- Next speaker is gonna be Matan Hart with Cymptom.
- Thank you, Adam and the entire ATT&CK team
for giving me the opportunity to present,
you're doing amazing job.
Huge fan here.
I'm going to talk about today is how you can transform
Adversary Emulation into Data Analysis Question
using the MITRE ATT&CK Framework
and specifically to mitigation in the ATT&CK Framework.
About myself, usually I look like in the picture
on the left side, but doing COVID,
I might look like this.
I'm the co founder and CEO at Cymptom Security Startup
specializing in security testing,
I've been a security researcher in the Israeli Defense Force
and as well as in the private sector,
some of my research I've been presented in
several security cons such as a Black Hat
and actually the inspiration for the content
that I'm talking today is based on my existing work,
building solutions
and conducting security assessments for large organizations
And click.
Right, so let's start with Adversary Emulation,
So Adversary Emulation, for those of you who need recap
is the way that has been used popularly
one of the most useful use cases for the ATT&CK Framework,
which is basically allowed organization
to test their defenses against specific threats,
the ATT&CK Framework can be very beneficial to measure test,
and then also make improvements to defenses
based on the different adversary tactics, techniques
and procedures.
But the problem with Adversary Emulation is that
it doesn't scale nor it wasn't intended to basically
the main focus of Adversary Emulation
is to test specific controls in a controlled manner
that is very targeted specific network
and isolating specific threat.
The issue with it is that some organization are looking up
still early on during their work with the ATT&CK Framework
and they basically want to get an initial
state of whereas our standing with our defenses
and against the metrics.
And what I've seen that basically some organization
are trying to emulate all attacks,
all in the network.
I've seen one time that there was organization
with 50,000 endpoints where as they needed to emulate
lateral movement technique used by an APT,
and they figured out only after they use
some kind of automation
that they literally emulated two and a half billion
emulation because they tested it from each computer
to all the other computers in the network.
So, it was a big number
and it's actually made a huge disruption to their network.
So what I'm suggesting is different approach
using the MITRE ATT&CK Metrics Framework
that basically instead of checking detection capabilities
that are the most commonly used with Adversary Emulation
is to basically look at the aspect of the mitigation
of the attack framework.
And testing each technique and the associated mitigations,
if you're really have the the right capabilities
to prevent the technique before going on to detection.
So the mythology is I have four steps,
first of all choose an ATT&CK technique,
you should preferably choose the technique that you feel
that you feel comfortable that you want to test first,
if you're already have a mapped techniques
to detection capabilities,
so you should probably start with something that you feel
that you don't have enough data sources
or detective capabilities in place,
then for the technique that you choose
you should test for each mitigation how much it effective
because not all of the mitigation
that are in the ATT&CK Framework
are you using the same attack vector
or some of them are just reducing some
of the attack surface over explorability of that technique
and some of them are truly mitigated the technique entirely,
after you grasp those techniques that you want to focus on,
you should map the data sources
that you can really collect information needed
in order to validate the applicability of that mitigation.
preferably you should do it for all the mitigation
for that technique in order to make sure
that you're not missing any information,
but in generally as mentioned also by previous speakers
before me it's not science,
yeah, the ATT&CK Framework
and you're gonna have to be 100% all the time
and it's okay that even if you feel that
it's not 100% accurate
or don't have access to all the information,
you can still be able to have the initial states
to conclude if a specific technique you are able
to prevent in your...
What is your current situation during that technique
and how much he's exploitable in your network,
not on specific endpoint rather on the entire attack surface
inside a network.
Let's take a test case the Pass The Hash scenario.
Basically Pass The Hash is a Literal Movement
and defense evasion technique that allows an adversary
to move laterally between endpoints based on a credential
that they can reuse
because they both have the same credentials.
It's very common between endpoints
that are used by the same image
and the default Middleton users, there password not changed
after they've been deployed
and something that is still very common
to see in organization
and it's something that very hard to really know
what's been changed or not.
when we looking at the mitigation's in the ATT&CK Framework
about the specific technique,
there are basically four different mitigation
that offer different...
They have different ways to mitigate this technique,
however, not all of them are actually doing the same,
and also as their exposure that how reducing
or eliminating is not the same.
So when you drill down with the small letters,
first of all, you can understand
what is really need to be checked,
what data should be collected
and then you can move on to do a bit of research.
It's not something that it's very easy,
but we took here a case that is more harder
as I've summed that up that mitigation
are more straightforward,
but when you check each mitigation and specifically
you can see that their effectiveness is always the same.
So of course, if you have the capability to check,
if there's any type of credential overlap,
the first mitigation, which is Privileged Account Management
if you use lapse or you have access to endpoints
and check the registry
or whether you have a PAM solution
that you can use to assess this is the best mitigation
that you could check and you could also enforce,
but of course life are not perfect
and if you're looking for other mitigation's
that could potentially reduce the attack surface
you should consider checking for your patch management,
if you installed a the right patches
that the matter mitigation suggest
as well as which will mitigate the exposure
only to administrative local accounts,
you could go with the User Account Control mitigation,
which is aimed more for domain users,
but it could be easily checked by a checking doctor director
in the GPO to see if multiple systems that have
administrative access
that the same user have administer access to both of them
and maybe you should consider focusing
on that mitigation as well.
Other effective mitigation that has been used
in the frame that is commonly seen in an organization
that is easy to implement
is User Account Management
is basically enforced some UAC restrictions using the GPO,
if you don't trust your GPO, you could also...
If you have the capability to query each endpoint registry
and look for the right keys,
which are also mentioned in the ATT&CK Mitigation
and basically if you don't have...
If your built-in Administrator account is disabled,
this is a very effective mitigation to eliminate
local account variation of the Pass The Hash
ATT&CK Technique.
And of course you can do talk about the ATT&CK Framework
and MITRE fancy heat map.
So here is my heat map, what we focus here,
the important difference is that
we are not mapping the detective controls,
We are checking only if the existing mitigations
are applied.
So if you already built a heat map
that shows your detection capabilities,
this heat map could look very different.
And I suggest to use it as a complimentary
to the techniques that you feel
that you don't have enough depiction of controls,
if you don't have already and you want to focus
and we start from square zero.
I think it's better, I feel it's better
to start actually we've DCF map.
And then if you feel comfortable
with preventing some of the ATT&CK Techniques,
you should focus your Detective Controls
for other techniques in in the MITRE Framework.
So those you can build even interesting
a heat map that contains how many of the techniques
you are able to prevent using preventing patrols,
using new mitigations in the ATT&CK Framework
and how many of those are you only able to detect?
So it's interesting a use case to make Defense Gap Analysis
first with mitigation and then also with detection.
So it's important to mention you need to pick the right tool
for the right job.
Adversary Emulation is great,
I've been doing it also for years,
it helps organization really to know really
where they stand and they'll also check
how you're also people and processes are performing.
The that makes Adversary Emulation not to scale
is the potential business disruption
that it might create and also the experienced team
that should do it in a safe manner.
That analytics on the other hand
could be a good complementary
to first get the right coverage in the ATT&CK Framework,
as well as the network coverage in a safe manner
that could scale better.
I suggest to start with...
We've done analytics
if you don't perform Adversary Emulation yet
and then based on the results that you can map
from the ATT&CK Metrics
in order to check your detective controls
or to see how you can really check
that the mitigation that you have implemented
are performing as intended,
Adversary Emulation could be a good use case
to check this.
The issue is we have that analytics is that first of all,
it doesn't check detective controls,
which is of course, one of the main use cases
that people use the ATT&CK Matrics
and the ATT&CK Framework,
and it doesn't really check any type of processes.
To conclude the presentation,
First of all, Adversary Emulation are
grades that are important
and it's something that I suggest everybody to practice,
even if you're not in the red team,
also blue teams can use the atomic red team,
which Verena talked about
but as well, it's something that you should use cautiously,
it's something that you don't really want to run it
in all your network,
rather you want to do it specifically
to check specific controls and in a controlled environment.
Data Analytics in the other hand could be a better approach
to get the initial state of what is your defense coverage
and to know where you stand and then you could operate
and implement new capabilities
whether preventive or detective.
And I found the mitigation attack very beneficial
to understand what the defense coverage,
because first of all,
most of the of the techniques in the MITRE Framework,
and basically most of the controls
that most organization have,
these organization are first of all, preventive
and of course should be preferred.
So sometimes I found yet mitigation and attack
something that should be used more often
during any type of usage for the ATT&CK Framework.
- Great talk Matana,
Well, that was fantastic, I really loved it.
Someone dropped a comment Slack
that you're effectively emulating the adversary emulators,
but like you said,
"Getting ahead of them and saying you know what."
Before we even...
Even if you don't have that resources
to do an emulation or before we do it,
let's go ahead and figure out like,
what are we doing in terms of the mitigation aspect?
I think a lot of people really it,
and that resonates with them.
Biggest question though
people are already asking this in Slack is
what advice do you have for the community in terms of
the process that you shared of looking at attack,
seeing the mitigations for technique,
and actually translating that to what can we do
in our environment?
How does that line up with our technology?
any words you can share with the community
and any wisdom you can kind of work with there.
- Right.
So first of all, I think as also discussed
in the previous talks and I guess it's something that
we learn with ATT&CK on a daily basis
that it's the human aspect,
we kind really automate everything
and say there is a magic,
of course you should...
It's required research in prize award,
I took an example of the Pass The Hash
because it's an interesting case,
and it's a bit complicated.
Of course, some of them are much easier to start with,
but yes, the process is to research is to learn
and to be familiar with the different tactics
and techniques and to be able to really understand
and research what are the current capabilities
that people have in this organization
that they can really check of course, good cyber posture
and hygiene helps,
and if you have the right tools and the rights controls
or use vendors that help you automate some of this stuff,
it could be easier but for most techniques
I found that it's pretty trivial,
I do think that is part of our work as a community
to also invest in the mitigations in the ATT&CK even more.
I know that those are also now the also shield
and of course, going forward how we can all as a community
be able to share more
and make that processes essay.
- Yap love that answer like you said,
cybersecurity is hard but I'm loving to contribute plugs
to get accepted by all means,
keeping everything back to us, we love it,
But yeah, thanks again for great talking.