>> Welcome to MITRE ATT&CK for
Cyber Threat Intelligence Training.
This is Module 0, introducing the training.
I'm Adam Pennington, and I'll be
your instructor for this part of the training.
I lead MITRE ATT&CK and
created the first version of this course,
along with my former colleague, Kitty Nichols.
I've been around ATT&CK since
its initial creation and even
gathered much of the intelligence that was
used in ATT&CK's first version.
In my 12 years at MITRE,
I've been largely focused on
cyber threat intelligence and deception.
I've been both the defender in
the CTI analyst in multiple operations centers.
This module only has
one lesson where I'm introducing the training
itself and going over a little bit
about how ATT&CK can help with cyber threat intelligence.
This lesson has three objectives.
I'm first going to go over
the training goals for the overall course.
I'm going to review how
the training modules are laid out,
and then I'm going to get into a little bit about how
ATT&CK can help for cyber threat intelligence.
We have a number of goals that we're
hoping you'll take away from this course.
First is, why ATT&CK is
useful for cyber threat intelligence.
We want you to have some understanding of
why you might use it in the first place.
How to map to ATT&CK from
both narrative reporting and raw data.
How do you get the intelligence that you
have today into language of ATT&CK?
We want you to have an understanding of how
to store and display
ATT&CK-mapped data and what
you should consider when you're actually doing that.
We want you to have an understanding of how to perform
cyber threat intelligence analysis
using ATT&CK-mapped data.
Finally, taking that intelligence,
how to make defensive recommendations to your defenders.
You might notice that learning ATT&CK isn't in
here and we're assuming
some knowledge of ATT&CK in this course.
I'll get into some more resources
for learning about it in Module 1,
but you'll get a lot more out
of this course if you complete
our ATT&CK fundamentals training or another method of
learning about the structure and
contents of ATT&CK first.
The way the rest of this course is laid out,
we're currently in Module 0,
where I'm introducing the training
itself and I'll get into
a little bit about why ATT&CK is
useful for cyber threat intelligence in a moment.
In Module 1, I'll get into how to
map to ATT&CK from narrative reporting,
how to take the existing reporting you have today talking
about adversaries and add ATT&CK to it.
We'll then switch into mapping to ATT&CK from raw data.
How can you take your reporting from malware analysis,
your raw incident response data,
and turn that into ATT&CK as well?
Then move on in Module 3 into storing
and analyzing ATT&CK-mapped intelligence.
Once you have your intelligence leveraging ATT&CK,
how can we actually store and make sense of it,
be able to compare it,
look at it in intelligent ways?
Finally, we'll wrap up with making
ATT&CK-mapped data actionable and how to
give defensive recommendations to your defenders
from this ATT&CK-mapped intelligence.
Before getting into ATT&CK,
I wanted to take a moment to talk about
what is cyber threat intelligence,
since it's commonly misunderstood.
Sergio Caltagirone in a paper he wrote on
industrial control system intelligence
gave a definition we like.
"Threat intelligence is actionable knowledge and
insight on adversaries and their malicious activities,
enabling defenders and their organizations to reduce
harm through better security decision-making."
It's a great definition and
the only addition we might make to
that is that it's actual knowledge and insight,
but it's also the process of doing that.
From that definition, I'm going to talk about how
ATT&CK can help with cyber threat intelligence.
There is a couple of ways that we see that
ATT&CK can help with cyber threat intelligence.
You can use your knowledge of
adversary behaviors that you're
getting through ATT&CK to help inform defenders.
You can also structure threat intelligence with ATT&CK.
This allows us to do a couple of things.
We can do things like compare
behaviors between adversaries.
We can say one threat group does a specific thing and
other threat group does another set of
behaviors and look at them next to each other.
We can compare a single group over time.
We can say APT3 today is doing a particular behavior.
What did they look like a year or two ago?
How do they change over time?
We can also compare groups to defenses.
What is it that an adversary really care about does
and how well do our defenses stack up to that adversary?
It also lets us communicate in
a common language just to be able to talk to each
other using the same language to
talk about behavioral cyber threat intelligence.
When we say it allows you to communicate to defenders,
CTI analysts might currently be
saying this is what the adversary is doing.
The run key is Adobe Updater.
If they leverage ATT&CK,
they can point at a specific ATT&CK technique,
T1547.001, which is
Boot or Logon Autostart
Execution Registry Run Keys Startup Folder.
If the CTI analysts uses this common language,
it means that the defender has a lot of
resources they can look at to see
if they might be able to detect it and
how might they go about seeing this in the future.
We say that it allows
people to communicate with each other.
Existing reporting, we might have Company A
saying APT Lee is using AutoRun,
and Company B saying Fuzzy Duck used a run key.
If they both leverage ATT&CK,
they then have a common definition.
Again, this is T1547.001.
When both companies are using the same language,
it means that cyber threat intelligence consumers
understand what they mean by it.
In this lesson, we covered a couple of things.
I went over the training goals for the overall course.
I took a look at how the modules are
going to be laid out for the rest of it.
We also took a look at how ATT&CK can help with
cyber threat intelligence by
giving a common language instruction.
This is just the beginning of our journey on
working with ATT&CK for cyber threat intelligence,
and next up, I'll be getting into
how to map to ATT&CK from narrative reports.
This is Module 1,
mapping to ATT&CK from narrative reports.
This module, we have four high-level objectives.
First, to learn how to identify
behaviors in narrative reporting.
To understand how to translate those behaviors into
ATT&CK tactics techniques and sub techniques.
I want you to get
some practice mapping narrative reporting to ATT&CK.
I'm going to try to help you understand analysts and
source bias and learn how to hedge against these.
We've broken up this module into six lessons.
In this lesson, I'm going to be
getting into the challenges,
advantages, and the ATT&CK mapping process.
Next, we're going to get into finding in
research and behaviors and narrative reporting.
How to translate those behaviors you
find into ATT&CK tactics,
how to identify techniques and
sub techniques within those tactics from the reporting,
I'm going to give you
some practice mapping a narrative report to ATT&CK,
and finally, I'm going to get a bit into how to hedge
your biases that are likely
to happen throughout this process.
This is our first lesson in the module,
we're getting into the challenges, advantages,
and the process of mapping to ATT&CK.
This lesson have three objectives.
We'll help you understand
the prerequisites for ATT&CK mapping.
What is it you need to have in your toolkit and what
needs to be true about the reporting itself for
you to be likely to be able to map it to ATT&CK?
I'm going to get a little bit into
both the down and the upsides of mapping to ATT&CK.
Finally, I'm going to go over
the process that we're going to be using for the rest of
this module for mapping to narrative reporting.
In order to get started with ATT&CK,
there are a number of
resources out there that might help you get going.
We've created another course along with
this one called ATT&CK fundamentals,
that you can take that it'll go over a lot of
the structure in basics of MITRE ATT&CK.
Among the team, we've put out a lot of presentations like
MITRE ATT&CK The Plate Home Edition from Black Hat USA.
On our website, we have things like
our design and philosophy paper and
getting started page that has a lot
of resources for getting going with ATT&CK.
Even just something like reading the tactic descriptions.
There are only 14 enterprise ATT&CK,
and that can give you a much better idea
of what's going to be in there as you dig in.
You can pick a random and start
skimming techniques and sub techniques in ATT&CK,
start reading the descriptions,
look at what pieces are actually in there.
Once you're a bit more comfortable
and you've gotten started with ATT&CK,
you can also still challenge yourself to
ongoing learning and discussion.
Something we've seen some other teams do is
in their weekly meeting or something like that,
learn a technique and associated sub technique a week.
Cover one little piece of ATT&CK.
This can also be something you do as a team.
Going over techniques and sub techniques,
talking about with another analysts are talking about
with the rest of your threat intelligence team.
When you're mapping to ATT&CK,
there are both challenges and advantages
that you're likely to gain
from going through this process.
Some of the challenges.
Mapping to ATT&CK requires a shift in thinking.
If you're used to thinking about
a focus on an adversary as indicators of compromise.
Talking about IP addresses, hashes,
talking about behaviors instead can be a bit of a shift.
ATT&CK is fairly big at this point.
There are quite a few ATT&CK techniques
and sub techniques,
and it can seem overwhelming,
just trying to consume it all at once.
ATT&CK gets into the technical details of
how adversary is actually doing a particular behavior.
This can get complex.
It can be outside of your particular skill area,
and so it can seem really complex.
We do think there are some advantages as
well as working through this process.
Working with behaviors and working with
ATT&CK forces a shift in thinking.
You end up actually thinking about behaviors which
can be a really good place to catch adversaries,
instead of just looking at indicators.
It can give you opportunities to
discover new adversary techniques.
In looking at behaviors,
you may actually see things that
even ATT&CK doesn't have yet.
It can facilitate learning of the technical side.
I can help you start to understand
the technical basis for
things that adversaries are doing.
With understanding ATT&CK being a prerequisite,
we're going to go through the rest of
this mapping process throughout the rest of this module.
We're going to start with finding the behavior.
How do we take our narrative reporting and recognize
what is behavior that likely
would be found in ATT&CK in the first place?
We're going to research that behavior.
We want to understand a little bit
about what it is the adversary is doing,
why they're likely doing it so
that we can dive further into ATT&CK.
We're going to translate that behavior into a tactic.
We want to go through the 14 tactics of
ATT&CK and figure out
which one that adversary activity would likely fit into.
We're next going to go one level deeper.
We're going to try to identify techniques or
sub techniques for that particular behavior.
Finally, we recommend comparing
your results to other analysts.
It helps hedge against bias
and it gets you a better result in the end.
This lesson, we've covered a couple of quick things.
We've reviewed the prerequisites to ATT&CK mapping
and some of the resources to help you
get started with the ATT&CK itself.
We've talked about some of the challenges and
corresponding advantages to doing
this ATT&CK mapping process in the first place.
Finally, I've given the ATT&CK mapping process
that we're going to be using for
the rest of this module for
coming from a narrative reporting.