- For our spinal speakers
can I have Jamie switch roles
and become those speakers where he now be joined
by Mike Hartley, both from the MITRE ATTACK team.
So take it away guys.
- Thanks Adam.
And like I said, this is Jamie Williams here.
I'm here with my friend Mike Hartley,
and we're giving you an update
from the ATTACK team on what's happening with PRE-ATTACK.
So it has been a truly crazy 2020 in many ways.
And even just for the ATTACK team
you know, we started the year doing sub techniques.
We released beta,
we released the final and I believe it was July.
We've been growing cloud.
And then recently we released the network platform
as well as ICS as in sticks.
So if you been like anyone in the ATTACK consumer
you might've noticed in the most recent release
that, you know, an ATTACK normally grows vertically
you know, we see new techniques, you set techniques, but
in this release ATTACK for Enterprise got a little wider.
And this is because we merged the previous PRE-ATTACK matrix
into Enterprise.
So Mike and I are gonna give you a little more detail
on what happened there
as well as some transparency and insight
into the decision-making that went into this process.
So first off, you know, this didn't happen overnight.
This wasn't something that we just
you know, decided this year
and implemented you might've seen this graphic previously.
This is actually, this was included.
This entire idea
for this merger was included in our 2020 roadmap
as well as if you followed ATTACK on last year
Adam actually presented an introduction
for what we were thinking here.
So, you know
big picture, you know, this is something that's been kinda
on our minds for a while.
And, you know, it just just has been implemented
as a version eight, this most recent release of ATTACK.
So a little background about PRE-ATTACK.
It was initially released
in 2017 as a separate matrix from Enterprise.
So it had its own 17 tactics.
Long story short is when you think about a kill chain.
Enterprise typically focuses
on what we call post compromise
or right of boom, where PRE-ATTACK was kinda thinking
left of boom, you know
the behaviors that an adversary would execute leading
up to compromise.
So thinking of things like,
you know, deciding on targeting, deciding on,
you know, what are the priorities are, you know
gathering information about their victim, you know
staging and developing resources, things like that.
And Pre-ATTACK really opened up
some really interesting use cases.
You know, most importantly, you know
how do you get ahead of a breach, you know, as a defender
how can I see artifacts
of an adversary getting ready to target me
whether it be, you know
setting up domains, you know, tracking bottleneck activity.
These are really important considerations
especially when we start thinking
about open source, intelligent requirements
like, you know, where do we need to look for?
And, you know, in the public space
to actually start seeing, you know
adversary activity before it's actually in our environment.
And, you know, and like I said before
this wasn't something that happened overnight
you know, dating all the way back to version two of ATTACK
in 2018, we actually started to pull bits
and pieces of PRE-ATTACK over into Enterprise.
You know, particularly in this case
the initial access tactic was actually populated
from two tactics that were previously
in pre, you know, launch and compromise.
So like I said, this is something that's, you know
we've kind of wanted the
I had the desire to kinda bring these two
you know, pre and post compromise
major sees and thoughts together, you know
and finally in version eight, we've actually achieved that.
So like I said, this most recent release of
ATTACK version eight
we've officially deprecated the PRE-ATTACK matrix.
It is still available, you know, via
VR versioning, but, you know, going version eight
and forward PRE-ATTACK is deprecated and has been replaced
by the PRE platform and Enterprise.
So, you know, PRE will sit next to,
you know, windows, Mac, iOS, Linux, network cloud
all those other platforms within Enterprise.
As you can see in the graphic on the bottom right
is a perfect example
of highlighting this, you know, PRE-ATTACK was huge.
You know, we did quite, we had to do a lot
of re-scoping, a lot of downs to like to get it
into the two tactics that are now in Enterprise.
And just kinda giving you some transparency
into the thought process that went into that
to kinda match everything currently in Enterprise,
we had three main criteria
for, you know, translating these techniques.
First of which was the behavior had to be technical.
It had to be something that an adversary is doing
with a host or a system or something
you know, it just kinda leads something technical
which leads to our second point.
You know, it had to be something that was visible
to a defender, you know, as you know, it's great to think
about, you know, adversaries, you know, making decisions
and kinda having their own board meetings
and kinda, you know, defining the priorities
but, you know, to match the rest Enterprise
that's not something we're gonna see.
It's not something we can actually defend against.
So it really,
unfortunately didn't have a place in Enterprise.
And finally, in the spirit of ATTACK
everything is based on, you know, open source in the wild
it had to be something that we actually had evidence
of, you know, seeing adversaries do this.
So it kinda, as you can see
you know, the technical aspect being visible
all that cascades into that in the wild documentation
public reporting criteria
that we use to build the rest of ATTACK.
So, like I said, finally, the final merger, you know
we've pulled initial access before
and then the final merger included the creation
of two new tactics, as you can see in the bottom right.
Reconnaissance and resource development.
So kinda just diving into the first tactic
reconnaissance, you can kinda think
of this as, you know, pre compromised discovery.
This is an adversary, you know, actively
or passively gathering information that they're gonna use
during targeting, you know, in terms
of just stats, you know, reconnaissance is 10 techniques
31 sub techniques, and really interesting nuance about it
is it split into two categories more or less.
There's the, you know, what, you know
what information is the adversary, you know gathering,
whether it's about your host, your infrastructure
your personnel, you kinda think of those as well as how.
You know, how has an adversary actually gathering
gathering this information?
Are they scanning forward?
Are they sending you fishing probes?
Or are they, you know, kinda triaging
and combing through publicly available information.
- Thanks, the resource development tactic is focused
on an adversary trying to establish resources
they can use to support operations.
So that includes techniques that all
the adversaries creating, purchasing, or compromising
and stealing resources that can be used
to support targeting.
Resources here include infrastructure such as
buying or compromising servers or domains,
accounts such as creating or compromising email accounts
or creating and developing a social media persona
and capabilities such as developing
or downloading malware exploits.
While there are six new techniques
and 26 sub techniques here,
please don't let that scare you.
There's a parallelism among and within techniques that
helps make use of these more manageable.
As part of this release,
we've also added a new pre-platform tag
as these behaviors taught fit easily into windows, Mac
iOS, Linux, cloud network, or any other existing platform.
We've also added a new pre-compromised mitigation.
As often these behaviors are
outside the scope of preventative measures
and Enterprise defender can typically take.
For detections and data sources,
as Jamie said,
everything going in here is as opposed to some defenders
but many are not observable to most Enterprise defenders.
We've highlighted some data sources and detections
in cases where there are detections applicable
to a broad set of defenders
such as using domain registration
information to detect adversaries purchasing domains
including things like monitoring for domains
registered that are similar to your own
that might be used for something like
credential harvesting.
In some cases we also have pointers
to related post-compromised
behaviors where detection efforts may be more fruitful.
So why do this?
We hope to promote community adoption
and contributions around tracking adversary
reconnaissance and resource development efforts,
and to have more integration
across the wider spectrum of adversary behaviors.
As Jamie mentioned for the version eight release
we have deprecated PRE-ATTACK.
However, previous versions
of ATTACK will retain the PRE-ATTACK matrix
in case you aren't ready to make the switch quite yet.
So you can still use PRE-ATTACK in version 7.2 and earlier
on our website in the sticks and in the ATTACK navigator.
So how can you help?
As we said, ATTACK is very focused on the community.
So feedback and contributions would be greatly appreciated.
Looking through things like new techniques
or scoping of existing techniques,
documentation of potential detections and mitigations,
and of course reported instances of
in the wild adversary procedure examples.
Lastly, we wanna give a special thanks
to a few people,
including MITRE's Ingrid Parker
for working with the ATTACK team to develop the criteria
for determining what PRE-ATTACK behaviors could assimilate
into Enterprised ATTACK.
We also want to give special thanks
to former ATTACK team member, Katie Nichols
along with current head of ATTACK, Adam Pennington
for white boarding sessions to determine the techniques
and sub techniques that fit those criteria.
And lastly, thank you to Kristen Asbeck
for leading the creation of PRE-ATTACK
which much of this work was based on.
And that folks is how we helped put the PRE into ATTACK.
Thank you and back over to you Jamie.
- And I'm just gonna thank everyone again
for joining ATTACKcon as well as I know in advance
for all the contributions to the pre-effort.
And with that, I'll turn it over
back to Adam for a sign off.
- And thank you guys
Mike and Jamie will be available for questions in the Slack.
Jamie's not gonna ask himself questions today.
Thank you again to all today's speakers
and for everyone for joining us.
There's been some great discussions in the Slack
which hopefully will keep going after we're done here.
Links to videos and slides from today will be emailed
to everyone who registered once their ready
to be put online.
And we'll be getting those out to everybody as well.
Please join us for the next ATTACKcon
power hour on December 11th.
Registration is open today
and thank you again for joining us.