Hello and welcome
to our first discussion in the
application of the minor attack
framework.
So today we're going to be looking
specifically at what is
the attack framework.
And as we continue to work
through it, you'll see why this
framework is growing in popularity,
why it is great for
blue team members, red team members,
purple team members, security
consultants, business
owners, you name it.
If you're evaluating a solution or
software, this framework
definitely has some capability that
can assist you in making those
decisions or understanding the
threats and attack vectors that you
would need to defend against.
So let's jump right in with a quick
definition as provided by the miners
site.
The MIETEK framework is a globally
accessible knowledge base
of adversary tactics.
So we talked about threat actors
and the MIETEK framework gives
you some tips and information
on each of those
aspects under
each of the vectors and areas
and techniques based on real world
observations.
And so the knowledge based is used
as a foundation for the development
of specific threat models and
methodologies in the private sector.
So you mentioned all areas, private
sector, government and in the
cybersecurity product and service
community. So with the creation of
the attack framework,
it's fulfilling its mission to solve
problems for a safer world by
bringing communities together to
develop more effective
cybersecurity.
Attack is open and available to
any person or organization for use
at no charge.
So that is a wonderful thing.
Like I said, the
research that an individual would
have to do, whether you are a blue
team member or a red team member,
it can be different depending
on the methodologies that were
developed by the organization or
developed by the individual,
depending on the type of
certifications that they've gone and
taken. So the great thing about
the attack framework is that it
takes everything.
And this is a snippet from the site.
So I did cut off the bottom portion
of some of these, but it breaks it
down into each of these areas,
which, when we do the tour of the
site, will actually look at.
But it initially it
starts with initial access down here
on this end.
And then what happens is, is the
threat actor would gain access
through one of these methods.
So let's say that they get to trust
and relationship.
So what happens with
the framework is you can kind of
move left to right and assume
that an individual would gain access
to threat, actor would gain access
to one of these areas, and then
they would essentially move through
each of these areas,
finding ways
to move through the organization.
And make movements all the way
to the end where there's
impact and so
the reason that I like this
framework and that I think it's so
awesome is that within each of these
areas, so underlying
initial access is
I'll show you you can click into
vallet accounts.
And within that it gives you a
definition of what that is.
It talks a bit about some of the
threat actors that if you used valid
account access and how they've gone
about doing that, they give you
some information on mitigating
factors and then they give you
some tips and tricks for detection.
And ultimately,
at the end of that, there are some
references that were used for those
recommendations and information as
well. And so it's a really nice,
concise body of knowledge
that helps you to kind of look for
gaps. So let's say that you've got a
security solution and it takes care
of a number of things in the
execution,
let's say, in the execution area
here and a few things maybe in
discovery. Maybe it's got some
things in defense evasion.
Maybe it touches on each of these
areas. And so you can map out,
you know, it helps with command line
interface areas. It helps with
absolute DLs.
It helps with command history,
auditing and information, domain
trust, discovery.
And so let's say it does all those
things, but then it has
gaps in the solution where it
doesn't cover every area and
the attack framework.
And of course, as threat actors
become more sophisticated and more
aware of the ways that we're
kind of keeping them from making
money or keeping them from gaining
access to systems.
This framework would grow or shrink
based on the popular attack vectors
and what threat actors are doing.
So this framework is definitely
useful, whether
you're evaluating software
solutions, security controls,
maybe your organization's security
posture, definitely beneficial.
And so we will touch on this when we
go through the site as well.
So what will we be looking at?
Well, essentially, our discussions,
our modules
are going to line up with each
of the main areas of the
attack framework.
So we're going to start with initial
access.
And then what we'll do is we'll work
our way through each of those areas.
Now, what we're not going to do is
touch on every
vector within each
of these areas. We're going to touch
on a few at a high level.
We're going to talk about some
instances where those either
were taken advantage of as far as
in the wild
or in practice where a business
was damaged or had an incident
that was because of credential
access techniques or because of
initial access techniques.
And we all are aware of phishing
and things of that nature and how
much that's impacted organizations.
But we'll talk about command line
and where that's been used or how
it's been utilized.
We'll talk about valid accounts.
We've got some case studies where
we'll talk about how valid accounts
were used in each of these areas.
We'll have a respective case study
where you can apply
how a threat actor got into an
organization or what the speculation
is behind it. And then we will apply
principles within the attack
framework to see
if we had implemented certain
controls or mitigating factors or
detection factors.
Would we have been able to
potentially reduce the impact
of a compromise or have stopped it
outright?
And so it'll continue all the way
through to the impact phase, where,
again, we'll touch on each of
these areas and some of the attack
vectors within each.
But we're not going to touch over
every piece of the
framework just because it would take
a large amount of time.
And once we go through a few of
these in each area, you kind of get
the point and how to look through
each of the given attack vectors in
these core areas.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.