Lecture 08

Summary

This script is a detailed walkthrough of mapping cybersecurity incidents to the ATD CK framework using raw data. It discusses techniques such as initial access, execution, and persistence, and emphasizes the importance of understanding attacker behavior and tactics. The instructor guides through the process of analyzing various commands and network interactions, illustrating how to identify and map tactics and techniques from both finished reports and raw data. The session also covers the significance of creating databases for attack pattern recognition and the challenges of attribution in cybersecurity.

Takeaways

• 📈 The main objective is to understand how to map raw data to the ATD (Adversarial Tactics, Techniques, and Common Knowledge) framework.
• 🔒 The script discusses techniques such as stealing VPN credentials, compromising web services, and using phishing to gain initial access to a network, which are part of the 'External Remote Service' category.
• 🐟 The term 'STIX' is mentioned as a format used for cyber threat intelligence, which is important for creating and understanding threat reports.
• 🔑 Command injection is highlighted as a method for attackers to execute commands on a web server host, which falls under the 'Execution' tactic.
• 🔄 The script explains how certain behaviors can be associated with multiple tactics, emphasizing the need to understand the context of each action.
• 🔍 The importance of network intrusion detection is stressed for identifying command and control communications, which may use various protocols.
• 🛡️ 'Persistence' in cybersecurity is defined as ensuring that an executable remains on a system even after reboots, often achieved through methods like writing to startup folders or registry entries.
• 🤝 The script touches on the idea of 'resource development' in the context of cyber kill chain, which is about creating the necessary tools and resources for an attack, synonymous with 'weaponization'.
• 🧐 The need for cybersecurity professionals to think from both an attacker's and a defender's perspective is emphasized to effectively anticipate and counter threats.
• 📚 The 'Cobalt Kitty' report is used as an example to demonstrate how to map tactics and techniques from a finished report, which is a valuable exercise for understanding the cyber attack process.
• 🔑 The script concludes with the importance of mapping ATD from raw data, which is a critical skill for threat intelligence analysts who must interpret various data sources to identify and respond to cyber attacks.

Q & A

What is the main objective of the session described in the transcript?

The main objective of the session is to learn how to map ATD (Adversarial Tactics, Techniques, and Common Knowledge) framework from raw data.

What is the significance of using the code number 45975 on m.com in the context of the session?

The code number 45975 is used on m.com to access and answer questions related to the session, which is part of the learning process about external remote services and cyber threat intelligence.

What are the three choices given in the example question about external remote services, and which one is not a procedure for it?

The three choices are: 1) stealing an employee's VPN credential to access the network, 2) compromising a vulnerable web service to get a remote shell access, and 3) phishing followed by a backdoor infection to obtain access. The third choice, phishing followed by a backdoor infection, is not an external remote service procedure as the initial access is through phishing, not an external remote service.

What is STIX and why is it important in the context of the session?

STIX (Structured Threat Information Expression) is a language and serialization format used for cyber threat intelligence. It is important in the session as it helps in understanding and creating files for cyber threat intelligence, which is a key part of mapping ATD framework.

What is the role of Network Intrusion Detection in identifying Command and Control (C2) communications?

Network Intrusion Detection plays a crucial role in monitoring all network traffic to identify any suspicious IP addresses or communication patterns that may indicate C2 communications, which are often used by attackers to control compromised systems.

What does the term 'Persistence' refer to in the context of cybersecurity?

In cybersecurity, 'Persistence' refers to the ability of a malware or an unwanted executable to remain on a system even after reboots, often achieved by writing the executable to startup folders, injecting itself into always-running processes, or changing registry entries for autorun.

What is the difference between 'Resource Development' in the ATD framework and 'Weaponization' in the Cyber Kill Chain?

In the ATD framework, 'Resource Development' refers to the process of creating resources for attacking, such as exploits or phishing emails, after identifying a target's weak spots. In the Cyber Kill Chain, 'Weaponization' is the process of preparing an attack, which includes developing the actual exploit or payload to be used in the attack.

Why is it important for cybersecurity professionals to understand both the attacker's and defender's perspectives?

Understanding both perspectives is crucial for cybersecurity professionals because it allows them to anticipate what an attacker might do and then devise effective defensive strategies against those potential attacks. This dual understanding helps in creating comprehensive security measures.

What is the purpose of creating a database of tactics and techniques used by various APT (Advanced Persistent Threat) groups?

Creating such a database helps in analyzing and distinguishing between different APT groups by understanding their attack patterns, sequences, and methods. This can be used for attribution, which is the process of identifying the source of an attack, and can also aid in developing machine learning models to predict and defend against such attacks.

How does the process of mapping ATD from raw data differ from mapping it from a finished report?

Mapping ATD from raw data requires a deeper understanding of technology and forensics, as analysts must interpret log files, network packet traces, and other raw data sources to identify behaviors, tactics, and techniques. In contrast, mapping from a finished report involves analyzing the already identified behaviors, tactics, and techniques presented in the report, which is often more straightforward.