Threat and Vulnerability Management -- MITRE

[WDavid404]

Mitre Corporation

The US-based non-profit MITRE Corporation has created for the cybersecurity community, specifically:

• ATT&CK® (Adversarial Tactics, Techniques, and Common Knowledge) Framework
• CAR (Cyber Analytics Repository) Knowledge Base
• ENGAGE (sorry, not a fancy acronym)
• D3FEND (Detection, Denial, and Disruption Framework Empowering Network Defense)
• AEP (ATT&CK Emulation Plans)

[WDavid404]

Basic Terminology

APT is an acronym for Advanced Persistent Threat.

TTP is an acronym for Tactics, Techniques, and Procedures:

• The Tactic is the adversary's goal or objective.
• The Technique is how the adversary achieves the goal or objective.
• The Procedure is how the technique is executed.

[WDavid404]

ATT&CK® framework

MITRE ATT&CK® is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Website: https://attack.mitre.org/

14 categories. Under Initial Access, there are 9 techniques. Some of the techniques have sub-techniques, such as Phishing.

[WDavid404]

CAR Knowledge Base

Cyber Analytics Repository

The MITRE Cyber Analytics Repository (CAR) is a knowledge base of analytics developed by MITRE based on the MITRE ATT&CK® adversary model. CAR defines a data model that is leveraged in its pseudocode representations but also includes implementations directly targeted at specific tools (e.g., Splunk, EQL) in its analytics. With respect to coverage, CAR is focused on providing a set of validated and well-explained analytics, in particular with regards to their operating theory and rationale.

Full Analytic List https://car.mitre.org/analytics/

[WDavid404]

MITRE Engage

MITRE Engage is a framework for planning and discussing adversary engagement operations that empowers you to engage your adversaries and achieve your cybersecurity goals.

MITRE Engage is considered an Adversary Engagement Approach. This is accomplished by the implementation of Cyber Denial and Cyber Deception.

• With Cyber Denial we prevent the adversary's ability to conduct their operations.
• with Cyber Deception we intentionally plant artifacts to mislead the adversary.

Website

https://engage.mitre.org/

Matrix

https://engage.mitre.org/matrix/

• Prepare the set of operational actions that will lead to your desired outcome (input)
• Expose adversaries when they trigger your deployed deception activities
• Affect adversaries by performing actions that will have a negative impact on their operations
• Elicit information by observing the adversary and learn more about their modus operandi (TTPs)
• Understand the outcomes of the operational actions (output)

starter kit:

Get you 'started' with the Adversary Engagement Approach. The starter kit is a collection of whitepapers and PDFs explaining various checklists, methodologies, and processes to get you started.

[WDavid404]

D3FEND

A knowledge graph of cybersecurity countermeasures. D3FEND stands for Detection, Denial, and Disruption Framework Empowering Network Defense.

Website: https://d3fend.mitre.org/

D3FEND is still in beta and will change significantly in future releases

[WDavid404]

ATT&CK® Emulation Plans

Under MITRE ENGENUITY, we have CTID, the Adversary Emulation Library, and ATT&CK® Emulation Plans.

CTID

MITRE formed an organization named The Center of Threat-Informed Defense (CTID). This organization consists of various companies and vendors from around the globe. Their objective is to conduct research on cyber threats and their TTPs and share this research to improve cyber defense for all.

Adversary Emulation Library & ATT&CK® Emulations Plans

The Adversary Emulation Library is a public library making adversary emulation plans a free resource for blue/red teamers. The library and the emulations are a contribution from CTID.

There are several ATT&CK® Emulation Plans currently available:

• APT3,
• APT29
• FIN6.

[WDavid404]

ATT&CK® and Threat Intelligence

Threat Intelligence (TI) or Cyber Threat Intelligence (CTI) is the information, or TTPs, attributed to the adversary. By using threat intelligence, as defenders, we can make better decisions regarding the defensive strategy.

Large corporations might have an in-house team whose primary objective is to gather threat intelligence for other teams within the organization, aside from using threat intel already readily available. Some of this threat intel can be open source or through a subscription with a vendor, such as CrowdStrike.

Scenario: You are a security analyst who works in the aviation sector. Your organization is moving their infrastructure to the cloud. Your goal is to use the ATT&CK® Matrix to gather threat intelligence on APT groups who might target this particular sector and use techniques targeting your areas of concern. You are checking to see if there are any gaps in coverage. After selecting a group, look over the selected group's information and their tactics, techniques, etc.