Hello and welcome to
another application of the minor
attack framework discussion
today we're going to be looking at
the site.
We're going to navigate through some
of its components, just give it an
overall thorough review
and help you to become familiar
with, you know, when we're talking
about command line or when we're
talking about initial access,
you can go to these different areas,
follow along, look through the sign
information and really take
advantage of the full wealth of
knowledge that miner brings to the
table right out the gate.
So with that, let's go ahead and
jump over to the site.
All right, everybody, so you
may notice that we are on
the minor attack framework site,
so in order to get to this
beautiful piece of information, you
can go to attack the minor league
and it will bring you to this
home page.
Now, you may also notice
down below, there's the attack
matrix for Enterprize.
There are some other areas that we
can go as well that have some
different matrixes.
And so in this case, if we
went to Enterprise,
you'd see here
just taking a moment to load
that we have the enterprise
information in this nice compact
form.
We can also go over to
mobile.
And it will adjust for mobile
information as well.
Now we are focusing in on
particular discussions on the
enterprise area, and
so we're just going to go back to
this main page here
now in navigating
the framework.
As you can see, you've got initial
access, execution, persistence,
privilege, escalation, defense,
evasion, credential access,
discovery, lateral movement,
collection, command and control,
exfiltration and impact.
Now, if you click into any of these
given areas, it will give
you a description of what that
means. So in this case, it's the
xanthan there.
It's the adversary trying to get
access to the network.
And then it's got various techniques
that it breaks down into that with a
technique I.D.
And so if you ever had a solution or
something and they said these are
the following technique I.D.
we defend against,
you could trace that back to these
areas.
And then if you want to go even
deeper, you can click a particular
technique area
and it then breaks that technique
down into its description.
The I.D.
tactic is, of course, initial
access. Any given platform here,
spearfishing attachments can work in
data sources in which they were
able to collect information
version.
The data was created last modifieds.
If you want to see when it was
updated last, you can see it's
pretty current as of this year.
And then they've got some procedure
examples. And so within this it's
got different groups and it
describes kind of like Apte twenty
nine, you spearfishing emails with
an attachment to deliver files with
exploits to a victim.
And so it breaks down each of those
given areas.
Here's emoted.
And so you can see here, there are
different groups, there's some tool
names, and then it has mitigations
down kind of midway
or toward the bottom.
And so it has antivirus and malware,
which if there's malicious payloads
being delivered, that can hopefully
block something. If we're not
looking at a zero day attack,
network intrusion prevention,
restrict Web based content and user
training. Of course, when we talk
about spearfishing or attachments
and things of that nature in
user training can definitely be
beneficial there.
And then each of these areas
will have detection methodologies.
So in this case, network intrusion
detection systems and email gateways
can be used to detect spear fishing
with malicious attachments in
transit.
And it's got some additional
information that covers what
antivirus could potentially detect.
And there are some different areas
where it'll talk about auditing or
different types of logs to save and
things of that nature.
So definitely beneficial
to look at these areas within
the framework and then we
get into references.
Now, references are great
for many reasons.
One, we can see what they were using
in those given areas.
But also if we want to
go to, let's say, the reference
for us or.
We can open that up.
And taking a moment to load,
but in this case, it talks about
Imhotep, which was one of the
ones they mentioned in this
particular area, and so
they actually give some examples and
description, information of what was
sent and seen.
They also go through some
methodology, information here
with how they work and what they do,
and so here's an example, following
paths as far
as you know, looking for the malware
and things of that nature, the
impact and solution.
And so that's a great resource to
have. If you're, again, trying to
combat emoted, if you've
got, you know,
an attack that's happened and you
think it was from spear fishing and
you've got some threat ID
information or some hash information
that helps, they're so great to have
that data.
Now, under this, we also
have techniques.
Which within this, it just shows
different techniques within
the enterprise area and
it's alphabetized in this case.
And then we can go to mitigation,
so essentially it's breaking
everything down outside
of each of the individual vectors.
And then we can go into groups,
so these are some of the different.
And again, if I want to know about
Apte 30 to
click right in, pull it up,
gives me some information about what
their focus is or what
are some techniques that they've
used in some ways that they've
compromised entities and
individuals,
softwares that have been used.
So this is great as well.
So IP config, that's just some
command line information.
But maybe Cats', we've heard
of maybe cats, but maybe you want
to read more about it.
There we go. Talks about it being a
credential. No, what it does.
Techniques used and some things that
it's done. And what you can look for
groups that have used the software.
And so that's not a small set
there. That's a pretty good size
group. And then some different
references, again, if I want to read
more.
I just pop right in.
And it talks about Apte thirty four
gives me a little information here,
so overall
the framework is solid.
I mean, you can go into software's
different softwares that have been
used all winter
AAFP, which we know what AAFP is,
baby shark.
Lord, don't go sailing on me now,
brave prince. So I mean, just
boundless amounts of information
that you can use. You could probably
spend a week looking through
all of the different data sets and
resources and information they keep.
In fact, you hear.
And so if there's anything that we
explain that you want further
details on, you can go in
and they provide some answers to
some of those different areas as
well as legal.
And then if you want to contribute
to the framework,
they've got some different areas in
here that you can read up on as
well.
And so, again,
this is a pretty boundless
framework. They're always working on
this and updating it.
There is plenty to see here.
If you're a researcher, academic,
if you are blue team member, red
team, purple team consultant,
business owner, vendor
solutions provider, managed
service provider, or whatever the
case may be.
There is something here in this
framework that you can take
advantage of in that you can use.
And so I definitely recommend that
you take some time to dig through
the site, understand what
it has to offer and where you can
apply to get the different controls
and techniques within it to
help minimize risk and
hopefully make threat actors jobs a
little bit harder than they are
today.
So with that, let's go ahead and
jump back over to our slides.
All right, everybody.
Well, I hope you enjoyed that tour
of the site, I hope you enjoyed
seeing all the different resources
and things that are available,
really. It is just a repository
of wonderful information on top
of wonderful information.
So if you're needing to do research
for a paper, if you're trying to
figure out some new vectors, if
you're trying to just touch
up on some different threat groups,
softwares, whatever the case may be,
as you saw this particular
site and this group has
it and it is beautiful.
So I encourage you to continue
to explore the miner site,
especially the attack framework and
all of the goods that it has to
provide to you as a professional
or just hobbyist, whatever the case
may be.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.