- [Announcer] Please welcome to the stage,
Mr. Adam Pennington.
(audience applauding)
- Welcome back.
(audience applauding)
So now we have a couple of shorter talks for you,
you know, to round out our day.
Our first talk is another ATT&CK update,
our cyber threat intelligence lead Matt Malone
is gonna be talking about campaigns.
(audience applauding)
- Thank you, sir.
And I know that applause was more for the fact
that it's a short talk compared to everything else going on,
but I appreciate you taking time
outta your day this afternoon.
I just wanna elaborate a little bit more
on the structure of campaigns
as we are attempting to put it into action.
Not for April, not for the ATT&CK version 11
coming out next month,
but this is going to be in October focus.
I am not lazing anyone, there we go.
Several people talked as they were introducing themselves
talked about being gamers, I'm a retired gamer.
I was, I didn't get to the punchline yet,
I was retired by my very malicious teenage sons
who regardless of the game,
no matter what the platform coming after me
and taking me out first and then repeatedly
it was always more fun than the game itself.
I've been with MITRE for about a year and a half.
I get the privilege of working with the CTI team
four outstanding analysts.
They work with your contributions,
they work with open source reporting
to help create new group and software updates,
create new group and software entries as well as update,
additional information
that's already within the ATT&CK framework.
Over the last couple of releases, eight, nine, and 10,
they've added almost 30 new groups
and over 140 new software entries.
They've also done some deeper dives
into some of our APT actors trying to update,
refine, and in some cases detangle
how ATT&CK had previously identified
Iranian, North Korean and other actors.
And now, because they'd like a challenge,
we're gonna add campaigns to their list as well.
As Adam mentioned this morning and as in the roadmap,
we're starting with a very general definition
of what a campaign is.
It's a grouping of intrusion activity
which may or may not be attributed,
it's ideally bound within a timeframe,
but also specifically going after common targets
and objectives.
This is very much a work in progress,
that's why I focus on the fact
that it's a concept right now.
So everything I tell you today will be absolutely true
except the parts that are gonna change
between now and October,
based on the reality of taking the concept
and applying real world CTI to it,
but also primarily based on your feedback,
your recommendations and your guidance.
The idea of having campaigns in ATT&CK is not a new one,
the ATT&CK team has talked about it for quite some time
and truth be told there are campaigns
and operations already in ATT&CK.
They're kind of squirreled in
with some of our group updates, our group entries,
there's only a few maybe about a dozen,
but really the turning point,
the tipping point for moving forward with the campaigns
was the solar winds intrusion as Adam mentioned earlier.
From an ATT&CK perspective,
we were trying to focus on
as much of the CTI reporting that was coming out,
collecting it, analyzing it,
and then trying to map the techniques related to it.
We created a new group entry
because that was our best avenue at the time.
We created UNC2452, and started mapping ATT&CK techniques.
When we did the out cycle update for this,
we had 50 techniques total,
a majority of those were techniques
that were already in ATT&CK,
however, there was some new behavior
that had not been previously captured in ATT&CK.
So Jamie and other parts of the ATT&CK team
worked with the community to help identify those,
scope them and then we mapped UNC2452 to that as well.
Typical with a group entry we had a software section,
combination of tools that were already in ATT&CK
and some unique malware that had not been seen before,
including some that had been custom made for this campaign.
And of course down the bottom we had all of our references,
our compilation of reporting,
so as researchers wanted to understand
more about a specific technique or how software fit in,
they could go to that original reporting
and go back and get the details.
Last April coming up on a year ago now,
the US and the UK government issued statements
regarding solar winds.
They attributed with high confidence the campaign
to the Russian Foreign Intelligence Service the SVR,
and in their statement,
they talked about other groups also known as APT29,
Cozy Bear and The Dukes.
From an ATT&CK perspective,
we already had a group entry that covered that.
So we ended up taking UNC2452
and merging it into our G0016 or APT29 entry.
All the information carried over, none of it was lost,
but what we discovered was the details of solar winds
quickly became lost in what was one of our largest
group entries in ATT&CK.
The 50 techniques were still there,
but now they were part of a broader category
of list of 70 that go went back several years,
same with the malware.
Now we had 23 software entries in total,
at the same time additional reporting was still coming out
about not only solar winds in and of itself,
but also what the actors were doing outside
and after solar winds.
And that was all being added to the G0016, APT29 entry.
From an internal MITRE perspective,
as we doing work on solar winds,
I often found myself going back to UNC2452 as the baseline
and then kind of populating additional techniques
and software as it came out from there.
We're hoping that campaigns has a widespread benefits
beyond high impact, high visibility campaigns
such as solar winds.
We're hoping that as we can populate campaigns
out over time, it provides another perspective,
another way of telling the story
of what's going on in cyber field.
We're hoping it can show the evolution
of malicious cyber operations,
particularly as we can tie them to specific groups.
We can show how groups have evolved not only over time,
but potentially due to new technologies coming on board,
identification, new vulnerabilities, exploits,
sometimes shifting based on their targeting
or what their objectives are,
but probably in many cases to what you all are doing here
in terms of hardening the networks
and making their job harder.
To a certain extent,
I'm curious that as we can kind of build this out
will there be sections
where we can focus on unchanged behavior?
If we can get a better sense
of what are those key techniques
that are always part of their toolkit,
they'll make minor modifications
to get around detections and alerts,
but it's always something they go to time and time again,
and maybe that'll help with prioritization
when you're looking at techniques overall.
From an ATT&CK perspective,
it gives us a lot more flexibility than we currently have.
As Adam mentioned this morning,
we currently don't create group entries
without a group name.
We also don't take,
I mentioned how we would previously take campaigns
and kind of cram 'em into a group.
We don't do that with unnamed campaigns.
We wanna create a lot of flexibility
with this new structure.
So we can take unnamed actors,
we can take low confidence actors as well,
and unnamed operations
and be able to fit it into this format.
One of the biggest benefits
we hope to get from this is addressing ransomware.
The last talk was excellent
in terms of just framing the ransomware as a service issue,
from an ATT&CK perspective,
we've had a challenge of keeping up on that.
Yes, we can create malware software entries
for the ransomware in and of itself,
but at that point it's already in the network,
it's already deployed,
it's too late for the defender to actually take action.
There's a large body of open unclassified CTI reporting
about all the activities all the TTPs
leading up to the ransomware infection,
but quite often it was unidentified actors,
unidentified groups, or based on ransomware as a service,
you could have multiple clusters of activity
all working to the same end goal
of deploying the same type of ransomware.
And we just didn't have a good methodology
for capturing that.
From a campaign perspective we're hoping to shift the focus
away from the actor in and of itself
and make it the target of the campaign instead,
so we could focus on a (indistinct) ransomware campaign
against the healthcare sector in this timeframe,
and identify not only named actors
but unidentified and unknown actors as well.
So in terms of components,
what the actual page will look like
if you're familiar with ATT&CK
and hopefully you are if you're here,
it's gonna look very much like a group and software page
with some noticeable differences.
Every page will have a campaign ID number,
so Charlie one, two, three, four.
It may or may not have a name.
That'll be, as I said before,
split in practice from what we've done previously,
if we can link it to a group, we will,
but that's not necessary, it's not required.
Again, we could have campaigns
that just focus on unknown actors or unidentified actors.
We'll have that description of what the campaign is about,
the sectors, the targeting, countries involved.
We try to capture that in group descriptions
as much as possible.
One of the challenges is with data aggregation over time,
we we're forced to generalize.
So instead of talking about specific countries,
we talk about regions,
instead of specific organizations,
we talk about general sectors.
Under campaigns we're hoping to keep
as much detail as we can and add additional points.
If new techniques were developed based on this campaign,
if there were new TTPs identified,
maybe it was the first time a family of malware
or software was identified and used,
we wanna make those notes
as to why this campaign stands out.
The group and software pages will not change
with the exception
that when we can tie it back to a campaign,
there'll be a campaign section with the campaign ID code
so you can click and you can move
hopefully seamlessly between a campaign page,
any groups in any related software.
So again, October timeframe, not April,
don't go looking forward in version 11.
Right now the team is focused on taking those campaigns
that are currently in ATT&CK.
They're going back to the original reporting,
seeing if any new information has come to light,
help us better understand not only the campaign
but if there's been some attribution made subsequently,
they're also gonna remap the reports
because ATT&CK has grown
and changed since these first came out.
And then as we've moved forward,
we'll keep creating new campaigns.
As the team has been working for group
and software updates for version 11,
on the side they've been keeping mappings for campaigns.
We have a template or they've been using excel words,
so they've been in identifying
and potentially nominating potential campaign entries.
Our goal over time is to narrow the gap
between what we have in groups,
where we can take older campaigns
and map those while still being forward leaning
and capturing new activity.
And that's where you all come in.
We're really looking forward to engagement and feedback,
recommendations how to move forward quickly with this.
I don't have a set number of campaigns
that plan to publish come October,
I'd rather have a strong foundation
and then be able to build out from there.
We owe you a blog post later in the year,
whereas this develops,
we'll provide a little more guidance and information.
And as always, we look forward to your contributions.
(audience applauding)
- The words escape me on how excited for this I am.
I wish I could really capture.
- You (indistinct) heart.
- Yeah.
- Wow, just there's a Taylor swift meme there.
I don't wanna monopolize,
'cause I could talk about this one all day.
I wanted to see if anyone from the audience
wanted to ask anything from Matt.
Yes.
- So, I saw a lot of these campaigns,
will they have some campaign activities
dedicated to the ICS space?
- Question for the audience is will the campaigns
extend to across multiple domains and matrices of ATT&CK?
Particularly not just enterprise, but ICS.
- Ideally, yes.
Ideally we'd like to eventually get to a point
where we can either different frameworks together.
So if something starts from a mobile perspective,
but moves to enterprise,
if it starts with enterprise but low and behold
that ICS network isn't as air gaped
as the people thought it was
and they have that type of movement,
so yeah, it is a whole of ATT&CK development.
- We put this in slides, we haven't put it on a t-shirt yet.
Haven't put that on a t-shirt yet,
but we have this internal saying called One ATT&CK,
and I think it's something we're really pushing towards,
you know, the equity and kind of the balance
between the different domains.
I think we have time for one more question.
Oh, in the back.
(indistinct)
So the question is how fast will ATT&CK begin
to, you know, kind of consume all this
and actually integrate it.
- Right now, we release ATT&CK twice a year
and that's going to be the current pace
until Adam tells us differently.
So we'll be, I guess from the perspective of the CTI team,
we are constantly adding and updating to ATT&CK,
it's just that the release comes out every six months.
- I think we have time for one more question
and I'm gonna be very selfish to take this,
in the spirit of this is our framework,
this is our community,
you mentioned contributions.
- Yes.
- What can we do for you?
- Well, I think that's where the conversation has to start.
You know, we started with a very general definition
of how we're approaching campaigns.
If people have a better way of scoping,
shaping elements that really should be in there.
If there are gonna be particular challenges
where there's gonna be a gap in reporting
of one part or another, how do we address those?
- Lovely, thank you.
(audience applauding)