- [Woman] Please join me in welcoming John Wunder.
(audience claps)
- [John] Thank you.
All right, thanks for that introduction, Katie.
I'm really excited to be talking about ATT&CK Sightings here
at ATT&CK Con especially because,
it was, at ATT&CK Con last year,
where I actually had some of the first
conversations about Sightings
with some of you who are here today.
And a lot of that conversation inspired
what you're seeing up here.
We kinda took those notes.
And so when I talk about Sightings today,
just keep in mind that that's
kinda as a result of you talking about it.
I think it also addresses
a lot of the things that we heard today.
A lot of the needs that we heard today.
The need to be able to prioritize defenses,
and the need to be able
to really make our threat intelligence actionable.
And so out of all that we kinda collected together that
this idea for ATT&CK Sightings.
But before I talk about Sightings,
I really wanna talk about threat intelligence reports.
Threat intelligence reports are great.
They can tell you about new and interesting techniques.
They can tell you about tools.
They can tell you about what different
threat actors are up to.
Threat intelligence reports are really great at
writing up, you know, kinda finalized, really detailed
information about what actors are doing.
And what tools they're doing.
And what new techniques are out there.
That's said, threat intelligence reports
maybe are not that best way to answer
every single question we have, right?
Threat intelligence reports are one form
of threat intelligence.
But there's other forms of threat intelligence as well.
So, threat intelligence reports are for example,
they take a long time to write.
You have to have an analyst write them,
you have to have them usually go through legal,
or marketing teams.
You have them go through publications and be produced.
And then they have to get out there and people to read them.
So we see a number of
threat intelligence reports, obviously.
There's a lot of them.
But scale-wise, there's not as many threat intelligence
reports as there are incidents out there.
Or as there are events out there.
And so just this scale and scope of things
that are covered by finished intelligence reporting,
is not as broad as what we see out there.
And second, threat intelligence reports
are really focused on that in depth analysis
of things that are new and novel, right?
We're not going to be writing intelligence reports
about, you know, the ways that adversary A
used PowerShell for the zillionth time.
And what that means is that
threat intelligence reports are great.
They help us inform ATT&CK.
ATT&CK wouldn't be what it is
without threat intelligence reports.
But, there is also a need for other
types of threat intelligence.
And that's where sightings come in.
As we think about how to answer these types of questions,
that's where we see these more
"sightings type per use case".
And I'll talk about what that means in a minute.
But just think about how you were to answer
these types of questions today.
Which techniques are more-or-less common.
That can be tough to answer threat intelligence reporting,
because are your threat intelligence reports
talking about this technique because
it happens more often,
or because it's more novel and more interesting,
and more unique?
Second, how do techniques tend to be used
together or in conjuntion with each other?
This is something that having a great set of
raw data would really help us answer.
How do we actually see things
when they happen on a box?
Third, how has usage changed over time?
Threat intelligence reports are often
you know, encompassed data from many, many years,
or many, many months.
And so it's hard to tell sometimes,
at more of an atomic level,
what does it look like this year versus last year,
versus the year before.
That needs a more atomic type of information as well.
And lastly, how does prevalence differ by sector
or things like geographic area?
How do we more see, look at kinda an in depth level
of exactly what we're seeing here?
Again, threat intelligence reports talk about this,
they talk about geographic area and sector a lot.
But just the breadth and depth of that,
the breadth of that reporting is not as big as it could be,
if you look at the scope of incidents and events
that happen out in the world.
So this is where we see ATT&CK Sightings fitting in.
I've used that word a bunch of times now,
what do I actually mean by that?
So when I think about ATT&CK Sightings,
I think about observations that provide evidence
that an ATT&CK technique is in use.
Wouldn't that be great to know,
to have evidence when an ATT&CK technique is in use
without having to go read all of these threat intelligence
reports necessarily?
We can think of couple different
types of threat intelligence reports as well.
Or sorry, as sightings as well.
So, direct technique sightings,
so if you think about the different ways
you might have evidence of a ATT&CK technique in use,
one way is you're looking at your logs
and you're digging in there
and you're seeing actions happen on your
systems and networks that directly correspond
to an ATT&CK technique.
So for example, if I'm looking at credential dumping
and I see for example, a memory read of LSASS.exe.
That is direct evidence credential dumping as occurred
on that machine. That's really great evidence
that, that technique happened.
But there's other types of evidence as well, right?
We might not have something quite that conclusive.
For example, Mimikatz is a tool that is capable
of doing credential dumping.
What if Mimikatz is blocked blocked at the firewall?
We blocked it by download because we have a known
hash for it or something like that.
That's not quite as good as the evidence,
as seeing the actual memory dump,
but it's a pretty good indication that our
adversaries are trying to do credential dumping;
if you see Mimikatz being blocked at your firewall.
So direct software settings are kind of this idea that
we've seen a piece of software that
enables us to do a technique.
Indirect software sightings are really getting at this
concept of tips and threat intelligence reporting
that goes through kinda more automated
STIX/TAXII mechanisms.
So maybe I see an indicator shared from Mimikatz.exe.
I didn't see it myself, I don't know that it actually,
whether it was a successful attack
or whether it was not successful.
I don't know exactly where it happened.
But the fact that somebody is sharing a hash
from Mimikatz tells me that is probably in use,
and therefore, that the adversaries are
looking to do credential dumping.
So hopefully you can see that while these are
different levels of evidence,
some of them are really great direct evidence
of a technique occurring.
Others are more indirect evidence.
It's still evidence that a technique is in use
in the real world.
And that's really what we wanna get at
with ATT&CK Sightings.
We at the ATT&CK team feel like something that would
be really useful is more direct evidence
of ATT&CK techniques in use in the real world.
And that's what is idea is about.
So, in order to help enable that,
and in order to make that happen,
we've kinda proposed this idea of ATT&CK Sightings.
And I've talked to some of you about this,
and I'm happy to talk to more of you about it today
if you come find me after.
But what we're proposing now is
MITRE collects sightings from multiple organizations.
So we take in some of these sightings.
When you think about a sighting,
so I talked about those three types,
think about that type of sighting,
technique ID, maybe tactic ID, time stamp maybe,
and maybe some other metadata.
And so that's what really what we're talking about
when we talk about a sighting.
What is MITRE collected a bunch of those,
they were anonymized at some level,
either before or after they get to MITRE.
And then we can kind of aggregate them,
and make intelligent kind of decisions and reports
based off of those things.
We could public insights,
and ideally, if we get a good amount of data,
and we feel like it makes sense,
we could also publish data sets that help
researchers like yourselves, figure out insights
that we at MITRE maybe couldn't ever figure out.
So the idea here is to kind of collect this sighting,
create this sighting's ecosystem.
Where we're constantly collecting telemetry about
what ATT&CK techniques are in usage in the wild.
And republishing that back out,
both in terms of insights,
as well as more in terms of raw data.
You can imagine it looking like this.
So along the left side you can see the
systems that are under attack basically.
So all of our individual laptops,
all of our servers, all of our infrastructure.
And we're doing security monitoring on those things.
And that security monitoring is hopefully
when we have an attack, going to lead to detections.
At some level, those detections will create reporting.
Right, so we can do reporting of those detections.
That might happen for your ISACs or ISAOs.
Maybe you have an MSSP or a security vendor or something,
that you're working with.
And that point right there, I really wanna highlight
because if you're working with those ISAOs,
your MSSPs, that's a great way to anonymized the data
before it gets to MITRE.
One thing MITRE doesn't necessarily want to do is
be responsible for collecting a lot really sensitive data
about where techniques are seen in the wild
at specific organizations.
We're happy to work with you if you are one of those,
a user organizations,
and you do wanna contribute what you find.
But we think it makes a lot of sense really,
to look at the ISACs and the ISAOs.
And the people that are collecting data from multiple
organizations at the same time.
So that they can do the anonymization for us.
We'll continue to look at it in an anonymized way,
we'll try to aggravate it.
We had some people that are privacy experts
and can also look at how
to keep it from being de-anonymized.
And then the idea is that we can publish those insights.
So, that's kinda the operating model
that we're hoping for here.
In this we have three communities of interest
that we really wanna help enable and protect.
So one is contributors. They're probably the most
important part of this eco system.
They are the people that are
providing information of value.
MITRE is not providing information of value here.
So the contributors are really
the most important part of this community,
so we wanna make sure that
A. they're able to really easily contribute.
B. They're protected from disclosing too much information.
And C. That they're acknowledged for
providing something of value.
We wanna give people credit when they give
information that helps the community,
even if we do anonymize it.
Second, we wanna be able to help defenders.
So that's most of us here are defenders,
whether we're threat intel analysts,
or whether we're operators,
or whether we're hunters.
We want to help us, we want to be able to help
defenders kind of prioritize actions,
prioritize what threat intelligence they do look at,
to see more information.
We wanna help them understand and communicate
the value of their work.
It's really easy to communicate value here
if you can say, well I now have a detection for
this thing that happened 10 thousand times last year,
or x number of times last year.
Moreso then here's this thing
that I saw in a couple reports.
And lastly, we wanna help them change based on,
change their defenses based on what we're seeing
changed in the adversary behavior.
Lastly, we wanna help researchers.
So there's a lot of great research
that's happening in the cyber defense base,
and a lot of that research needs good data.
And I think by publishing some
of these data sets out,
we can enable that research by
anonymizing and then making sure that
that the contributors are safe,
but also giving researches what they need
to do their jobs.
You know, helping them develop new defensive approaches,
understand how adversary usage may differ by sector.
I think we all kind of internally think that,
and know that probably a finance sector
is attacked differently than defense industrial base.
But it would be great to have data that kind of proves that.
So we're not just relying on our own intuition.
And lastly, to do things that I can't even think of,
I needed three bullets on each of these columns,
so I need some researchers to
come up with a third item here.
(audience laughs)
So, how can you contribute?
We wanted to make it as easy as possible.
First is email us at attack@mitre.org,
or find me after the break,
or find any MITRE team member.
We're happy to hook you up.
We wanna make this as easy as possible to contribute.
You'll need to generate some data.
We have a data format that we define,
it's kind of a pretty straight forward JSON format.
You can create that yourself.
MISP was great enough.
If you tell the MISP developers,
you tell them an idea and they have it
developed within the next day or two.
And that was the case here.
We talked to them about sightings,
as as of now you can MISP to export sightings out,
and then contribute that back to MITRE.
Or if you have something else you're using,
if you're using STIX, or if you're using CSV files,
send us whatever you have and we'll take it.
We're basically willing to, we care about the data.
We don't care necessarily what format
you give us the data in.
And then send it to us.
I did want to call out some related work here,
first of all, Red Canary released
a threat detection report last year.
And if Twitter can be
trusted. I guess they're releasing another one soon.
That talked about the top 10 techniques
that they found in the wild.
And they also gave great tips
on how to find those techniques when you see them.
Second, Carl mentioned
the CrowdStrike OverWatch reporting before.
They've released two reports with two different formats.
One thing I thought they really did
that made a lot of sense in their second report,
the mid-year report that they just released recently,
was they talked about changes
from the 2018 report to the 2019 mid-year report.
And also, where you maybe should not
take some of those changes as seriously
because there might be issues
in some of the data they thought.
We're pretty thoughtful about what changes actually mean.
And maybe some of the changes
aren't as significant as they seem.
And lastly, VERIS. So VERIS does a lot of
like incident metadata type of work.
The demographics of incidents we think
this is complementary to that.
So current statuses we're collecting sightings under NDA.
You don't necessarily have to
sign an NDA to contribute sightings.
We find that many organizations want to
just to help themselves.
With the goal of having more contributions over this year,
and eventually move towards having those insights
being able to be published.
All right, that's what I got, thank you.
Here's a URL you can go to get involved,
emails us, come find me after.
And I'm happy to take questions.
- [Woman] So what we might do is
we're right on time actually.
You finished right on the dot, thank you for that, John.
So John will be hanging out at the reception,
and will leave tonight as well.
And tomorrow, so please come talk to him.
We want your data
and will anonymize it, So. (audience laughs)
Thank you so much, John.
(applause)