- CISA Best Practices MITRE ATT&CK Mapping
- CAR - CYBER ANALYTICS REPOSITORY
- MITRE ATT&CK
- General Info:
- General resources
- PDF: Foundations of Operationalizing MITRE ATT&CK
- MATRIX - USAGE
- MATRIX & GROUPS -
- BY INDUSTRY -
- NAVIGATOR
- Example usage
- Red Team Simulators:
- Breach and Attack Simulations (BAS) Technologies
- MITRE CAR (Cyber Analytics Repository)
- MITRE D3FENSE
- WINDOWS
MITRE ATT&CK DEFENDER (MAD): https://mitre-engenuity.org/mad/ (Link: "Get training" → Cybrary → Free when training from MAD) https://mitre-engenuity.org/blog/2021/03/25/mad-press-release/https://www.cybrary.it/catalog/refined/?q=mit Getting Started ATT&CK: https://attack.mitre.org/resources/getting-started/
CISA Best Practices MITRE ATT&CK Mapping
https://www.cisa.gov/news-events/alerts/2023/01/17/cisa-updates-best-practices-mapping-mitre-attckr
CAR - CYBER ANALYTICS REPOSITORY
Scripts for Sysmon, Osquery → Splunk, etc. To detect Tactics/Techniques
MITRE ATT&CK
General Info:
Tactic vs. Technique vs. Procedure:
Tactics: Adversary's Technical Goals
Techniques: How those Goals are achieved.
Procedures: Specific implementations of techniques.
"Atomic Indicator": IP address, File Hash, etc. (Minimal indicators of adversarial presence)
Usage: Incident Report / Observable Behavior → Mapping to MITRE ATT&CK
Recommendations:
- UNDERSTAND ATT&CK
- FIND BEHAVIOR
- RESEARCH BEHAVIOR
- TRANSLATE THE BEHAVIOR → TACTIC
- WHICH TECHNIQUES APPLIES TO THE BEHAVIOR
- COMPARE RESULTS
General resources
Pdf: Getting started with ATT&CK (GOOD)
PDF: Foundations of Operationalizing MITRE ATT&CK
MITRE ATT&CK FOR DUMMIES PDF
MITRE ATT&CK GROUPS
MATRIX - USAGE
MATRIX & GROUPS -
BY INDUSTRY -
Example: Searching for ecommerce industry:
NAVIGATOR
Use the Navigator directly for a custom Matrix or select it from APT Group, technique, or even Software (i.e. Mimikatz) and see the Matrix already highlighted for the tactic, technique, group or swoftware:
Example usage
Ejemplo: Conti (Software)
Red Team Simulators:
Breach and Attack Simulations (BAS) Technologies
MITRE CAR (Cyber Analytics Repository)
Usage (Extract logs → Integrate a SIEM → Use Datasets for testing → Analyze with MITRE CAR)
- Use SIGMA for translating CAR analytics into other languages
MITRE D3FENSE
WINDOWS
This “Windows ATT&CK Logging Cheat Sheet” is intended to help you map the tactics and techniques of the Mitre ATT&CK framework to Windows audit log event IDs in order to know what to collect and harvest, and also what you could hunt for using Windows logging Event IDs.