Introduction to ATT&CK

Summary

This course on ATT&CK fundamentals introduces the framework's background, philosophy, and structure. It emphasizes how ATT&CK helps defenders understand and respond to real-world adversary behaviors. The course covers threat-informed defense, David Bianco's Pyramid of Pain, and ATT&CK's focus on tactics, techniques, and procedures (TTPs). It explains how ATT&CK organizes these elements into matrices for various operational use cases, highlighting the relationship between adversary tactics, defense strategies, and community-driven intelligence. The course comprises three modules, with the first exploring ATT&CK's structure and evolution.

Takeaways

• 📘 ATT&CK fundamentals course explores the background, philosophy, and structure of ATT&CK, as well as its operational use cases.
• 🎯 The main goals include understanding ATT&CK’s structure, resources, and operational use cases, as well as how it empowers defenders against threats.
• 🧩 The course is divided into three modules: understanding ATT&CK, benefits of using ATT&CK, and use cases for operationalizing ATT&CK.
• 📊 Module one focuses on the structure and evolution of ATT&CK, starting with its intelligence sources and how that information is organized.
• ⚙️ David Bianco’s Pyramid of Pain is discussed as a model for understanding how different indicators of compromise (IOCs) can hinder adversaries.
• 🔒 ATT&CK is a knowledge base of real-world adversary behaviors, tactics, techniques, and procedures, focused on higher-level defense strategies.
• 🌍 ATT&CK is open, free, globally accessible, and community-driven, curated by MITRE.
• 🧠 The remainder of module one explores how ATT&CK organizes tactics, techniques, and sub-techniques, as well as connections to defensive measures.
• 📈 ATT&CK evolves over time, reflecting how adversary behaviors change and grow, with community contributions driving this evolution.
• ✅ The knowledge check highlights that ATT&CK is based on real-world observations, making it a critical tool for understanding and responding to cyber threats.

Q & A

What are the high-level goals of the course on ATT&CK?

The high-level goals of the course are to understand the structure and philosophy that shapes ATT&CK, identify the available ATT&CK resources and operational use cases, and recognize how ATT&CK empowers defenders through understanding threats.

How is the course on ATT&CK structured?

The course is divided into three modules. Module one focuses on understanding ATT&CK, module two discusses the benefits of using ATT&CK, and module three highlights various use cases for operationalizing ATT&CK.

What is the focus of module one in this course?

Module one focuses on understanding ATT&CK. It is split into eight lessons that explore what intelligence goes into ATT&CK, how this knowledge is formatted and connected, and how ATT&CK grows and evolves over time.

What is the purpose of the Pyramid of Pain, introduced in module one?

The Pyramid of Pain, created by David Bianco, highlights different types of Indicators of Compromise (IOCs) that defenders can use to observe and prepare for adversaries. The higher up in the pyramid, the more challenging it is for adversaries to bypass defenses.

Where does ATT&CK fit into the Pyramid of Pain?

ATT&CK focuses on the top of the Pyramid of Pain, which includes tactics, techniques, and procedures. These elements help build more resilient defenses against adversaries.

What is ATT&CK, and who curates it?

ATT&CK is a knowledge base of adversary behaviors, tactics, techniques, and procedures based on real-world observations. It is free, open, globally accessible, and curated by Mitre, with contributions from the broader security community.

What will be explored in the remaining lessons of module one?

The remaining lessons will explore how matrices are used to visualize ATT&CK domains, how tactics structure these matrices, how techniques and sub-techniques fill the tactics, and how these are connected to mitigations, data sources, and detections.

What is the primary motivation for creating ATT&CK?

The primary motivation for creating ATT&CK is the need to observe and adapt to the tactics, techniques, and procedures used by real-world adversaries to access and operate within networks, enabling defenders to better understand and respond to threats.

What are some key concepts that shape the understanding of ATT&CK?

Key concepts include threat-informed defense and David Bianco's Pyramid of Pain, both of which highlight the importance of focusing on adversary behaviors (tactics, techniques, and procedures) to build more effective defenses.

How does ATT&CK connect to real-world use cases?

ATT&CK connects to real-world use cases by modeling adversary behaviors based on public reports of cyber activity and intrusions. It links these behaviors to threat actors, campaigns, malwares, tools, and defensive countermeasures, allowing defenders to map threats to their own environments.