- [Narrator] The MITRE ATT&CK Framework
is one of the most successful projects from MITRE
and actually very popular in the industry.
I am a big fan of the MITRE ATT&CK Framework
because it provides a set of matrices
of the tactics and techniques
that real life attackers use
to perform many different attacks
and of course impact to many different organizations.
Now, this is a collection of matrices, right?
And there's several of them, as you see here,
there's the matrix for enterprise
which is actually the most popular.
Within it there's different matrix.
One for Windows, the pre is pre attack
but it's actually combined with reconnaissance
and we'll get to that in a second
but you have one for Windows, one for Mac,
one for Linux, one for Cloud, and also one for network.
And as a matter of fact,
I contributed to the network matrix
and specifically some real life attacks
that we have actually observe
against network infrastructure devices, right?
There's one for mobile,
one for ICS as well for Industrial Control Systems.
Now, if I go back to the main page, right?
Think it shows a little bit better
all the different tactics and techniques.
So you see different areas of the life cycle of an attack
from reconnaissance all the way to impact, right?
And that includes basically the day in the life of an attack
from the moment that an attacker
is trying to gather information from its victim
all the way to command and control ex filtration,
and of course, the overall impact to the organization.
One of the cool things
that I like about the MITRE ATT&CK Framework
is that they provide an amazing set of resources
for you to get familiar
with these different tactics and techniques,
whether you are in the defensive side.
So you're an instant responder
in a security operations center,
or whether you are in the ethical hacking
or offensive security.
This provides you with basically a real life description
and examples of the techniques
and tactics that attackers actually have used.
For example, let's go over previous escalation, right?
So you have the description
and you have different techniques.
Within those techniques there's different sub-techniques
related to that activity, right?
So for example, for previous escalation,
you see the ID for the main technique,
and then you have 0.001, that's a sub technique.
And in this case it's actually setting the UID
and set UID, and set group ID for a Linux environment
to abuse that configuration to perform previous escalation.
And the other cool thing that they actually have
is that they give you even the commands
that have been used.
In this case is really, really simple, right?
But the commands that have been used
by attackers and adversaries
to perform these tactics and techniques, right.
It also provides with very detailed information
about the different examples
and basically real life attacks.
If it is in the MITRE ATT&CK Framework, it is a given
that will be a real life confirm attack, right?
And in the bottom of each of their pages
they actually have different references
that go over whether it's an article about a breach
or some blog post from a technical person
describing the attack,
or things that are already in the public domain, right.
Let's click on another one,
like defense evasion, for example.
In this one you actually see a whole bunch
of other sub techniques, right?
within the defense evasion category
or defense evasion technique.
And if you click on, like,
token impersonation and theft, right?
You also see different, true real life examples, right?
And if you go over any of the other ones
you see, again, different examples
on how you can perform these adversarial technique, right?
In the case of adversary elimination
what a lot of people actually call some
of the activities of the purple team, right?
So you know, that the blue team is the defensive side
the red team is at the offensive side.
So it's kind of a hybrid between both
into the way that you can absolutely take advantage
of these resources to potentially perform
automated adversarial emulation.
I will get to that in a second.
There's actually even different tools that also
the community and MITRE have created to perform those type
of emulations.
As you're seeing here,
I mean, all these procedural examples are basically
real life attackers, right?
Or types of malware or types of tools
that actually use these type of techniques, right?
Now, if you actually see any of these sub techniques
and descriptions and so on, yes,
you can absolutely take advantage of it to learn.
So absolutely that's, I have done it
and I suggest for people to do,
however, this goes beyond learning.
What a lot of companies have done
is that they have integrated the MITRE ATT&CK Framework
within their tools.
So if there's a detection, for example,
or some type of alert, it actually can be mapped
to the specific tactic and techniques from the adversary.
So then you can perform additional things.
It can help you in threat hunting.
It can help you in other areas
within the security operations center itself, right.
Now if you go under resources,
there are a few things in here
they have from things on how to get started
with the ATT&CK Framework, training,
you know they have provided for free,
AAT&CKcon is a conference
that they have in an annual basis.
And they have tons and tons of presentations.
As a matter of fact
if you're actually click in here,
of course you see different presentations that are there
but if you go all the way to the related projects
there are a few things that are related to the
MITRE ATT&CK ecosystem, if you will, right.
There's a GitHub repository within the framework.
There are different tools that allow you to illustrate
and navigate to the framework.
And one of them is actually called ATT&CK Navigator.
And we'll get into that in a second.
I'll show you an example and then you have related formats.
So in other words,
if you actually have a specific observable
or a specific technique,
the community and specifically MITRE
with the CTI community
and CTI stands for Cyber Threat Intelligence,
they have created an express attack
in STIX format and STIX stands for
the Structured Threat Information and Expression.
As you're see here,
its basically a language to share a threat intelligence.
And you will learn this throughout the course here.
And it's basically that is a machine readable format.
And in that case, it's JSON format that you can use
of course, to exchange threat intelligence information
among participants.
And specifically, if you want to share things related
to the tactics and techniques of an attack,
that's where the integration of the ATT&CK Framework
expression STIX comes into play.
Now, another thing in this page
that I want to draw your attention is a tool called Caldera.
And it's an automated adversarial elimination tool
that basically you can use
with a whole bunch of different plugins
to basically simulate what an attacker can do
and is completely mapped to the ATT&CK Framework.
There's another ecosystem underneath
called the Atomic Red Team.
I'm not gonna go into a lot of that detail
for the scope of this course.
However, these are tools that are highly recommended
for you to actually learn and explore.
And specifically, if you are looking
into a career as an analyst,
whether it's a junior or a senior analyst
in a security operation center.
Now, if I go back to the framework
and I click on software here
this is like a list of different
either pieces of malware or legitimate software
that has been used by attackers to perform
different types of activities, right?
And this can be things, for example, let me actually go back
to the letter C and look for Cobalt Strike.
Cobalt Strike is a commercial adversarial emulation
/ pen testing / red teaming tool, right?
It actually has been used
by many Fortune 500 companies and government institutions.
However, attackers have also taken advantage
of these tools to perform a plethora of different attacks.
And if you see here,
it's a very extensive list of all the different tactics
and techniques that you can basically emulate
with that tool, right?
So I picked this one because it's a little bit controversial
in the security world because
the dual use of that tool, right?
Now I wanted to take advantage of this screen
and basically show you the ATT&CK navigator, right?
And just like we are right now
we're their software on Cobalt Strike.
I'm gonna click on the ATT&CK navigator
and you can do two things.
You can download this information
in a machine readable format
that then you can actually, basically in JSON,
that you can then import to a local
instance of the ATT&CK navigator, or you can click on view.
And that actually will take you
to MITRE's hosted attack navigator.
And as you can see,
it says, Cobalt Strike,
which is the name of the software that we selected.
And again, this is just one example out of many
many different things that you can actually do
with a framework or at least show in the navigator
and navigate, no pun intended,
for all the different tactics and techniques.
And every single one that are related to in this case
Cobalt Strike are being highlighted.
Now the cool thing about this one
is that you see some comments,
if I hover over these elements
you can absolutely create your own comments and so on.
For example,
I can highlight this Parent PID Spoofing
and I can add a comment in there, right.
Either modify it or add,
"This was observed in my investigation." Right?
And this is of course a very lame example,
but you get the point.
Basically you can actually put any type of comments.
And what is actually useful is because you can
exchange this information in machine readable format.
And again, a lot of commercial tools already integrate
the ATT&CK Framework and the elements that you get
from the navigator within their tools
and Cisco is actually one of them, right?
So if you download that you can see that
I'm able to download it in machine readable format
in this case.
And it's JSON file that has all the different elements
about the observe, all the techniques and tactics
that Cobalt Strike is actually doing.
So this is a view from a software perspective
you can also do the same thing as a view
from a specific tactics or map whatever emulation
you're trying to do,
or whatever type of threat hunting activity
that you would like to do.
You can absolutely do the same.
Now, as I mentioned, there's different commercial tools
that take advantage of the ATT&CK Framework.
Pretty good example of it.
You know, of course, part of the Secure X ecosystem
at Cisco within Threat Grid,
and you learn that Threat Grid is basically a sandboxing.
And actually it goes beyond sandboxing
but a behavioral analysis and sandboxing
a solution from Cisco that is integrated
in many, many different other platforms, right?
Like M4M Points, Fire Power Threat Defense,
and many others, right?
But basically, as you see here, they have the mapping
of the ATT&CK Framework in different behavioral indicators
that I'm showing the screen.
So in this case actually
the second one that you see is says,
" Excessive Remote Process Code Injection Detected."
And there are two techniques
from the MITRE ATT&CK Framework,
defense evasion and previous escalations.
If you click on that you will actually see
related activity to the same behavior
basically it's a tag that shows you other types
of activities within the network.
And as you can see this is a demo system
but it has a lot of different types of attacks, right?
That actually include defense evasion,
the same thing if you want to go
and see previous escalation, right?
There's a lot of different techniques
that also have been detected
that are related to previous escalation, right?
Scheduled task and registry entry
is actually being detected that might be modified and so on.
And as you can see, if I expand one of these
it has a direct reference to the MITRE ATT&CK Framework.
So again, for the purpose of this exam
and for the purpose of this course,
this is all what you need to actually know.
You don't need to actually configure and go deep.
The concentration exams
and the C C I Lab absolutely will test you
into the very details of the configuration
and troubleshooting of each of these devices and solutions.