|
4 | 4 | "cell_type": "markdown", |
5 | 5 | "metadata": {}, |
6 | 6 | "source": [ |
7 | | - "# Prioritizing Using ATT&CK and the Navigator\n", |
| 7 | + "# Prioritizing Detection Using ATT&CK and the Navigator\n", |
| 8 | + "\n", |
| 9 | + "We're going to use the ATT&CK Navigator to overlay some layers and start to prioritize what we want to detect. This is a simplistic approach based on selecting a set of adversaries in the navigator and relying on mapping a threat report." |
| 10 | + ] |
| 11 | + }, |
| 12 | + { |
| 13 | + "cell_type": "markdown", |
| 14 | + "metadata": {}, |
| 15 | + "source": [ |
| 16 | + "## Scoring Existing Adversaries\n", |
| 17 | + "\n", |
| 18 | + "ATT&CK itself already has a set of threat intelligence mapped and accessible in the navigator. We can use that CTI in order to select all techniques that we've seen specific adversary groups use.\n", |
| 19 | + "\n", |
| 20 | + "In this case, let's select and score APT1 and APT3.\n", |
8 | 21 | "\n", |
9 | 22 | "1. Open up the [ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/enterprise/).\n", |
10 | | - "2. Select all of the techniques for APT1 and APT3.\n", |
11 | | - "3. Assign them a score." |
| 23 | + "2. Our threat model includes APT1 and APT3. How would you show that in a heatmap?\n", |
| 24 | + "3. To be safe, download the JSON to save it for later.\n", |
| 25 | + "\n", |
| 26 | + "*Consider: What are the downsides of this approach?*" |
12 | 27 | ] |
13 | 28 | }, |
14 | 29 | { |
15 | | - "attachments": {}, |
16 | 30 | "cell_type": "markdown", |
17 | 31 | "metadata": {}, |
18 | 32 | "source": [ |
19 | 33 | "# Adding Additional Internal or Local CTI\n", |
20 | 34 | "\n", |
21 | 35 | "Create a new layer, and select the techniques you see in the following threat report, which impacts your sector and was active over the past summer.\n", |
22 | 36 | "\n", |
| 37 | + "**Note: MITRE's ATT&CK for CTI training discusses how to map threat reports into ATT&CK in order to arrive at this list of techniques. We didn't want to duplicate that training, so have simply provided a list.**\n", |
| 38 | + "\n", |
23 | 39 | "* Credential Dumping: https://attack.mitre.org/techniques/T1003/ \n", |
24 | 40 | "* Bypass User Account Control: https://attack.mitre.org/techniques/T1088/ \n", |
25 | 41 | "* Powershell: https://attack.mitre.org/techniques/T1086/ \n", |
26 | 42 | "* NTFS File Attributes: https://attack.mitre.org/techniques/T1096/\n", |
27 | 43 | "* File Permissions Modification: https://attack.mitre.org/techniques/T1222/ \n", |
28 | | - "* Indicator Blocking: https://attack.mitre.org/techniques/T1054/" |
| 44 | + "* Indicator Blocking: https://attack.mitre.org/techniques/T1054/\n", |
| 45 | + "\n", |
| 46 | + "*Consider: What extra threat information, in addition to the techniques, would be helpful at building detections?*" |
29 | 47 | ] |
30 | 48 | }, |
31 | 49 | { |
|
34 | 52 | "source": [ |
35 | 53 | "# Developing our Priorities\n", |
36 | 54 | "\n", |
37 | | - "We need to combine these layers into one set of priorities.\n", |
38 | | - "\n", |
39 | | - "1. Create a new layer as a function on previous layers.\n", |
40 | | - "2. Adjust the formula and scoring so that you get prioritized detections.\n", |
| 55 | + "We need to combine these layers into one set of priorities. We can do that by creating a new layer as a function of previous layers.\n", |
41 | 56 | "\n", |
42 | | - "BONUS:\n", |
43 | | - "1. What if you want to weight the recent incidents higher?\n" |
| 57 | + "1. Making sure to have the APT1/APT3 layer in the navigator and the new custom layer in the navigator, hit the plus to create a new layer.\n", |
| 58 | + "2. Adjust the formula and scoring so that you get prioritized detections. How would you weight these different sets of intelligence? What are your top techniques?" |
44 | 59 | ] |
45 | 60 | }, |
46 | 61 | { |
|
51 | 66 | "\n", |
52 | 67 | "Let's assume we want to detect the techniques used in the recent Blue Panda campaign. How would we see which techniques we could cover given our data sources?\n", |
53 | 68 | "\n", |
54 | | - "What other changes might we want to make?" |
| 69 | + "1. Keeping your prioritization heatmap in the navigator, open up your data sources layer.\n", |
| 70 | + "2. Create a new layer that shows you, of your prioritized techniques:\n", |
| 71 | + " * Which can be detected given current data collection\n", |
| 72 | + " * Where you have gaps.\n", |
| 73 | + "\n", |
| 74 | + "*Consider: What data sources might you want to add to increase coverage?*" |
55 | 75 | ] |
56 | | - }, |
57 | | - { |
58 | | - "cell_type": "code", |
59 | | - "execution_count": null, |
60 | | - "metadata": {}, |
61 | | - "outputs": [], |
62 | | - "source": [] |
63 | 76 | } |
64 | 77 | ], |
65 | 78 | "metadata": { |
|
0 commit comments