Hey, humans.
I'm Aaron Rosenmund, and welcome to Blue Team Tools: Defense
Against Adversary Activity Using MITRE Techniques.
Quite the title, right?
Well, I agree.
Thank you for noticing.
It's meant to be inclusive of the deceptively broad topic I'm about
to cover while also giving me ample chances to mess it up by saying
defense against the dark arts instead, though that isn't entirely incorrect,
is it?
I don't know, Aaron.
That's what you're supposed to be telling me in this course. That's a
valid point, but stop breaking the fourth wall.
This isn't a Shakespeare play. But where does this story start?
Well, it all starts with you, the blue team operator, a security engineer,
SOC analyst, or are you an incident responder?
No, no, no.
You, you are a threat hunter. A threat hunter and the tools, the
tools are what you use to assess the environment,
stalk the adversary, and cut them down with precision.
Regardless of your role, you need tools,
software, or sets of software that help you do your job.
And before you flip the channel thinking that you've got it
covered with your enterprise solutions, I'm here to tell you, no,
no,
you don't. By now, you realize that this game of keeping up with the
advancements of malicious actors is never ending.
And just as malfeasance individuals and groups create
new ways to exploit your applications,
systems, and processes every day, you need tools that
leverage new ways of detecting this activity.
Congrats.
You've been conscripted into the cyber arms race.
Don't stress about it.
You didn't have a choice.
And what does that look like?
Well, let's use pictures.
Here is your security.
See the gap?
That's where the attackers get in, and it grows wider and wider as time
goes on and new technologies are developed that avoid all this surface
area that you don't have adequately covered.
And when I say covered,
I'm talking about cyber security functions that have to
operate within your business so that you can detect attackers
and the techniques that they use.
And that's what this is really all about, where are these gaps in your
functions that enable vulnerabilities that always exist to actually be
exploited? And just like other arms races, it really doesn't matter
which side you butter your toast on.
No one is slowing down to wait on anyone else. This race is
accelerated by the exponential churn of new technology, all
required to keep your business on the cutting edge.
So what am I saying?
Well,
if I'm saying anything at all, it's that the blue team tools,
specifically, the wonderful world of open‑source blue team
tools that we're discussing today, are the answer.
They are there to quickly fill the gaps that are too
cumbersome for enterprise solutions to fill.
If you want to work with a new data source to detect a new red
team tool that was released or a MITRE ATT&CK technique that
you're not sure you have coverage for, well,
there's a blue team tool for that,
and you can implement it without a procurement cycle, or an
evaluation period, or a contract, or any of that.
See if you like it, and then if you really need this capability,
you then have two choices.
You can invest in the people and give them the skills that they need
to continue to support the open‑source solution,
something I'm partial to,
or you can find an enterprise solution that provides that same
gap fill with the open‑source tool as a stopgap until you can
get the enterprise solution going.
Still not convinced? That's okay.
The rest of this course is going to go over where Blue team tools fit into the
familiar frameworks that we all use to build our business security, then I'm
going to get in to how adversary activity can inform our use of blue team tools
and how we can align these defense capabilities to the offensive capabilities
with MITRE ATT&CK, and finally,
I'll take a look at MITRE Shield as a way to chart out how you build a
defensive capability, matched with the threats to your industry. And while
we're at it, I don't want to go too much further without recognizing the
amazing individuals and teams that work together,
often in their own time, to upkeep these tools for free, all so the community
and the industry as a whole can benefit. And don't worry,
we're not ever going to take credit or in any way imply
that we're responsible for these tools.
We simply want the world to know more about them.