CK version 14.1. Excludes relationship objects.
Data from Enterprise ATT&CK version 14.1 Object Type # of References ATT&CK ID Name Tool 5 S1040 S1063 Rclone Brute Ratel C4 Software 13 S0367 Emotet Campaign 13 C0024 SolarWinds Compromise Technique 18 T1547.006 Kernel Modules and Extensions Group 28 G0016 APT29 Most number of references by object type
Data from Enterprise ATT&CK version 14.1. Excludes relationship objects. How often references are reused in ATT&CK 2114 464 139 50 29 11 7 5 1 1 1 1 3 1 1 1 0 500 1000 1500 2000 2500 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 Count of References Count of Times Reference Used
2114 464 139 50 29 11 7 5 1 1 1 1 3 1 1 1 0 500 1000 1500 2000 2500 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 Count of References Count of Times Reference Used Data from Enterprise ATT&CK version 14.1. Excludes relationship objects. How often references are reused in ATT&CK
Data from Enterprise ATT&CK version 14.1 Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016. T1001 T1001.001 T1001.002 T1001.003 T1008 T1030 T1041 T1048 T1048.001 T1048.002 T1048.003 T1071 T1071.001 T1071.002 T1071.003 T1071.004 T1090 T1090.001 T1090.002 T1095 T1102 T1102.001 T1102.002 T1102.003 T1005 T1132 T1132.001 T1132.002 T1571 T1572 T1573 T1573.001 T1573.002 14 techniques + 19 sub-techniques = 33
Exfiltration Over Alternative Protocol ← (T1048) d Illustration by Arthur Rackham. Alice’s Adventures in Wonderland (n.d.)
If you maintain ATT&CK… • Keep working on data normalization and quality control T1574.001 / “Microsoft Security Advisory 2269637” - malformed published date: “(, May 23)” T1218 / “split man page” - malformed published date: “(2020, March null)” G1001 / “SecureWorks August 2019” - malformed published date (missing parentheses?) - malformed retrieval date: “Retrieved. 2019/11/19”
If you produce cyber threat intelligence… • Keep doing what you’re doing • Open reporting is important to the community • Consider directly contributing content to ATT&CK based on your own research • Encourage others to produce CTI
If you are blue/red/purple teaming… • Read the underlying sources of ATT&CK as you use objects from the framework • Discover new sources of CTI • Help drive web traffic to smaller sources…they deserve attention too
If you work with decision makers… • Pitch ATT&CK on its deep roots in CTI • Highlight the robust nature of the dataset • Demonstrate its usefulness in the cyber toolbox
If you work in PowerShell… • PowerShell lacks a current mitreattack-python module • A few projects on GitHub, but out of date
The End Illustration by John Tenniel. Cheshire Cat in the Tree Above Alice (1889)

More Related Content

PDF
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
Katie Nickels
 
PPTX
Leveraging MITRE ATT&CK - Speaking the Common Language
Erik Van Buggenhout
 
PDF
MITRE-Module 1 Slides.pdf
ReZa AdineH
 
PDF
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
MITRE ATT&CK
 
PDF
MITRE ATT&CKcon 2.0: State of the ATT&CK; Blake Strom, MITRE
MITRE - ATT&CKcon
 
PDF
MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)
MITRE ATT&CK
 
PDF
MITRE A-TAK Design Philosophy
tom termini
 
PPTX
ATT&CKing with Threat Intelligence
Christopher Korban
 
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
Katie Nickels
 
Leveraging MITRE ATT&CK - Speaking the Common Language
Erik Van Buggenhout
 
MITRE-Module 1 Slides.pdf
ReZa AdineH
 
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
MITRE ATT&CK
 
MITRE ATT&CKcon 2.0: State of the ATT&CK; Blake Strom, MITRE
MITRE - ATT&CKcon
 
MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)
MITRE ATT&CK
 
MITRE A-TAK Design Philosophy
tom termini
 
ATT&CKing with Threat Intelligence
Christopher Korban
 

Similar to Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert Funches (20)

PDF
MITRE-Module 2 Slides.pdf
ReZa AdineH
 
PDF
Mitre getting-started-with-attack-october-2019
Thang Nguyen
 
PDF
MITRE_ATTACK_Enterprise_11x17.pdf
AisyiFree
 
PPTX
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
Harry McLaren
 
PDF
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
Adam Pennington
 
PDF
State of the ATT&CK
MITRE ATT&CK
 
PDF
Slideshare.net rh-isac summit 2019 - adam pennington - leveraging mitre at ta...
Robert Brandel
 
PPTX
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
Adam Pennington
 
PDF
State of ATT&CK
Adam Pennington
 
PDF
I can haz cake: Benefits of working with MITRE on ATT&CK
MITRE ATT&CK
 
PDF
How MITRE ATT&CK helps security operations
Sergey Soldatov
 
PDF
MITRE ATT&CKcon Power Hour - November
MITRE - ATT&CKcon
 
PDF
MITRE AttACK framework it is time you took notice_v1.0
Michael Gough
 
PDF
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
MITRE ATT&CK
 
PPTX
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Katie Nickels
 
PDF
MITRE-Module 4 Slides.pdf
ReZa AdineH
 
PDF
Secure 2019 - APT for Everyone - Adversary Simulations based on ATT&CK Framework
Leszek Mi?
 
PDF
Automation: The Wonderful Wizard of CTI (or is it?)
MITRE ATT&CK
 
PDF
Mitre ATT&CK by Mattias Almeflo Nixu
Nixu Corporation
 
PDF
State of the ATT&CK May 2023
Adam Pennington
 
MITRE-Module 2 Slides.pdf
ReZa AdineH
 
Mitre getting-started-with-attack-october-2019
Thang Nguyen
 
MITRE_ATTACK_Enterprise_11x17.pdf
AisyiFree
 
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
Harry McLaren
 
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
Adam Pennington
 
State of the ATT&CK
MITRE ATT&CK
 
Slideshare.net rh-isac summit 2019 - adam pennington - leveraging mitre at ta...
Robert Brandel
 
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
Adam Pennington
 
State of ATT&CK
Adam Pennington
 
I can haz cake: Benefits of working with MITRE on ATT&CK
MITRE ATT&CK
 
How MITRE ATT&CK helps security operations
Sergey Soldatov
 
MITRE ATT&CKcon Power Hour - November
MITRE - ATT&CKcon
 
MITRE AttACK framework it is time you took notice_v1.0
Michael Gough
 
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
MITRE ATT&CK
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Katie Nickels
 
MITRE-Module 4 Slides.pdf
ReZa AdineH
 
Secure 2019 - APT for Everyone - Adversary Simulations based on ATT&CK Framework
Leszek Mi?
 
Automation: The Wonderful Wizard of CTI (or is it?)
MITRE ATT&CK
 
Mitre ATT&CK by Mattias Almeflo Nixu
Nixu Corporation
 
State of the ATT&CK May 2023
Adam Pennington
 
Ad

More from MITRE ATT&CK (20)

PDF
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
MITRE ATT&CK
 
PDF
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
MITRE ATT&CK
 
PDF
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
MITRE ATT&CK
 
PDF
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
MITRE ATT&CK
 
PDF
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
MITRE ATT&CK
 
PDF
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
MITRE ATT&CK
 
PDF
Every Cloud Has a Purple Lining - Arun Seelagan
MITRE ATT&CK
 
PDF
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
MITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
MITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Lightning Talks - Various Speakers
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Enterprise - Casey Knerr
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Software - Jared Ondricek
MITRE ATT&CK
 
PDF
State of the ATT&CK 2024 - Adam Pennington
MITRE ATT&CK
 
PDF
Updates from The Center for Threat Informed Defense - Jon Baker
MITRE ATT&CK
 
PDF
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
MITRE ATT&CK
 
PDF
ATT&CK From Basic Principles - Tareq AlKhatib
MITRE ATT&CK
 
PDF
Lifecycle-Aware Power Side-Channel Malware Detection - Alexander Cathis
MITRE ATT&CK
 
PDF
From ATT&CK to CL&IM: Cyber Insurance Data Modeling using MITRE ATT&CK and be...
MITRE ATT&CK
 
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
MITRE ATT&CK
 
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
MITRE ATT&CK
 
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
MITRE ATT&CK
 
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
MITRE ATT&CK
 
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
MITRE ATT&CK
 
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
MITRE ATT&CK
 
Every Cloud Has a Purple Lining - Arun Seelagan
MITRE ATT&CK
 
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
MITRE ATT&CK
 
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
MITRE ATT&CK
 
ATT&CKcon 5.0 Lightning Talks - Various Speakers
MITRE ATT&CK
 
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
MITRE ATT&CK
 
MITRE ATT&CK Updates: Enterprise - Casey Knerr
MITRE ATT&CK
 
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
MITRE ATT&CK
 
MITRE ATT&CK Updates: Software - Jared Ondricek
MITRE ATT&CK
 
State of the ATT&CK 2024 - Adam Pennington
MITRE ATT&CK
 
Updates from The Center for Threat Informed Defense - Jon Baker
MITRE ATT&CK
 
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
MITRE ATT&CK
 
ATT&CK From Basic Principles - Tareq AlKhatib
MITRE ATT&CK
 
Lifecycle-Aware Power Side-Channel Malware Detection - Alexander Cathis
MITRE ATT&CK
 
From ATT&CK to CL&IM: Cyber Insurance Data Modeling using MITRE ATT&CK and be...
MITRE ATT&CK
 
Ad

Recently uploaded (20)

PDF
Empathic Computing: Creating Shared Understanding
Mark Billinghurst
 
PDF
CIFDAQ's Market Insight: SEC Turns Pro Crypto
CIFDAQ
 
PPT
Teaching material agriculture food technology
LiaRayya
 
PDF
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
PPTX
PA Analog/Digital System: The Backbone of Modern Surveillance and Communication
AVTRON Technologies LLC
 
PDF
KodekX | Application Modernization Development
KodekX
 
PDF
TokAI - TikTok AI Agent : The First AI Application That Analyzes 10,000+ Vira...
SOFTTECHHUB
 
PDF
Spectral efficient network and resource selection model in 5G networks
IAESIJAI
 
PPTX
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
DOCX
The AUB Centre for AI in Media Proposal.docx
GAONE9
 
PDF
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 
PPTX
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
PDF
Chapter 3 Spatial Domain Image Processing.pdf
Getnet Tigabie Askale -(GM)
 
PPTX
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
PPTX
VMware vSphere Foundation How to Sell Presentation-Ver1.4-2-14-2024.pptx
blackmambaettijean
 
PDF
Bridging biosciences and deep learning for revolutionary discoveries: a compr...
IAESIJAI
 
PDF
Review of recent advances in non-invasive hemoglobin estimation
IAESIJAI
 
PDF
cuic standard and advanced reporting.pdf
SimoneTitaniumTomase
 
PDF
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
Safe Software
 
PDF
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
Akar16
 
Empathic Computing: Creating Shared Understanding
Mark Billinghurst
 
CIFDAQ's Market Insight: SEC Turns Pro Crypto
CIFDAQ
 
Teaching material agriculture food technology
LiaRayya
 
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
PA Analog/Digital System: The Backbone of Modern Surveillance and Communication
AVTRON Technologies LLC
 
KodekX | Application Modernization Development
KodekX
 
TokAI - TikTok AI Agent : The First AI Application That Analyzes 10,000+ Vira...
SOFTTECHHUB
 
Spectral efficient network and resource selection model in 5G networks
IAESIJAI
 
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
The AUB Centre for AI in Media Proposal.docx
GAONE9
 
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
Chapter 3 Spatial Domain Image Processing.pdf
Getnet Tigabie Askale -(GM)
 
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
VMware vSphere Foundation How to Sell Presentation-Ver1.4-2-14-2024.pptx
blackmambaettijean
 
Bridging biosciences and deep learning for revolutionary discoveries: a compr...
IAESIJAI
 
Review of recent advances in non-invasive hemoglobin estimation
IAESIJAI
 
cuic standard and advanced reporting.pdf
SimoneTitaniumTomase
 
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
Safe Software
 
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
Akar16
 

Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert Funches

  • 1. Sources of ATT&CK A Bibliographic Journey Through Enterprise ATT&CK Robert J. Funches ATT&CKcon 5.0, October 22-23, 2024 Illustration by John Tenniel. Alice’s Adventures in Wonderland (1865) MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.
  • 2. PS > $Env:USER • Senior Cyber Security Engineer* • CISSP® • Windows security • Detection engineering • API integration • Identity solutions • Commentary & photography: robertjfunches.com *This talk is presented on an independent basis and not affiliated with my employer. Any views or opinions expressed are my own. This document does not contain controlled technical data as defined within the International Traffic in Arms Regulations (ITAR), Part 120.10, or Export Administration Regulations (EAR), Part 734.7-10. (PRR ID806)
  • 3. Pre[requisites of] ATT&CK There are three conceptual ideas that are core to the philosophy behind ATT&CK: •It maintains the adversary’s perspective; •It follows real-world use of activity through empirical use examples; •The level of abstraction is appropriate to bridge offensive action with possible defensive countermeasures. “ ” Pg. 20, MITRE ATT&CK: Design and Philosophy (2020)
  • 4. Pre[requisites of] ATT&CK New information relevant to ATT&CK techniques can come from many different sources. These sources are used to help meet the empirical use criteria: •Threat intelligence reports •Conference presentations •Webinars •Social media •Blogs •Open source code repositories •Malware samples “ ” Pg. 21, MITRE ATT&CK: Design and Philosophy (2020)
  • 5. …and what is the use of a book without pictures or conversations? “ ” Illustration by Arthur Rackham. Text by Lewis Carroll. Alice’s Adventures in Wonderland (n.d.) Alice
  • 6. Illustration by Arthur Rackham. Alice’s Adventures in Wonderland (n.d.) Exfiltration Over Alternative Protocol ← (T1048) d
  • 7. The rabbit asks: “What’s at the bottom of this page?”
  • 8. ATT&CK Website ATT&CK Workbench Screenshot by MITRE Engenuity ATT&CK Navigator mitreattack-python pip install mitreattack-python from mitreattack.stix20 import MitreAttackData
  • 10. • ATT&CK Website • ATT&CK Navigator • ATT&CK Workbench • mitreattack-python • ATT&CK in Excel ATT&CK STIX uses
  • 11. PS C: > Install-Module –Name invoke-atomicredteam, powershell-yaml –Scope CurrentUser PS C: > Invoke-AtomicTest T1048 –CheckPrereqs PS C: > Invoke-AtomicTest T1048 Atomic Red Team / Invoke-Atomic Invoke-Atomic only accepts technique IDs (not a critique!)
  • 12. Illustration by J.G. Sowerby and H.H. Emmerson. Afternoon Tea: Rhymes for Children (1880) Wouldn’t it be fun to perform adversary emulation by software instead of technique? Nobody asked your opinion.
  • 13. How do we map Linux Rabbit to its techniques?
  • 14. ATT&CK data ??? Illustration credit unk. Wikimedia Commons / Open Clipart Awesome Windows red teamer Atomic Red Team / Invoke-Atomic
  • 15. Illustration credit unk. Wikimedia Commons / Open Clipart ATT&CK STIX JSON Awesome Windows red teamer Atomic Red Team / Invoke-Atomic PowerShell 7
  • 16. Using ATT&CK STIX to Crosswalk Techniques (ex: get all techniques for malware “Linux Rabbit”)
  • 19. The rabbit asks: “What’s at the bottom of this page?”
  • 21. 22981 Total references* 3268 Unique references* Data from Enterprise ATT&CK version 14.1. *Excludes identity, marking-definition, and x-mitre-* object types
  • 22. What can we learn from these references?
  • 23. Data from Enterprise ATT&CK version 14.1. References have been deduplicated. References by website top-level domain (TLD) 80% .com 7% .org 4% .gov 3% .io 47 total TLDs com 80% org 7% gov 4% io 3% net 2% other 2% uk 1% co 1%
  • 24. welivesecurit y.com 2% securelist.co m 2% crowdstrike.c om 2% secureworks. com 2% symantec .com 1% archive.o rg 1% talosintel ligence.c om 1% cisa.gov 1% apple.co m 1% github.io 1% malware bytes.co m 1% mandiant.c om 1% amazon.c om 1% cisco.co m 1% medium .com 1% proofpo int.com 1% wikipedi a.org 1% google.co m 1% cert.gov 1% cybereaso n.com 1% mcafee .com 1% twitter. com 1% sentine lone.co m 1% checkpoint. com 1% bleepingco mputer.co… security.co m 1% other 59% microsoft.com 14% github.co m 4% paloaltonet works.com 4% fireeye.co m 4% trendmicro. com 3% Data from Enterprise ATT&CK version 14.1. References have been deduplicated. (580 domain names) References by domain name 14% microsoft.com 4% fireeye.com 4% paloaltonetworks.com 4% github.com 590 total domain names
  • 25. Data from Enterprise ATT&CK version 14.1 References by year published, per ATT&CK object type 0 500 1000 1500 2000 2500 3000 3500 4000 1982 1986 1990 1994 1998 2002 2006 2010 2014 2018 2022 attack-pattern campaign course-of-action intrusion-set malware relationship tool
  • 26. 0 500 1000 1500 2000 2500 3000 3500 4000 1982 1986 1990 1994 1998 2002 2006 2010 2014 2018 2022 attack-pattern campaign course-of-action intrusion-set malware relationship tool Data from Enterprise ATT&CK version 14.1 References by year published, per ATT&CK object type
  • 27. Data from Enterprise ATT&CK version 14.1
  • 28. Data from Enterprise ATT&CK version 14.1. References have been deduplicated. References without publication dates Has Publication Date 2803 No Date 475 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
  • 29. Data from Enterprise ATT&CK version 14.1 References by year ATT&CK object was added 0 500 1000 1500 2000 2500 3000 3500 4000 4500 attack-pattern campaign course-of-action intrusion-set malware relationship tool 2017 2018 2019 2020 2021 2022 2023
  • 30. Data from Enterprise ATT&CK version 14.1. References have been deduplicated ATT&CK objects by year added 0 500 1000 1500 2000 2500 3000 3500 4000 4500 attack-pattern campaign course-of-action intrusion-set malware relationship tool 2017 2018 2019 2020 2021 2022 2023
  • 31. 60 25 26 44 10 5 8 16 321 26 23 21 0 50 100 150 200 250 300 350 2017 2018 2019 2020 2021 2022 2023 Technique Sub-Technique Data from Enterprise ATT&CK version 14.1 Techniques vs. sub-techniques, year added
  • 32. Sub-techniques were added in 2020 (versions 7.0-beta and 7.2)
  • 33. Data from Enterprise ATT&CK version 14.1 102 106 95 85 55 37 42 21 17 8 6 5 0 2 3 1 0 20 40 60 80 100 120 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Technique objects Number of references Number of references per ATT&CK technique
  • 34. Data from Enterprise ATT&CK version 14.1 Number of references per ATT&CK relationship object 11163 2178 534 183 68 48 19 15 10 5 0 2000 4000 6000 8000 10000 12000 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Relationship objects Number of references
  • 35. 0 100 200 300 400 500 600 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 ATT&CK objects Number of references attack-pattern campaign intrusion-set malware tool Number of references per ATT&CK object type Data from Enterprise ATT&CK version 14.1. Excludes relationship objects.
  • 36. Data from Enterprise ATT&CK version 14.1 Object Type # of References ATT&CK ID Name Tool 5 S1040 S1063 Rclone Brute Ratel C4 Software 13 S0367 Emotet Campaign 13 C0024 SolarWinds Compromise Technique 18 T1547.006 Kernel Modules and Extensions Group 28 G0016 APT29 Most number of references by object type
  • 37. Data from Enterprise ATT&CK version 14.1. Excludes relationship objects. How often references are reused in ATT&CK 2114 464 139 50 29 11 7 5 1 1 1 1 3 1 1 1 0 500 1000 1500 2000 2500 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 Count of References Count of Times Reference Used
  • 38. 2114 464 139 50 29 11 7 5 1 1 1 1 3 1 1 1 0 500 1000 1500 2000 2500 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 Count of References Count of Times Reference Used Data from Enterprise ATT&CK version 14.1. Excludes relationship objects. How often references are reused in ATT&CK
  • 39. Data from Enterprise ATT&CK version 14.1 Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016. T1001 T1001.001 T1001.002 T1001.003 T1008 T1030 T1041 T1048 T1048.001 T1048.002 T1048.003 T1071 T1071.001 T1071.002 T1071.003 T1071.004 T1090 T1090.001 T1090.002 T1095 T1102 T1102.001 T1102.002 T1102.003 T1005 T1132 T1132.001 T1132.002 T1571 T1572 T1573 T1573.001 T1573.002 14 techniques + 19 sub-techniques = 33
  • 40. Exfiltration Over Alternative Protocol ← (T1048) d Illustration by Arthur Rackham. Alice’s Adventures in Wonderland (n.d.)
  • 41. If you maintain ATT&CK… • Keep working on data normalization and quality control T1574.001 / “Microsoft Security Advisory 2269637” - malformed published date: “(, May 23)” T1218 / “split man page” - malformed published date: “(2020, March null)” G1001 / “SecureWorks August 2019” - malformed published date (missing parentheses?) - malformed retrieval date: “Retrieved. 2019/11/19”
  • 42. If you produce cyber threat intelligence… • Keep doing what you’re doing • Open reporting is important to the community • Consider directly contributing content to ATT&CK based on your own research • Encourage others to produce CTI
  • 43. If you are blue/red/purple teaming… • Read the underlying sources of ATT&CK as you use objects from the framework • Discover new sources of CTI • Help drive web traffic to smaller sources…they deserve attention too
  • 44. If you work with decision makers… • Pitch ATT&CK on its deep roots in CTI • Highlight the robust nature of the dataset • Demonstrate its usefulness in the cyber toolbox
  • 45. If you work in PowerShell… • PowerShell lacks a current mitreattack-python module • A few projects on GitHub, but out of date
  • 46. The End Illustration by John Tenniel. Cheshire Cat in the Tree Above Alice (1889)