In this lesson,
we will learn about the MITRE Adversarial Tactics,
Techniques, and Common Knowledge, or the ATT&CK Framework.
The MITRE ATT&CK Framework categorizes
and documents the tactics, techniques and procedures
(TTPs) used by adversaries to compromise
and exploit systems.
The framework is organized into matrices
that outline the various stages of an attack
with each matrix entry,
detailing specific attributes like the required permissions,
platforms, and potential mitigation strategies.
MITRE ATT&CK matrices include the Enterprise ATT&CK matrix,
ATT&CK for mobile, PRE-ATT&CK and ATT&CK for ICS
or Industrial Control Systems.
Also, part of the MITRE ATT&CK framework
is the ATT&CK Navigator.
The ATT&CK Navigator is a tool
that allows security professionals to visually map
and analyze how specific techniques might be used
by specific threat actors against their systems.
Let's learn more about the MITRE ATT&CK framework.
The MITRE Adversarial Tactics Techniques
and Common Knowledge, or ATT&CK framework,
is a comprehensive model developed
to document the tactics, techniques,
and procedures used by adversaries in cyber attacks.
It organizes this information into matrices
which break down each stage of an attack
with specific entries detailing the techniques used,
the permissions required, the platforms affected,
and the potential strategies for mitigation.
This structure makes the MITRE ATT&CK framework
a valuable tool for defenders to understand
and anticipate threats, allowing them to assess
and reinforce their defenses
based on categorized real world attack methods.
The MITRE ATT&CK framework is divided into several matrices,
each targeting different environments and types of systems.
The Enterprise ATT&CK Matrix is the most widely recognized
and used, covering techniques applicable to desktops,
servers, and cloud environments.
Next, the ATT&CK for Mobile Matrix focuses on tactics
and techniques used in attacks against mobile devices,
offering insights into security risks specific
to mobile applications and operating systems.
Then the PRE-ATT&CK Matrix focuses
on adversary behavior that occurs
before an actual attack begins,
such as reconnaissance in planning, allowing defenders
to anticipate threats at their earliest stages.
Finally, the ATT&CK Matrix
for Industrial Control Systems
addresses techniques attackers might use
to target industrial environments,
such as energy or manufacturing sectors.
Together, these matrices provide a robust view
of the different tactics used across various platforms
and industries.
Part of the ATT&CK framework is the ATT&CK Navigator.
The ATT&CK Navigator is a visual tool
that allows security teams to map
and analyze how specific techniques align
with real world threat actors.
For example, if a security team wants
to assess the threat posed by a known actor like APT29,
they can use the ATT&CK Navigator
to map out APT29's commonly used techniques.
By highlighting these techniques on a matrix,
the team can visualize which tactics APT29 employs
and compare them to their own defenses.
This process makes it easy
to spot any potential gaps
in the organization's current security protocols,
helping the team prioritize improvements
to counter the specific methods that APT29 is known to use.
From a defensive perspective,
the MITRE ATT&CK framework is incredibly useful
for identifying and addressing weaknesses
within an organization's security posture.
For instance, a cybersecurity team can use ATT&CK
to understand how a specific attacker might progress
through each stage of an attack
and determine where the organization's security measures
might be vulnerable.
With this knowledge,
the team can set up defenses specifically
for high risk techniques
or tactics that are likely to target their environment.
For example, let's say an organization wants
to ensure it's prepared for a credential dumping attack.
Credential dumping is a common technique used by attackers
to gain unauthorized access to account credentials.
By referencing the ATT&CK Matrix,
the security team can find information on specific
credential dumping techniques,
the permissions attackers need to perform these techniques
and how best to detect or prevent them.
Then, given a high probability threat actor
and using the ATT&CK Navigator,
they can then map these anticipated attacker techniques
against their current defenses to identify areas
where they may lack coverage, like missing audit logs
for credential related events.
Based on these insights,
the team can implement targeted measures
such as setting up alerts for suspicious access attempts,
or restricting administrative permissions
to sensitive accounts.
Let's take a walk through the process.
For our demonstration
in the MITRE ATT&CK framework,
we will research APT29
as the threat actor we are concerned with.
So let's learn about APT29
under the Cyber Threat Intelligence and group selections.
Then we'll select APT29.
We can see that APT29 is a threat group associated
and attributed to Russia's Foreign Intelligence Service
or SVR.
We can also see that there are a lot
of associated group descriptions
or names associated with APT29.
Additionally, as a nation state sponsored actor,
they're likely to target critical infrastructure
or military related organizations for strategic advantage.
Next, we can learn about
what attack campaigns have been attributed to APT29.
As we continue to scroll down, we can see a large list
of techniques that APT29 has been known to use.
This is all great information,
but without a picture to help orient me to where in the path
of an attack all of these techniques would be used,
it's hard to operationalize this information.
So, there is a handy link
to overlay the techniques
onto the Enterprise ATT&CK Matrix.
Now I can see what specific tactics
have been used in the wild
to support APT29 attack scenarios.
These identified TTPs can be further associated
with campaigns that have been attributed to APT29.
For example, in the legend,
we can see that the blue TTPs are associated
with APT29 directly.
The red TTPs are associated
with campaigns attributed to APT29,
and the pink TTPs are identified
as both being used by APT29
and in a campaign attributed to APT29.
With this information,
we can now review our network infrastructure
and identify systems, permissions,
and platforms that are high probability targets for APT29.
Then we can harden the network
or look for indicators of compromise and attack.
So by following this process,
we have used the ATT&CK Navigator
to map out APT29's likely attack pathways.
We could then analyze our defenses,
determine where they are weak,
and take proactive measures
to strengthen our security posture.
This proactive approach ensures our network infrastructure
will be better prepared
to defend against APT29's tactics.
So remember, the MITRE ATT&CK framework
is a comprehensive tool that categorizes the tactics,
techniques, and procedures or TTPs used by attackers.
Organized into various matrices, the MITRE ATT&CK framework
outlines the stages of an attack
detailing each technique's requirements,
platforms affected, and potential defensive strategies.
Key matrices include Enterprise ATT&CK for General Systems,
ATT&CK for Mobile, PRE-ATT&CK for early planning,
and ATT&CK for Industrial Control Systems or ICS,
each of these tailored to different environments.
Additionally, the ATT&CK Navigator is a visual tool
that helps security teams map out these techniques
to specific threat actors,
allowing them to analyze potential attack paths
and defenses.
Overall, the MITRE ATT&CK framework supports defenders
in identifying vulnerabilities
and strengthening security by aligning their defenses
with real world observed attack patterns.