OK, so Myersville was really cool, the last lecture we talked about, the minor attack methodologies.
Now we're going to flip it on its end and look at the Miter Shield methodology.
This is when we're talking about active defense and cyber deceptions, which are sort of like distributed
honeypots.
And any blue team should definitely employ these techniques because they can certainly give you the
upper hand against an adversary who has a foothold in your network.
So if we look at the active defensive matrix, you can see that there are, as there are in the wider
attack framework, there are tactics which basically talks about what does the defender try to do while
the defenders trying to channel defenders trying to collect.
Right.
They're trying to contain all these different things.
Right.
And the techniques describes how they can actually do that.
So look at application diversity.
This is a technique when it comes to active defense in what you can do here is you present the adversary
with a variety of installed applications and services.
Right.
And so what this does is it just can give them an opportunity.
What really a detection opportunity here.
You can see you have an opportunity to study the adversary, you know, get some behavioral analytics
and behavioral indicators of compromise.
You can discover what is being targeted, you know, what is the adversary after.
So this is one of the things that application diversity can get you.
And then you can scroll down, you can get a couple of use cases, right?
You can install decoy services that have extensible capabilities for medical services.
Well, there's lots of them, right?
There's different cyber deception or I guess you can call them deception platforms that exist.
So you could Google those and find them.
There's a couple of different top vendors and then you can go down.
You can see also where there's an overlap between the miter shield and might attack.
It will tell you.
So, again, you know, this is another useful resource is not as popular as mortar attack, but it's
definitely newer.
But don't let that fool you into thinking that you don't need to do this right.
For example, look at this.
I click on Decoy Account.
And now I can see what this can do right, create an account that is used for active defensive purposes,
a decoy account is one that is specifically used for defensive and deceptive purposes.
Right.
A decoy account can be used to make a system service or software look more realistic or to entice an
action.
And if you have some opportunity, some detection opportunities and everything's mapped again to make
it very easy to find what you want to do.
All right.
So that's really all I want to show you for MITers Shield.
And that's why I really I just want you to be aware of it so that, you know, it's out there.
You don't really have to study each of these tactics unless you want to.
But, you know, I just want you to be aware of it.
It's relatively new, but it's definitely becoming an emerging resource for threat hunters and blue
demons.
So on the next lecture, we are going to dig into the OAS top 10 methodology, perhaps the most famous
methodologies.
I will see you guys in the next lecture when we dig into the top 10.
But.