1.1 Introduction to MITRE ATT&CK - MAD20 ATT&CK Fundamentals

Summary

In this course on Attack Fundamentals, Jamie Williams introduces the ATT&CK framework, emphasizing its importance for understanding and improving defenses against real-world cyber adversaries. The course covers the structure, data, and evolution of ATT&CK, focusing on tactics, techniques, and procedures (TTPs) used by threat actors. By the end of the course, participants will have a deeper understanding of how to leverage ATT&CK for threat modeling, applying it to real-world defense practices. The first module highlights how ATT&CK is built on real-world cyber threat intelligence, helping defenders identify and counter adversary behaviors.

Takeaways

• 😀 The course 'Attack Fundamentals' introduces the Miter Attack Defender Series and focuses on using adversary behavior models to improve cybersecurity defenses.
• 😀 The course is designed for anyone involved in threat modeling and aims to help participants understand and apply the ATT&CK framework.
• 😀 By the end of the course, participants will understand the structure of ATT&CK, its operational use cases, and its role in empowering defenders against real-world cyber threats.
• 😀 The ATT&CK framework is based on real-world observations of adversary behavior, drawing on publicly available cyber threat intelligence.
• 😀 ATT&CK is open-source, free, and globally accessible, allowing both consumption of the data and contributions to help grow and expand the model.
• 😀 The Pyramid of Pain helps explain the concept of adversary behavior and the relative difficulty of adversaries changing certain indicators of compromise (IOCs).
• 😀 ATT&CK focuses on the most impactful adversary behaviors, such as tactics, techniques, sub-techniques, and procedures (TTPs), to help defenders anticipate attacks.
• 😀 The course includes lessons on how to apply ATT&CK in real-world scenarios, such as accessing credentials using tools like Mimikatz to dump LSASS memory.
• 😀 The framework highlights important metadata such as mitigations, data sources, and detections associated with various techniques and sub-techniques.
• 😀 ATT&CK evolves over time based on real-world cyber adversary behaviors, allowing defenders to stay up-to-date with the latest tactics and methods used by attackers.

Q & A

What is the focus of the course 'Attack Fundamentals'?

The course focuses on understanding adversary behavior in the context of cybersecurity, using the ATT&CK framework to model these behaviors, and improving defensive measures against real-world cyber threats.

What is the ATT&CK framework?

The ATT&CK framework is a knowledge base that captures the tactics, techniques, sub-techniques, and procedures (TTPs) used by adversaries in real-world cyber campaigns. It helps model and understand adversary behaviors and is designed to be used by defenders for better threat detection and mitigation.

What is the Pyramid of Pain and how is it relevant to the course?

The Pyramid of Pain, introduced by David Bianco, describes a hierarchy of Indicators of Compromise (IOCs) based on how difficult they are for adversaries to change. The ATT&CK framework is linked to this concept, particularly focusing on higher levels of the pyramid like TTPs, which are harder for adversaries to modify.

How does ATT&CK empower defenders?

ATT&CK empowers defenders by providing a structured way to understand and anticipate adversary tactics and techniques. This knowledge enables better defense strategies, threat detection, and mitigation based on real-world adversary behavior.

What is the intended outcome by the end of the course?

By the end of the course, participants should have a solid understanding of the structure and philosophy behind ATT&CK, the ability to recognize available attack resources, and the skills to apply this knowledge to real-world cybersecurity defense practices.

What are the three main modules in this course?

The course is divided into three modules: Module 1 focuses on understanding ATT&CK, Module 2 explores the benefits of using ATT&CK, and Module 3 covers how to operationalize ATT&CK knowledge in real-world scenarios.

How does the course structure approach learning about ATT&CK?

The course breaks down the ATT&CK framework into manageable lessons. In Module 1, it introduces the background, structure, and evolution of ATT&CK, while subsequent modules explore its application and benefits in defending against cyber threats.

What does ATT&CK focus on, regarding adversary actions?

ATT&CK focuses on the tactics, techniques, and procedures (TTPs) executed by real-world adversaries. This includes understanding how adversaries target networks and what they do once they gain access.

How does the ATT&CK framework grow and evolve over time?

ATT&CK evolves as new cyber threats emerge. The framework is continuously updated with new tactics, techniques, and adversary behaviors, enabling defenders to stay current with the latest threats and defensive strategies.

What is the knowledge check in Lesson 1 about?

The knowledge check in Lesson 1 asks participants to identify the primary source of information that informs the ATT&CK framework. The correct answer is that ATT&CK is primarily informed by real-world, operational use, based on publicly available cyber threat intelligence.