>> Hello, and welcome to
another lesson from the module: Campaign Analysis.
In this video, we are going to talk about
MITRE ATT&CK and MITRE Threat Group Tracker.
Organizations nowadays are facing
an increasing trend where
threat scenarios from Advanced Persistent Threats
or APTs are becoming more sophisticated,
and these organizations are struggling to be
able to defend themselves against these threats.
For those just starting out who may
not have many resources available,
you can start to use
an ATT&CK framework and MITRE Threat Group Tracker.
In this lesson, we will discover
together this MITRE ATT&CK Framework
and how is it useful for
cyber threat intelligence and campaign analysis.
We will see the benefits of this framework,
and we'll learn also about
another framework provided by MITRE,
which is MITRE Threat Group Tracker.
We will finish this lesson with a practical use case.
The MITRE ATT&CK Framework has gained a lot of
popularity in the security industry over the past year.
For those who are not familiar,
ATT&CK is the adversarial tactics,
techniques, and common knowledge framework
available from MITRE.
It is a curated knowledge base of 11 tactics and
hundreds of techniques that attackers can
leverage when compromising enterprises.
ATT&CK can be useful for any organization who wants
to move towards a threat and form a defense.
For an organization with just a couple of
analysts who wants to
start using ATT&CK for threat intelligence,
one way you can start is by
taking a single group you care
about and look at
their behaviors as structured in ATT&CK Framework.
Today, there are a lot of products that map to ATT&CK,
so you can use their information as reference.
If it's not the case for you,
you might choose a group from those
mapped on the MITRE Threat Group Tracker.
While there are certainly other ways to
share threat intelligence like the ones we've
already seen in previous videos when we were
talking about common standards
used in cyber threat intelligence,
such as STIX and TAXII Standards,
ATT&CK provides a common language that's
standardized and globally accessible.
As Katie Nickels,
ATT&CK Threat Intelligence Lead for MITRE points out,
analysts and defenders can work together with
data to compare and contrast threat groups.
Analysts and defenders can both
structure their information using ATT&CK.
Analysts can structure intelligence
about adversary behavior,
and defenders can structure information
about what behavior they can detect and mitigate.
By identifying the highest priority techniques,
an organization can better
determine how to mitigate and detect them.
Now we can move to see
the benefits of MITRE ATT&CK Framework.
ATT&CK gives us a structured way to
describe adversary TTPs and behavior.
This structure allows us to
compare adversary groups to themselves,
to other groups,
and to defenses in a way that addresses some of
the challenges that are encountered by companies.
Organizations can leverage the framework
to create a map to their defense systems.
Creating the entries for MITRE ATT&CK
Navigator for specific actors is a good way of
visualizing the strengths and weaknesses of
one's environment relating to these actors or groups.
It can also be used to categorize tests carried out
on an organizations internal
systems together with their results.
Now we can introduce
the second framework provided by a MITRE,
which is Threat Group Tracker.
Here, groups are sets of
related intrusion activities that are
tracked by a common name in the security community.
Analysts track clusters of activities using
various analytic methodologies and
terms such as threat groups,
activity groups, intrusion sets, and campaigns.
Some groups have multiple names
associated with similar activities due to
various organizations
tracking same activities by a different name.
Analysts track clusters of activity using
various analytic methodologies and
terms such as threat groups,
activity groups, threat actors,
intrusion sets, and campaigns.
Some groups have multiple names
associated with similar activities due
to various organizations tracking
similar activities by different names.
The information provided does not represent
all possible techniques that are used by the groups,
but rather a subset that is
available through open source reporting.
For the time being,
there are 91 groups currently mapped on the platform.
Let's see how all of this works in a practical way.
The graphic shown in this slide compares
techniques used by APT3 and APT29,
including the techniques from the software they use.
APT3 is a China-based threat group that
researchers have attributed to
China's Ministry of State Security.
APT29 is a threat group that has been attributed to
Russian Government and has operated since at least 2008.
The techniques used only by
APT3 are highlighted in blue,
and the ones that are only used by
APT29 are highlighted in yellow.
The ones that are used by both APT3 and
APT29 are color coded in green.
If APT3 and APT29 were
two groups that an organization
considered to be high threats,
the techniques in green may be
the highest priority to
determine how to mitigate and detect.
Next, as the defenders,
you can populate an ATT&CK Matrix
with what techniques you can detect.
You can overlay that on the matrix
showing what are the techniques used by adversaries.
In this example, we use the red color
to denote those techniques that both groups,
APT3 and APT29 are using,
and the company cannot detect.
The techniques in red would likely be
the highest priority to focus on by the company.
This is all for this lesson.
We've seen MITRE ATT&CK Matrix,
how is it used for cyber threat intelligence?
We've seen the benefits of ATT&CK Framework.
We discovered another framework
which is MITRE Threat Group Tracker.
We've seen an example how to work
with MITRE Threat Group Tracker.
In summary, MITRE ATT&CK includes a raft of
tools and resources to complement any security strategy.
This framework provides companies
with threat intelligence and gives them
an idea of how prepared they
are to detect and respond to intrusions.
In this way, they are able to meet
their cybersecurity needs and can be
ready wherever bad actors strike.
I hope you enjoyed this lesson.
The next video will be about
threat intelligence naming conventions.