[MEETUP] MITRE ATT&CK

[mitilan]

Разбираемся с матрицами MITRE ATT&CK (https://attack.mitre.org/) Использование в повседневной работе;

MITRE ATT&CK® is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.

[RoxyBroge]

Изучаем Adversarial Tactics, Techniques & Common Knowledge (ATT@CK). Enterprise Tactics. - используя эти рекомендации можно улучшить защиту и навести порядок.

Top 10 most used MITRE ATT&CK tactics and techniques - полезно следить за ТОП списком чтобы быть готовым к трендовым атакам

[mitilan]

Тренинг https://attack.mitre.org/resources/training/cti/

[mitilan]

Tools for working with Att&ck https://attack.mitre.org/resources/working-with-attack/ STIX / Excel / Navigator / python module

[mitilan]

Pyramid of pain, the source http://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html

Plus some clarification: https://www.threathunting.net/files/A%20Framework%20for%20Cyber%20Threat%20Hunting%20Part%201_%20The%20Pyramid%20of%20Pain%20_%20Sqrrl.pdf

[mitilan]

Цикл статей на хабре от bassmack: https://m.habr.com/ru/users/bassmack/posts/

[mitilan]

Для тех, кто любит роадмапы: https://medium.com/mitre-attack/att-ck-2021-roadmap-68bab3886fa2

[mitilan]

https://www.mitre.org/attackcon

[mitilan]

Getting started ebook https://www.mitre.org/sites/default/files/publications/mitre-getting-started-with-attack-october-2019.pdf

[mitilan]

Someone's thoughts on MITRE and cyber kill chain https://blueteamblog.com/my-thoughts-on-using-the-mitre-attck-framework-for-siem-detections

[mitilan]

STIX - A structured language for cyber threat intelligence https://oasis-open.github.io/cti-documentation/

[mitilan]

TAXII - Trusted Automated Exchange of Intelligence Information (TAXII™) https://oasis-open.github.io/cti-documentation/taxii/intro