- Our first speaker of December's ATT&CKCON Power Hour
returning ATT&CKCON speaker, Valentina Palacin.
- Hi everyone, thank you Adam for the introduction.
So, I'm gonna talk today about
a little app which I developed
with the Threat Mapping Catalogue.
What we're going to bring me to start this project,
What are the expectations?
What is the reality of that
and what I'm planning to do in the future?
So first I'm gonna talk about it a little bit on me
I'm a Threat Intelligence Analyst
I had a routine translation.
I'm trying to learn how to be a good Threat Hunter
and also I usually do things of Python Developing
on my free time.
That's how this idea came around,
around the last year,
maybe some of you saw a presentation
we did with reservoir embassy in attack 2.0
about Threat Library.
We repeated this presentation
in other places in Latin America,
trying to extend the attack knowledge
to your Spanish speakers
and most of the questions that we received a lot
after the presentation was,
How can I leverage something like this
if I don't have a dedicated team?
And it didn't got into them, into the slide,
but this question was followed by if
and if I don't have a good budget
like to buy a threat intelligence team.
So, we start pinpointing and we came up with this idea
there was a Threat Mapping Catalogue
which actually is basically a link
between the Threat Report ATT&CK Mapping TRAM
and the ATT&CK Navigator
which well, these are we'll do is to leverage the attack
through the taxi server
and we'll build all the information they have
in the website into a database.
It will be, it will create a relationship between that
and then it will link.
If you want to add more information, you can use TRAM
do you have more information?
And you can also automatically build that, that same
those mappings into the navigator.
So my expectations, when I started, I wished it
I had to wish to do this, all those things
I've seen the screen, I'm going
I'm not going to get into them, but then 2020 happen.
And after a lot of nights in which I actually
this actually happened to me
and I woke up to do something like this by hand,
and a lot of the and I can not even understand what I wrote,
but and a lot of time of doing, why did I do this to myself?
Because the pressure of the deadline was there,
plus everything that was going on.
It came up with some.
I didn't met every everything that I wished to accomplish
but for now the obvious usable do the links are there.
You can actually communicate
between TRAM and the navigator.
You can load everything of, of ATT&CK related
and the things that I couldn't manage to do right now
they're going to do it in the future.
So the first time you, the first thing you relate to do
in order to use the app will be
to clone and modify a tag navigator repo
and modify TRAM repo and the app repo itself.
And after registering and logging into the application
you're going to need to, to access to the path first time.
And then you will have to wait
and wait some more 'cause actually mapping everything
and creating all the relationship for the ATT&CK
takes about one and a half hours,
depending on where you are and your internet connection.
So you have to let it, let it, let it bill.
But after that, you will have something like this with them.
You can explore everything in ATT&CK fairly easily
with the table, and also start looking
for other things like the relationship between the data.
This is an example.
You can also filter the data.
If you have their list of the adversaries
or the list of tools
you can filter it for filtering
and start looking what you want to do.
And those sections there allow you
to either edit the data downloaded as STB opening
or open it into the navigator.
This is an example of how the app works.
When you click the link,
you will open the navigator
and it's not a, the previous solution, but it works.
The file with the mapping gets sent to the navigators
through the URL that really should I request to
I get requests to the team
to you to retrieve the file and open the layer.
Then, well, this screenshot,
it shows how you can edit the data
and you can also create new data and add, for example
in this case, you can add, and you feel which it
would be the via region of the adversary
which will allow you to track the adversaries
that you are loading based on the suspected of origin of it.
And this screen
you can trigger the mapping, TRAM interaction.
So for these, you will load the adversary,
the tool if you know what tool,
they're related into industry if you know it,
and when you pass it you're out to do
the input field and you click into map.
This will trigger the local bill map,
TRAM in server.
And then you, there will, you have to
you will have to do the process yourself, the mapping
the selecting, the techniques recording to maps
I thought about doing it automatically, but then you
kind of do not allow TRAM to learn from your selections.
So I went to the study side
and when you finally moved to the
in the card to, or the report to the complete column
it will trigger an issue back to the TMC with
all the mapping that you have selected.
So in that way, you will be able to look for it
into the same database.
Finally, you can, explore
all the relationships that are built
within as long as you are building data
and also within them, the Matria attack data
that's already loaded.
For example, here
you can see adversaries for tools, tools, Britain, mics.
You can, even, if you are tracking
a lot of trout reports through times,
you cannot track events for industry.
Also, you cannot
you can see a list of the most users techniques
according what is in the, in the
in the database and in the future
I would like to add a lot more stuff, but for now
this is what we have.
I would like to have more relationships.
For example, I think it's very interesting to
study how the adversary of evolving time.
Maybe the dates in which the campaigns are, are happening,
when the, to began the study, that the evolution
of the techniques of the adversaries,
I will like to avoid having the user
loading everything through TRAM.
And if someone wants to unload its own mapping outside TRAM
what I will want them to be able to do it also,
one thing that I did mention
that it's not possible to do right now
is to edit the relationships that are already in the
in the database, through the user interface.
That's a gold in the future.
I will also like to dockerize everything to
make it easy for deployment.
And finally, some, maybe some graphics
or something to study better what the adversaries are doing.
As a final goal with Ruth,
we talk a lot about translating attack into Spanish.
So this, the, the whole goal of this pro of this project
was to help those companies, small companies
or companies that was not a lot of resources
to deliver it threat intelligence.
And one way to do it too, is to translate in attack
to make it more available to Latin America, speakers
Spanish speakers in general,
and this pressure will be part of the OTR community.
And so everyone that wants to collaborate can
can collaborate there and, and keep improving it.
But for now, after everything that happened
in this district 2020, and when working with this
and all other stuff, I think I'm going to take
a well a verification and keep, maybe we will resume
development and in proving the functionalities
with the TMC after January.
So that's kind of all for my part, if you have any questions
and if you want to reach me there, or my, my networks
Twitter, LinkedIn
and I will be happy to answer anything you have for me.
- Thanks for sharing.
And first and foremost, thank you for taking the time
and like actually taking all the knowledge that you have
and building something that community can
the community can use, even though it takes a lot,
personal time and in a late hours and a lot of learning
as you said, I think your skill sets really useful,
and it's, it's really impactful,
you can actually put something in people's hands
that they can actually harvest all of the lessons
and experience that you've acquired over the years.
But I think my first question is
we've had a lot of interests even in the Slack channel.
So you'll have to see it already when he, after this talk
but how, how can people get involved?
I know it's really exciting
that you just publish this stuff on GitHub.
Are you looking for people to kind of come in
and do testing for you and your contributions,
or how can people kind of help on these?
- For sure, I mean, I love it.
I did, as much as I can.
I'm a soft kind of soft of developer.
So I'm really looking forward to feedback
and to ways to improve things that are already built.
And, and also, I am not an expert in, in
in JavaScript angular that is
everything that's navigator related.
So I think there's a lot of potential to build more things
and to connect the app better.
And, and I would love to do, to have this contribution.
And that's also a goal what, one I presented because
I think that importance and and what I wanted to do
was to be able to give something
to people, to, to leverage TTI in, in a useful way.
And for that, it has to be something public and something,
something that everyone can contribute to it.
- Yep Exactly, and like I think then
you have the most important thing
that the skills with coding and stuff
that'll all develop over time, but the vision
to say, like this is what, where we need to be.
This is what the problem is.
So speaking towards that,
for those people who might've missed your presentation
last year for it, with Ruth,
as a small organization or a small shop,
how does this intelligence help me?
Like, what should I be doing with that?
How do I actually apply intelligence
about adversaries toward my goals?
- I think if you focus in delivering into building accurate
data and data set of information that is relevant to you
you can probably manage better those,
the more resources you have,
to dedicate it to the things that are more critical
and crucial for your organization
than instead of trying, like to swim in the dark
and maybe what, the way.
- Yeah, that makes sense, like a prioritization saying,
there's just so many things to worry about
but like I said, your, your approach of like understanding,
what things are most likely to happen to me.
And then, you know, what things are,
most relevant for me that kind of helps make
huge effort and maybe something that we can,
address it on a day to day perspective.
I know another thing that people are really
really loving is your idea of translating attack to Spanish.
I think I've heard some rumors about this.
Can you speak a little bit towards that?
And both in terms of how people can get involved
as well as the impact of it?
I think it's a really, really notable effort.
- Yeah, So actually this is a project that born
in a discussion with Ruth
and we had been planning on this for a year.
We have, we have building something that's gonna be called
Open Sec Library, which the idea is
to translate more content into Spanish.
And even if to onto other languages, it will be all managed
through OTR, which is open thread research.
They can find it find in Twitter, we will do a
you'd have repositories in which people can collaborate
to with translation for attack.
And also we are going to have projects
for translating other stuff into Spanish, too.
- Awesome, that sounds amazing.
So definitely thank you for your time
and thank you for sharing all your ideas.