If you've watched any of my courses,
you know I really like to focus on getting to the demonstration.
I want to show you what the things are going to look like
that you're going to see in the real world,
and keeping in that theme,
there's not a single red team tools course that will exist without a demo.
In fact,
the structure is such that you're presented with the
general concepts of what the tool is, and why,
and then launched immediately into demonstration of
its function as fast as possible,
getting you from hands‑on keyboard to popping shells as quickly as we can.
And with that, I'm going to demo the ATT&CK Navigator,
covering the best way to use this framework to map the most
likely and most dangerous threats to techniques,
so that you can then use the courses to emulate the
adversary that matters to you.
You can browse to the link directly if you like and
look around to your heart's desire,
but I'm going to focus on the ways that I try to leverage this information
to be most directly impactful for security operations.
After all, efficiency with resources is the name of the game,
regardless of the industry.
Once landing on attack.mitre.org, and yes,
they use an A instead of ampersand,
you can see that they already have sub‑techniques going
live beta and coming mainstream soon.
In the core of MITRE ATT&CK,
the Matrix for Enterprise is showcased on the landing page.
The columns in gray are the tactics,
and each item under these categories are specific techniques.
Not everything happens post compromise,
and everything that happens up until the adversary's initial
access is categorized as pre‑attack with the same level of
detail you can see reflected in the example of Adversary OPSEC
and infrastructure acquisition,
with specifics on compromising of third‑party signing certificates.
As this develops,
pre‑attack becomes a great resource for getting at the
infrastructure and capability component of the diamond model,
allowing you to narrow in not just on the attribution,
but on groups that actually have the capability to
pose a threat to your organization.
Let me expand on that for one second and talk you through
how I think about using this information.
So you're looking at your organization,
and you have a tested capability that simply does not allow
unsigned code to run in any instance,
or at least attacks on that technique anytime that it's used.
You can focus your efforts on ensuring that you have detections
for any number of the other advanced techniques.
But just because you have tested one capability does not now mean that the
rest of the kill chain for a group that you're worried about,
like maybe APT28, is now cut off.
Zeroing in on the information for that specific group,
you can see how as an enterprise defender for an
organization like the DNC with elections coming up,
you may want to take just a quick look‑see and see what
other techniques this group is known to use,
and start tailoring your efforts to shore up your defenses
against those capabilities specifically,
which, as you can see, go well beyond acquired valid code signing certificates.
To make sure that your mitigations and detections are implemented properly,
you need to run red team ops on your organization,
and to do that, you need red team tools,
because as much as I would love to go wild using
software with awesome names like CHOPSTICK,
and Core Loader, and _____, those, as you can see,
are just straight‑up compiled malware, and that is where red team tools come in.
One last thing,
this little workflow seemed to work pretty well for me to walk you
through the thought pattern of how to use this information,
but you don't have to think like me, in fact,
it's probably better that you don't.
Diversity breeds excellence, right?
You can go back to Matrices, then click the button for ATT&CK Navigator.
And now, regardless of the thought process,
this tool helps automate the use of the information.
Worried about a specific APT?
Navigator's got you.
Simply use the selection controls, multi‑select,
scroll to APT28, and click select.
Maybe based on some current intel, you're also worried about APT41.
All the techniques for both groups are highlighted.
You can export this to Excel, change the colors,
make it pretty or easier to read in different views,
and even add custom legends to create operational plans that you
can use to run red team activities or test your defenses against
known behavior of advanced adversaries.