Introduction To The MITRE ATT&CK Framework

Key Takeaways

hey guys hack exploit here back again with another video and welcome back to the red team series uh in this video we're going to be getting a formal proper introduction to the MIT attack framework so in the previous video when we were going over the various red team Frameworks and methodologies like again uh the attack framework the M attack framework I should say the Cyber kill chain and the unified kill chain um you know I uh introduced you to the attack framework uh and you know how it's typically used uh for red team operations but I know that that must have confused you a little bit and that's why we're going to be you know now taking a look at the attack framework uh not just getting an introduction to it and understanding what it is but also how it is used uh by red teamers or during red team operations um with that being said let's get started so we'll uh switch over from the slides once I've given you the introduction onto the attack framework website but you know you may be asking yourself if this is your first time hearing about the attack framework uh you know you may be asking yourself what is the MIT attack framework or if you have heard of it before you might be a little bit confused about it and that's what um I'm going to try and uh resolve or at least um I'm going to try and answer that question in a very contextualized format so the MIT attack framework is a globally accessible knowledge base of adversary tactics and techniques based on real world threats and threat actors uh you more specifically AP groups right so just pay attention to that description so globally accessible what does that mean it means it's open you know uh it's free to use you don't need to pay anything you don't need to register an account great second uh second word or words are knowledge base all right uh if you think about what a knowledge base is um and uh you know how knowledge bases are use that should give you a better understanding of uh you know what uh the attack framework is or how it can be used so when I say knowledge based as a red team I just think of it as a reference uh you know just think of it as a reference or documentation on all uh publicly disclosed um attack s or breaches by AP groups that have been classified uh against or um have been classified in or by the might attack team and this is all uh organized uh through the use of the attack framework itself and all the tactics techniques and procedures that encapsulate it uh so it was essentially developed to improve the understanding of how cyber attacks are performed now attack uh which is an obvious abbreviation is uh you know an abbreviation for adversarial tactics techniques and common knowledge right and the might attack framework is typically employed or used as a Baseline and model for adversarial behavior and highlights the various phases of an adversary uh or the threat attack life cycle um you know what software the attackers employ and uh more importantly what operating systems or what type of environments they target uh it is mostly used by red and or blue teamers to plan Implement and orchestrate engagements based on specific threat actors or APS um and that's specifically in the case of adversary emulation or simulation now one common Mis Noma is that you know the attack framework is really only useful for the red team or if you're offensive minded however the blue team and I can say this from experience is also a valuable resource for blue teamers or sock analysts as it details the ttps used by a specific threat actor uh and provides companies or blue teams with valuable cyber threat intelligence that can consequently be used to implement defenses and mitigations for specific techniques so let's say you know if we'll actually be taking a look at a practical demo in a second and I'll I'll use some examples to help explain how it can be used so don't worry if it's still confusing now the might attack framework categorizes advisal techniques into a collection um of tactics that are further organized into techniques sub techniques and procedures which is where we get the abbreviated term ttps so whenever I refer to ttps just know that it's in relation to the MIT attack framework and generally speaking represents you know the tactics techniques and you know uh sub techniques and procedures of an adversary or if you're performing a red team operation it represents the ttps that you're going to be implementing uh you know during the red team operation and by this this point you can sort of understand uh how and why uh the attack framework is used by Red teamers specifically so uh you can see I've just added the screenshot here of the attack framework um and the tactics uh represent each phase uh you know of the of an adversaries or a red team operation let's just put it in that context so this represents all the phases that you know you typically see uh you know or you typically go through during a red team operation now remember not every red team operation or not every attack or adversary or AP group you know will follow this sequentially or will actually you know utilize any um all all will actually utilize all of these tactics so you know for example if I'm planning a red team operation I'll obviously you know specify uh or use this as a guideline to uh essentially guide me um in planning the operation so I'm keeping aside adversary ulation or where we're looking at an AP group's ttps and I'm using I'm not looking at it from the perspective of just you know planning a red team operation so for example I could say uh during the Recon phase yeah we want to perform you know some fishing for information we want to perform some active scanning uh and then during resource development we need to acquire some infrastructure for our C2 um you know communication channels or infrastructure we probably want to obtain some capabilities what that means is you know get some malware or develop some payloads that uh you know can evade uh you know uh antivirus or evade detection by antiviruses and then initial access we're going to Target the company's public facing applications or servers and we know that they have a couple of um exposed external uh remote services that we probably want to Target uh for this one we're not really going to be performing any fishing so in terms of execution uh the command and scripting interpreter we're going to be using uh you know made uh or in very close conjunction to our Command and control infrastructure or framework I should say is let's say something like Powershell you get the idea what are we going to do for privilege escalation uh so it just acts as a guideline or provides you with a guideline for planning that you can then adhere to or use again as a guideline when you're actually or when you're orchestrating the operation because I I realize obviously that uh you can Define you know your activities beforehand as best as you want or as accurately as you think you are or as accurately as you think you're you know you're doing uh but once you're performing the red team operation there's obviously going to be some changes and the attack Navigator is more so or more importantly the tool that uh will again tie all of these um or will essentially allow you to uh operationalize the MIT attack framework uh for you know red team operations so uh one of the really really awesome um aspects of the attack framework is that it breaks down ttps tactics techniques and procedures uh according to specific environments so you can see it has ttps for uh Enterprise environments you can also limit it just to Windows environments or Windows operat systems the Mac or the Macos operating system so let's say you're targeting a Windows environment well you can limit the ttps to just show those ttps relevant uh you know for Windows uh or um you know the Windows operating system you can do that for Linux the cloud network uh containers and there also something again really really cool you also have the Matrix uh or the Matrix sorry for mobile environment so uh Android iOS ttps and again also really cool you also have the uh industrial control systems or IC environments and in that case obviously your ttps or the ttps will change and that's why it has this sorting so Enterprise just refers to Enterprise environment so you know just think of it as uh just think of it as representing the ttps uh relevant to uh an Enterprise environment so you know small small medium large um organization so on and so forth uh now diving a little bit deeper into tactics techniques and procedures which again can be abbreviated or is abbreviated uh as TTP or ttps I should say uh what are tactics what are techniques and what are procedures well if we take a look at the screenshot here that again I took from uh the M attack framework website you can see that you know initial AIS is a tactic the techniques are listed under the uh the tactic and then some techniques also have sub techniques so fishing is obviously a very general term or can be thought of as a very wide uh technique in terms of you know the fact that fishing is you know you probably ask yourself well what type of fishing and that's what sub Techniques address so you can see the sub technique for the fishing technique uh you know the sub techniques for the fishing techniques are spear fishing attachments uh spear fishing links or spear fishing via service so describing it a little bit better now uh tactics categorize each step of the adversary's attack methodology or the red team um you know the red team's attack methodology uh tactics represent the adversary's Tactical goal or objective um and uh techniques are used to outline how each tactic is orchestrated so techniques essentially descri cribe actions taken by adversaries to achieve their objective so if our objective is initial access a technique essentially outlines uh the various techniques apologies for the redundancy but it outlines the the techniques and sub techniques that can be used to achieve your objective which is initial access so your techniques just tell you or give you the different ways that you can achieve initial access in this case and the sub techniques are essentially um an implementation of a specific technique that again uh requires a bit more detail or is multifaceted so fishing is multiac is multifaceted in that you can perform fishing through the form of a spear fishing attachment a link via service so on and so forth now the procedures aspect is where a lot of people uh when we talk about procedures this is where a lot of people get confused because again I've taught the M attack framework many times uh but for now just think of it a procedure as an implement mentation of a technique or sub technique now as a red teer uh this may not be that interesting to you at first glance and the procedure or the pro the procedures aspect of the M attack framework is where uh it starts becoming a knowledge base now if you remember when I was introducing it to you it was used the might attack framework was created uh to provide Clarity and an understanding of how attackers of what attackers do uh the actions they take so on and so forth so procedures essentially give you examples of uh let's say how specific AP groups uh performed or uh executed a particular technique so if I clicked on you know spear fishing attachment and you take a look at procedures it's actually quite uh helpful if you go through it because it'll tell you you know what uh AP groups or threat groups or adversaries have used this specific technique or sub technique and more importantly how they implemented it or how they performed it in order to obtain initial access so um just closing off the theoretical section of this video why should you use the attack framework or why am I spending all this time explaining it to you and this will become apparent as we progress within this series and we get into adverse ulation ad pen testing Etc uh but why should you use it well firstly it provides attackers and Defenders with a common knowledge BAS Bas of adversarial Behavior Uh based on behavioral analysis of attacks and threat campaigns that were publicly disclosed so when you talk about cyber threat intelligence and uh you know threat intelligence analysts that are analyzing let's say you know breaches by certain AP groups uh they'll use something like the attack framework or not something like they will use the attack framework to say um okay it looks like uh you know this particular AP group uh gained access through here and they'll say uh okay let's uh you know let's uh select that there and then you build a profile or they able to build a profile and they use the attack framework as a way to organize or to understand what exactly that particular threat actor or AP group did um and uh moving forward or moving on it also organizes and categorizes uh it organizes categorizes and contextualizes aders adversarial Behavior based on the different phases of the attack life cycle and as a r team you're really focused on the life cycle or the tactics CU they sort of give you a structured way of approaching a red team operation and ensuring that again you're able not only to uh you're not you're able not only to understand the different phases that you're likely to go through during the operation but also perform some planning uh more importantly it utilizes common and standardized nomenclature when referencing ttps and AP groups as well as other elements um and it's also frequently updated so this is very important the third Point here where you know I'm referencing the fact that it utilizes a common and standardized nomenclature what do I mean by that well every tactic uh technique or sub technique has a unique ID or identifier that allows me to tell a blue team or a Defender hey you guys didn't you guys didn't do too well at uh you know detecting let's say t158 and just saying that again it doesn't matter whether they know what that technique or what that ID is referring to specifically they can easily take that ID and search for it on the MIT attack framework website and know exactly what I'm talking about so it creates this uh this um shared language uh or provides for this um standardized nomenclature that allows us as red teamers TO bridge the gap in terms of communicating stuff effectively with the blue team and this will become or will make a lot more sense in the next video when we'll be taking a look at the M attack Navigator so now that we've got this you know proper understanding or I should say you know formal understanding of the MIT attack framework and how it uh correlates or it relates to Red Team operations uh I'm now going to switch over into my browser and we can go through the might attack website and you'll you'll actually see what I I was explaining or trying to explain the slide so just give me a second and and I'll be back in just a second no on it ended all right so I'm back uh in my web browser and I'm currently on the M attack framework website which is accessible via the URL attack. m.org or you can just search for it on Google Now when you visit the attack framework website for the first time you know it looks a little bit confusing you probably understand what all of this means now attack Matrix for enterprise Enterprise is a matrix um uh sorry it's a matrix I should say uh which represents the ttps for that are relevant to Enterprise environments uh and it essentially displays you know the tactics uh and each of the techniques and allows you to expand uh you know each of the techniques and list out the sub techniques if they do have one uh but uh you know you can play through this and if you hover over any you know let's say you hover over a tactic like defense evasion this is the common um language or the nomenclature I was referring to the standardized nomenclature you can see that it actually tells you the ID of that tactic and if I hover over a technique within a specific um tactic it also gives me the uh ID of that technique so T1 548 so that means if I tell you T1 1548 you can immediately either you know search for it manually by hovering over every technique or sub technique or you can click on this uh the search button and say T15 5 48 and uh you can see there we are uh now it'll probably bring up um let me make sure that's correct so T1 548 abuse elevation control mechanism there we are so T1 1548 there we are abuse ele um elevation control mechanism and this is really powerful especially you know if you're dealing with uh the blue team they can immediately click on that technique here and uh in this case I'm looking at it from the perspective of a Defender so they can see what you're referring to so let's say I tell or I communicate to the blue team that hey uh you guys didn't do so well in detecting uh you know abusing the um elevation control mechanism on windows so for example UAC on windows so then they can go as Defenders and take a look at the mitigations which is something that not a lot of people know but it actually tells you how you can mitigate a use of elevation control mechanisms if you take a look at the sub techniques you can now dive into the operating specific um uh techniques uh or the techniques that are oper um operating system specific um and uh you know you can take a look at those more granular mitigations but the other cool thing and again I'm looking at this from the perspective of a Defender is it also provides you with detections or ways you can detect this uh that you can integrate into your detection rigs or your defensive Security Solutions or your seams to create either uh alerts um so on and so forth so you can see when we talk about user um user account or uh let's see one that makes sense here in fact if I go into um let's see some of the there we are bypass user account control this is relevant to Windows now the procedure examples give you examples of how let's say AP 29 bypassed UAC so you can click on um the references there but it essentially tells you that hey uh in terms of who used this technique or sub technique apt29 is a group that actually did it and you can click on the references there to actually this will take you to some um threat intelligence reports that'll uh explain to you or that will show you exactly how apt29 uh was able to elevate their privileges or by uh you know uh perform uh evade defenses by uh again leveraging or abusing UAC so you can see uh this is just one here um let's see where that is highlighted um and uh just a moment uh let's see uh where UAC was bypassed uh they talk about this here uh let's see if we can find this mentioned specifically and uh of course you can go through all of the other this is by mandiant um actually I probably should have explained or understood so there we are no easy breach mandiant uh this looks like an analysis of [Music] um uh let's see here uh there we are details are massive intrusion by the Russian AP group apt29 also known as Cozy Bear as I like to refer to it you can see fun fact This was apt29 um but anyway you can go through all these uh threat intelligence reports or analysis um reports by you know different you know really uh juggernauts in uh the cyber security world like mandiant to understand how you know a29 um you know abused uh elevation control mechanisms in this case it looks like it was you know most likely done done on windows so this is abusing Kos tickets there uh it also provides some really cool um Intel or info on how you can um you know you can mitigate these attacks uh but let's see I didn't see any reference to that [Music] um just a moment and apologies if I'm going on atten ENT here uh let's see uh this is the response uh indicators of compromise challenge four Advanced attack techniques uh there we are looks like partial scripts like invoke mimic ads evaded AV detection um increase partial visibility I don't see any reference to that specifically yet I should say let me just find it okay so couldn't find anything there but if I click on the group here a29 as a group and uh we take a look at the campaigns you can take a look at the again campaigns that we know of right uh but we can take a look at the uh techniques used um more importantly uh if I take a look at this that'll just take me to that uh uh to that reference um you can see the software that they used or malware that they use so for example they used uh what did they use for the C2 framework uh they Ed Blood Hound for ad enumeration it looks like cobal strike they've used that quite a bit um but uh there we are so the references give you you uh great analysis reports or you know CTI reports so if I say um you know we can click on any of these here let's see let me pick one by um mandiant uh no I don't want mandiant I want uh One technical one uh let's see this here uh not found so I probably need to check something else uh firey Labs uh Manch is quite good with their reports um and don't worry if you're still new to AP groups and threat intelligence I'll probably make a video on that uh hold on a second uh looks like that just points to a closed Forum but let me open this up uh so if you're not familiar apt29 was uh again the group alleged I think to a certain point it's been proved but they were essentially interfered with the 2016 elections uh if you remember um but there we are the Russian militia cyber activity uh it sort of lists out what they did um right over here uh in terms of the operations so the adversary space neutral space the victim space uh this is the alternate names so uh indicators of compromise uh let's see they have the mitigations here uh this is not detailed enough I want one that actually uh dives into one of their campaigns here actually it might be wise to go into the campaigns let's see operation ghost um we can see the techniques implemented here do we have any uh nothing there uh let's go back I just want to let's go to the solo winds compromise um let's see um um uh actually it might be wise to go back in here so [Music] um they bypass UAC bypass user account control AP 29 yeah that was the original one let's take a look at maybe ap37 or one of the references here just so I can show you uh why this is useful for um there we are so you know if you this is a great thing for you to do as a red team or a pentest or if you are on the offensive side of cyber security because it'll actually give you uh it'll actually teach you different ways or different uh um implementations of a particular technique so it actually teaches you you know what the the best of the best in terms of AP groups are using let's say to bypass UAC and then you you know you can use that to improve your skill set uh or your trade craft so you can see in this case um initial dropper the UAC bypass method was uh UAC me that was the exploit used uh by the way I've made a video on UAC me you can actually take a look at it it was a um again a tool allows you to by UAC through different techniques uh but here you can see um let's take a little bit uh not the victimology um hold on let me take a look at this here there we are multi-stage binary infection uh we can see one of the most notable functions of the initial drop of the initial dropper is to bypass Windows UAC user account control in order to execute the next payload with higher privileges uh this malw uses the public privileges alation exploit code cve 2018 8120 or UAC me which is normally used by legitimate red teams aha so I'm actually being Vindicated here uh in any case I went on a serious tangent there my apologies so uh that probably gave you you know a very good introduction as to how you can use it as a red teamer but uh one thing I want to touch on is the matrices so you can see you have the Enterprise Matrix where you can now filter uh based on you know the operating systems or the environment you're going to be targeting so if I was targeting a cloud environment you can now see that the ttps are far few uh far fewer than what we had when we just clicked on you know the Enterprise uh top level uh Matrix um by the way if I click on Windows it'll now limit the ttps just to Windows right and uh that means that all of these techniques or sub techniques are relevant to just the Windows operating system so um you can see uh you can go through that there if we go to defense EV asion it'll now only display bypass user account control uh and no Linux uh techniques or sub techniques uh the pre the Prem Matrix is very cool because it essentially encapsulates reconnaissance and resource development so resource development is the process of again acquiring infrastructure uh for your red team operation or what um attackers or AP groups typically do before they begin any operation they typically buy domains uh you know DNS servers they set up the infrastructure right um or they can compromise infrastructure that they can then use to you know as a way to um so they'll typically I'll give you an example they'll typically compromise like websites or you know small companies organizations that again don't have any uh they they're not really security aware or conscious and so they'll not be able to tell that the website has been compromised and by the way the attackers will not do anything on the website like deface it they'll just leave it running as normal but will use it to either Route traffic or will again try and convert uh the server to to act as something like a proxy or a redirector for their C2 uh communication so on and so forth and you can see reconnaissance you is already um you already should be aware of it if you're a pentester uh but you also have you know the Matrix for Mac OS uh likewise for containers if you're targeting you know containerized environments or you're dealing with devops environment uh don't tell anyone you heard that from me but you also have ttps for mobile environment so you can see that we have abuse elevation control mechanism here it looks like in this case you know device uh process injection P tray system calls I believe this is uh this yeah this works on both Android and iOS but you get the idea so that's what the Matrix uh the various matrices represent they just allow you to limit the ttps to the environment uh that you're targeting uh or that you want ttps for um you can see for the IC environment or industrial Control Systems uh environments uh they're also going to be very different because you're dealing with different operating systems now and uh for example you can see uh the tactic inhibit response function you have stuff like activating the firmware update mode or what attackers have typically done like suppressing alarms so on and so forth um anyway so that's the matrices and uh you know we've talked about ttps but one thing I want to highlight here we go back to that example and I'm using it because again it makes sense you can see that the every technique or sub technique has its own unique ID and um the sub techniques have the same parent ID but uh then have a suffix uh a sequential uh suffix here so you can see the first Sub sub technique is 001 second one is T15 uh 48002 so on and so forth it then tells you the platforms that the technique is applicable to so in this case Azure ad Google workspace infrastructure as a service Linux Office 365 windows maos and then more importantly the permissions required in order for you to execute this technique successfully so you need to have administrator or user privileges here depending on you know what technique or sub technique you're trying to implement or you're trying to execute uh and when this was last um when it was created and when it was last modified so for the defensive if you're a blue teamer you have your mitigations here so if I wanted to mitigate this what you know what could I do well I could check for common UAC bypass uh weaknesses on the Windows systems to be aware of the risk posture and address issues were appropriate or I can uh if we take a look at the windows sub technique uh bypass user account control the mitigations are going to be much better so uh for example um you can see mitigations here uh remove users from the local administrator group on system so really really useful stuff so if I told a blue team that hey you guys really did not detect this or detect this particular sub technique ID then they can always refer to the mitigations and detection um the detections here so for example if you wanted to detect this type of activity uh you can take a look at uh you know for example process creation the data source being process creation and you can monitor newly executed processes such as event viewer. exe and sd. exe that may bypass UAC mechanisms to elevate processes or process privileges on the systems threat actors often after compro compromising a machine try to dis try to disable UAC to elevate their Privileges and this is done by changing the registry key for the system policies using reg.exe and you can then see you know uh the various analytics here but uh yeah so uh that pretty much is what I wanted to explain for now now this video will be improved upon or will make a lot more sense in the next video and we'll be taking a look at another Tool uh again still under the MIT attack framework called the attack Navigator so uh with that being said uh that's going to be it for this video and as uh based on what I said in the previous video you can find the blog post outlining everything that we've covered in this video uh sorry the Forum post uh in the description section as well as the first pinned comment in the comment section if you like this video or uh you found value in it please leave a like down below if you have any questions or feedback please leave them in the comment section down below furthermore you can continue the discussion with me regarding this series and any other videos you may want me to cover on the uh hack exploit Forum which is accessible um on Forum or via forum. Haack exploit. org and as I said the link to this particular video's post on the Forum is added in the description section and the uh the first pin comment in the comment section or rather the pinned comment in the comment section but that being said that's going to be it for this video and I'll be seeing you in the next video [Music]