How to Leverage MITRE ATT&CK for Threat Intelligence

Hello everyone. :)

In this article I’ll cover how to leverage the MITRE ATT&CK matrix for Cyber Threat Intelligence.

In recent years, security professionals have been looking for ways to predict cyber threats and take precautions against them. Situations like this highlight just how important threat intelligence sources and needs are. Because of this, security teams need strategies or frameworks that can help them analyze and reduce the risks their organizations face.

Understanding the MITRE ATT&CK Matrix

The ATT&CK Framework is a knowledge base showing the techniques, tactics, and procedures that describe the actions attackers can take against systems in the cyber domain. MITRE ATT&CK (Adversarial Tactics, Techniques and Common Knowledge) has been developed by the MITRE company since 2013. This knowledge base was built by observing real-world attacks, in order to systematically categorize attacker behavior. Thanks to this knowledge base, cyber attackers’ next moves can be predicted.

This matrix contains the actions attackers can take, how they gain access to systems, how they infiltrate systems, how they carry these operations out, the paths they follow while doing so, and the tools they use.

As a result, people on the defensive side can take precautions earlier against constantly evolving attack scenarios. On the other hand, attackers are also constantly looking for ways to avoid detection against security methods that stay in the spotlight.

If identifying threats takes too long, the likelihood of privilege escalation, lateral movement, data theft, or system disruption increases. To prevent this, cyber security teams can map out their tactics, techniques, and procedures (TTPs) and use indicators of compromise (IOCs) gathered from various sources to predict attacker behavior.

The ATT&CK Framework and Threat Intelligence

Cyber threat intelligence enables the identification and analysis of cyber threats. When researched together with MITRE ATT&CK, it becomes easier to identify the attackers and attack scenarios found in the matrix. Cyber security analysts can take precautions for their organizations by identifying and analyzing the behavior of the groups targeting them. This once again shows just how important Threat Intelligence and the MITRE ATT&CK platform are for organizations.

The MITRE ATT&CK Framework helps us understand adversary behavior by showing us the following data:

What are the attackers’ motivations?
Which countries and sectors do attackers target the most?
Which techniques do attackers use during an attack?
Which tools do attackers use?

Level 1 Threat Intelligence

Let’s imagine an organization with only a handful of analysts that wants to start using ATT&CK for threat intelligence. The analysts can take a single group that the organization is targeted by, or cares about, and study it in ATT&CK.

Example Scenario:

Let’s say we have an organization, and this organization is in the “Telecommunications” sector. Now let’s answer questions such as what information we can gather about this organization and how we can use this information for our organization.

First, we go to the MITRE ATT&CK page. We’ll identify the attack groups that could target our organization.

Using the “telecommunication” filter as shown below, we found that there are many attack groups targeting this sector.

Here, the MuddyWater group stood out to me as particularly noteworthy.

We determined that the MuddyWater group targets the telecommunications and oil sectors in North America. At the same time, we saw that this group could target our organization as well. Now let’s click the MuddyWater link and go to this group’s page.

As shown in the image, ATT&CK provides attribution for the group, along with the targeted geographies and targeted sectors. The MuddyWater APT group is attributed to Iran, the targeted regions are the Middle East, Europe, and North America, and the targeted sectors are telecommunications, government, and oil.

ATT&CK also includes associated groups — groups that appear as the same or very similar groups across various threat intelligence reports. Since vendors don’t agree on a common naming convention for threat groups, knowing the other group names associated with a given group is also important for threat intelligence.

On the group’s page, we can get more information about the attacker group by looking at its techniques. For each threat group, ATT&CK includes the techniques used by that attacker group. It also briefly explains how the attacker group uses its attack techniques.

ATT&CK also visualizes the techniques used by the group in ATT&CK Navigator. To see the techniques in ATT&CK Navigator, click the “ATT&CK Navigation Layers” button on the group’s page. The blue techniques show the techniques used by the MuddyWater threat group.

Finally, ATT&CK also lets us view the techniques used by the attacker group visually in ATT&CK Navigator. Let’s click the “ATT&CK Navigation Layers” button on the group’s page to see the techniques in ATT&CK Navigator. The blue techniques show us the techniques used by the MuddyWater attack group.

There are currently 129 groups in ATT&CK.

Level 2 Threat Intelligence

If an organization has a mid-level team that regularly reviews information internally, a good next step would be to have your team map threat intelligence to ATT&CK yourselves, rather than relying on resources others have already predetermined or prepared.

For example, if your organization has its own report about an incident, mapping that report to ATT&CK can be a great resource.

Example:

An excerpt from a FireEye report mapped to ATT&CK.

( https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html )

The MITRE ATT&CK team has proposed a step-by-step guide to help map a threat intelligence source to ATT&CK. This guide:

Understand ATT&CK - This is the step where we learn about ATT&CK’s overall structure. We learn about tactics (the adversary’s technical goals), techniques (how these goals are achieved), and procedures (specific implementations of the techniques).
Find the Behavior - Look at the adversary’s actions; any indicator they use could be a hash value. For example, let’s say the malware in the report above establishes an X connection. Establishing a connection is a behavior the adversary performs.
Research the Behavior - If we don’t have a clear understanding of the behavior, more research needs to be done. In our example, a bit of research can identify the protocol used by the X connection, making it clearer.
Translate the Behavior into a Tactic - We need to determine which technique the attacker’s behavior could correspond to. The nice thing here is that Enterprise ATT&CK contains only 12 tactics.
Figure Out Which Technique Applies to the Behavior - This step can be a bit more complex, but with the right analysis, the examples on the ATT&CK website can help you reach the correct conclusion.
Compare Your Results to Other Analysts - Analysts may interpret a given behavior differently from other analysts. Because of this, comparing your results with other analysts’ findings, whether in reports or during analysis, is always a sound approach.

Level 3 Threat Intelligence

If an organization has a mature Cyber Threat Intelligence (CTI) team, they can map their data to ATT&CK. As a result, they can use this data by prioritizing how it should be used on the defensive side. By applying the steps we’ve summarized in this article, incident response data, OSINT or threat intelligence reports, real-time alerts, and companies’ historical data can all be mapped to ATT&CK. Once this knowledge base has been produced, threat groups can be compared against each other, and priority can be given to the most commonly used techniques.

Finally, to help defense teams better understand what they should focus on, you can combine this data to uncover techniques that are used consistently and regularly. This also helps your defense teams understand which tactics they should prioritize and take the necessary precautions accordingly.

Thanks for reading this far. :)

Sources: