Abstract image of a woman sitting on books and studying on a laptop

ATT&CKing the Red/Blue Divide

M
MITRE ATT&CK

The document discusses the integration of red and blue team efforts to enhance threat detection and response using the MITRE ATT&CK framework. It highlights the importance of community collaboration in curating analytics, reducing false positives, and improving the validation of security measures. The presentation introduces the SnapAttack community platform, aiming to provide open access to threat intelligence while fostering community contributions and better analytic robustness.

Technology
1 of 28
Downloaded 159 times
1
2
3
4
5
6
Most read
7
8
9
Most read
10
Most read
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Attacking the Red vs Blue Divide MITRE ATT&CKcon 3.0 March 30, 2022
Copyright © 2021 Threatology, Inc #whoami Fred Frey CTO/Co-founder - SnapAttack 20+ years of red team + threat hunt ffrey@snapattack.com @fryguy2600 Jonathan Mulholland AI Director - SnapAttack 15 years experience in data analysis and scientific research jmulholland@snapattack.com
Agenda Talk Topics • Our approach: red and blue • Threat & analytics library • What is measured, gets improved! • Curating analytics • Better ATT&CK coverage estimates • Analytic robustness measures • SnapAttack Community Release Goals and Motivations Support community threat research efforts by: • Combining multiple red and blue community efforts together • Measuring and identifying community detection gaps • Empower searching and filtering attacks/analytics in a purpose-built platform
Community Threat Research Security Content Analytics Sentinel Use Cases Red Team Communities Blue Team Communities … wouldn't it be cool if we could combine and independently validate these efforts? Sigma
Red ↔ Blue: Particle Collider Particle Collider Propels charged particles at high speeds that smash against other particles. By studying these collisions, physicists are able to probe the world of the infinitely small.
Red ↔ Blue: Particle Collider Atomic Red T1059 -> T1218 -> T1047 -> T1003 -> T1105 -> T1055 -> <- T1059 <- T1218 <- T1047 <- T1003 <- T1105 <- T1055 Sigma Logs EDR, syslogs, application logs, PCAP / Zeek SnapAttack Propels malicious attacks at high speeds that smash against behavioral detection analytics. By studying these collisions, threat researchers are able to probe the world of the hackers.
Empowering Threat Research What can we measure with red and blue data? False Positives – Throw out overly false positive analytics and/or improve filtering True Positives Validation – Ensure it detects what you expect it to MITRE ATT&CK Coverage – Detect across the board, validate community labels Analytic Similarities – Find duplicate analytics, pick the best 1 2 3 4
Into the Platform
Threat and Analytic Library Video of Attack Attack Description Analytic Hit Details Analytic Timeline Memorialize attacks – share with the community
Threat and Analytic Library Validate "All the Things" CONFIDENTLY DEPLOY BLUE TEAM Creates analytics to detect RED TEAM Emulates / captures threat to validate Signature Metadata • Title / description / notes • MITRE ATT&CK mapping • Validation status • Confidence ranking • Exclusion filters • Link to true positive logs Threat Metadata • Title / description / notes • MITRE ATT&CK mapping • Security event logs • Threat intel report link • Labeled threats (ATT&CK + timestamp) ANALYTIC LIBRARY THREAT LIBRARY Undetected Attack Logs VALIDATED True Positive Untested Signatures
FALSE POSITIVE (Noise) TRUE POSITIVE (Validated hit) FALSE NEGATIVE (Undetected hit) Label Data Validation Criteria Blue and red marker must match either: • The same event log, or • +/- 5 seconds with the same ATT&CK technique or process ID Attack timeline with overlayed detection hits
Curating Analytics: False Positive Reduction
Curating Analytics ATOMIC SESSIONS • 1,840 Sigma queries • 322 distinct ATT&CK tags Sigma Community Analytics • 847 Atomic Red scripts • 379 attacks emulated in our lab • 182 distinct ATT&CK tags Atomic Red Scripts • Techniques: 188 • Sub-techniques: 379 ATT&CK Techniques Finding Quality Community Detections ATOMIC SESSIONS SIGMA QUERIES
Curating Analytics • Filter out noise • Identify the events of interest • This experiment is environment sensitive Our Particle Traces Collision! ATOMIC SESSIONS SIGMA QUERIES QUERY HIT
False Positives Removed • Analytic must have 1 - 20 connections on the graph • Analytics that miss are discarded Noise Filters • Results can't be obtained manually • Analytic that miss form a red team backlog (need to create a true positive attack example) Notes ATOMIC SESSIONS SIGMA QUERIES QUERY HIT
Reducing False Positives Example: Change Powershell Policies to an Unsecure Level • Hits every single Atomic Red session • Author's level and false positive entries are unreliable • Behavior is environment dependent, manual curation is impossible CommandLine: powershell.exe -ExecutionPolicy Bypass -File C:Program FilesAmazonEc2ConfigServiceScriptsDiscoverConsolePort.ps1 detection: option: CommandLine|contains: '-executionpolicy' level: CommandLine|contains: - 'Unrestricted' - 'bypass' - 'RemoteSigned' condition: option and level falsepositives: - Administrator script level: high Unanticipated query behavior False Positive Log Hit:
CRITICAL HIGH MEDIUM LOW 0.0 0.2 0.4 0.6 0.8 1.0 QUALITY SCORE Criticality Level Can't Be Trusted! • Is not based on your data • Author expertise is unknown Sigma Author's Assessment Conclusion • Risk = Probability x Severity • Sigma level field does not include probability • Probability can be obtained from real data or estimated using community data DISTRIBUTION OF ANALYTIC QUALITY FOR EACH CRITICALITY LEVEL Quality Score • The fraction of hits by a Sigma query that are validated (1.0 means all hits from an analytic were validated) coin flip whether the analytic is reliable Criticality vs. Analytic Quality
Curating Analytics: Analytic Validation
Analytic Validation • False positive reduction • Analytic must have a validated hit (true positive) Analytic Filters Winners! ATOMIC SESSIONS SIGMA QUERIES QUERY HIT Validation Criteria • Analytic hit and attack marker match the exact same event log, or • Analytic hit must be near (+/- 5 seconds) an attack marker and share a MITRE ATT&CK tag or process ID
Validated Analytics Atomic Sessions Dump LSASS.exe Memory using ProcDump Dump LSASS.exe Memory using comsvcs.dll Dump LSASS.exe Memory using direct system calls and API unhooking Create Mini Dump of LSASS.exe using ProcDump Dump LSASS.exe Memory using Out-Minidump.ps1 Cred Dump Tools Dropped Files LSASS Memory Dump File Creation LSASS Memory Dumping Procdump Usage Suspicious Use of Procdump LSASS Memory Dump Suspicious Use of Procdump on LSASS Lsass Memory Dump via Comsvcs DLL Dumpert Process Dumper LSASS Process Memory Dump Files Dumpert Process Dumper Process Dump via Comsvcs DLL Credentials Dumping Tools Accessing LSASS Memory Generic Password Dumper Activity on LSASS Accessing WinAPI in PowerShell for Credentials Dumping Sigma Queries ATOMIC SESSIONS SIGMA QUERIES QUERY HIT T1003.001: OS Credential Dumping: LSASS Memory
MITRE ATT&CK Coverage Estimate
False Positives Filter Validation Filter Unfiltered Sigma Queries: 129 Atomic Sessions: 127 Sigma Queries: 221 Atomic Sessions: 214 Sigma Queries: 1840 Atomic Sessions: 379 SIGMA 322 ATT&CK TECHNIQUES 567 Realistic ATT&CK Coverage ATT&CK TECHNIQUES 567 SIGMA 130 ATT&CK TECHNIQUES 567 SIGMA 115 Query / Session Counts ATT&CK Technique Coverage
Analytic Similarity
Analytic Similarity • Nerds: Projection of the bipartite network onto a single mode using hyperbolic weighting • Everyone Else: Finding similar/duplicate analytics Analytic Similarity Applications of Similarity Calculation • Deduplication • Auto labeling • Defense-in-depth Use unvalidated data to calculate correlations Disjoint of sets of most correlated analytics Projection showing Sigma query connectivity based on similar Atomic Red hits Leveraging Graph Data
Analytic Similarity Analytic Similarity • Nearly identical analytic • ATT&CK tag error Mavinject Inject DLL Into Running Process T1055.001 Process Injection: Dynamic-link Library Execution T1056.004 Inject Capture: Credential Hooking detection: selection: CommandLine|contains|all: - ' /INJECTRUNNING' - '.dll' OriginalFileName|contains: mavinject condition: selection Mavinject Process Injection T1055.001 Process Injection: Dynamic-link Library Execution T1218. Signed Binary Process Execution detection: selection: CommandLine|contains: ' /INJECTRUNNING ' condition: selection Example #1 – Result: Merge to improve
Analytic Similarity Analytic Similarity Suspicious Rundll32 Script in CommandLine T1218.011 Signed Binary Proxy Execution: Rundll32 detection: selection_run: CommandLine|contains|all: - rundll32 - 'mshtml,RunHTMLApplication' selection_script: CommandLine|contains: - 'javascript:' - 'vbscript:' condition: all of selection_* logsource: category: process_creation product: windows Example #2 – Result: Keep Both for robustness • Similar analytic and same tag • Defense-in-depth • Process logs • Network logs • Auto-labeling potential Rundll32 Internet Connection T1218.011 Signed Binary Proxy Execution: Rundll32 detection: selection: Image|endswith: 'rundll32.exe' Initiated: 'true' filter: - DestinationIp|startswith: - '10.' - '192.168.' - '172.16.' ... filter_microsoft: DestinationIp|startswith: - '51.124.' condition: selection and not 1 of filter* logsource: category: network_connection product: windows
Research Wrap-up CONFIDENTLY DEPLOY ANALYTIC LIBRARY THREAT LIBRARY Undetected Attack Logs VALIDATED True Positive Untested Signatures Collision Experiments Results • Curated set of validated analytics • Backlog of undetected Atomic Red sessions • Realistic MITRE ATT&CK coverage • Graph theory analytic similarity Released Today in SnapAttack Community Platform ATT&CK TECHNIQUES 567 SIGMA 115
SnapAttack – Community Platform • Forever free and open to the community • Access to all community content (including all Sigma analytics and Atomic Red attacks mentioned today) • Request contributor beta access (general availability in the next ~3-4 months) • Analytic IDE for creating and testing detections • Capture and share your own attacks Register Today or Request Contributor Beta Access https://www.snapattack.com/community We are launching our community edition today

More Related Content

PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
MITRE ATT&CK
 
PDF
Mapping ATT&CK Techniques to ENGAGE Activities
MITRE ATT&CK
 
PDF
Knowledge for the masses: Storytelling with ATT&CK
MITRE ATT&CK
 
PDF
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
MITRE ATT&CK
 
PDF
When Insiders ATT&CK!
MITRE ATT&CK
 
PDF
ATT&CK Updates- Defensive ATT&CK
MITRE ATT&CK
 
PDF
It's just a jump to the left (of boom): Prioritizing detection implementation...
MITRE ATT&CK
 
PDF
State of the ATT&CK
MITRE ATT&CK
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
MITRE ATT&CK
 
Mapping ATT&CK Techniques to ENGAGE Activities
MITRE ATT&CK
 
Knowledge for the masses: Storytelling with ATT&CK
MITRE ATT&CK
 
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
MITRE ATT&CK
 
When Insiders ATT&CK!
MITRE ATT&CK
 
ATT&CK Updates- Defensive ATT&CK
MITRE ATT&CK
 
It's just a jump to the left (of boom): Prioritizing detection implementation...
MITRE ATT&CK
 
State of the ATT&CK
MITRE ATT&CK
 

What's hot (20)

PDF
Landing on Jupyter: The transformative power of data-driven storytelling for ...
MITRE ATT&CK
 
PDF
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
MITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK's Open Source
MITRE ATT&CK
 
PDF
ATT&CKING Containers in The Cloud
MITRE ATT&CK
 
PDF
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
MITRE ATT&CK
 
PDF
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
MITRE ATT&CK
 
PDF
ATT&CK Updates- Campaigns
MITRE ATT&CK
 
PDF
Threat Modelling - It's not just for developers
MITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK for mac/Linux
MITRE ATT&CK
 
PDF
The ATT&CK Latin American APT Playbook
MITRE ATT&CK
 
PDF
Automating the mundanity of technique IDs with ATT&CK Detections Collector
MITRE ATT&CK
 
PDF
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
MITRE ATT&CK
 
PDF
The ATT&CK Philharmonic
MITRE ATT&CK
 
PDF
Projects to Impact- Operationalizing Work from the Center
MITRE ATT&CK
 
PDF
ATT&CKcon Intro
MITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK for ICS
MITRE ATT&CK
 
PDF
Adversary Emulation - Red Team Village - Mayhem 2020
Jorge Orchilles
 
PDF
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE - ATT&CKcon
 
PDF
How MITRE ATT&CK helps security operations
Sergey Soldatov
 
PDF
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE - ATT&CKcon
 
Landing on Jupyter: The transformative power of data-driven storytelling for ...
MITRE ATT&CK
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
MITRE ATT&CK
 
ATT&CK Updates- ATT&CK's Open Source
MITRE ATT&CK
 
ATT&CKING Containers in The Cloud
MITRE ATT&CK
 
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
MITRE ATT&CK
 
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
MITRE ATT&CK
 
ATT&CK Updates- Campaigns
MITRE ATT&CK
 
Threat Modelling - It's not just for developers
MITRE ATT&CK
 
ATT&CK Updates- ATT&CK for mac/Linux
MITRE ATT&CK
 
The ATT&CK Latin American APT Playbook
MITRE ATT&CK
 
Automating the mundanity of technique IDs with ATT&CK Detections Collector
MITRE ATT&CK
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
MITRE ATT&CK
 
The ATT&CK Philharmonic
MITRE ATT&CK
 
Projects to Impact- Operationalizing Work from the Center
MITRE ATT&CK
 
ATT&CKcon Intro
MITRE ATT&CK
 
ATT&CK Updates- ATT&CK for ICS
MITRE ATT&CK
 
Adversary Emulation - Red Team Village - Mayhem 2020
Jorge Orchilles
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE - ATT&CKcon
 
How MITRE ATT&CK helps security operations
Sergey Soldatov
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE - ATT&CKcon
 
Ad

Similar to ATT&CKing the Red/Blue Divide (20)

PPTX
2017 Q1 Arcticcon - Meet Up - Adventures in Adversarial Emulation
Scott Sutherland
 
PDF
MITRE ATTACKcon Power Hour - October
MITRE - ATT&CKcon
 
PPTX
Build a complete security operations and compliance program using a graph dat...
Erkang Zheng
 
PDF
Protecting the Protector, Hardening Machine Learning Defenses Against Adversa...
Priyanka Aash
 
PDF
Security Certification: Security Analytics using Sumo Logic - Oct 2018
Sumo Logic
 
PDF
[Warsaw 26.06.2018] SDL Threat Modeling principles
OWASP
 
PDF
MITRE ATTACKcon Power Hour - January
MITRE - ATT&CKcon
 
PDF
TIC-TOC: Disrupt the Threat Management Conversation with Dominique Singer and...
SaraPia5
 
PDF
End-to-End Security Analytics with the Elastic Stack
Elasticsearch
 
PPTX
How to Leverage Log Data for Effective Threat Detection
AlienVault
 
PDF
Scaling security in a cloud environment v0.5 (Sep 2017)
Dinis Cruz
 
PDF
BlueHat v18 || Protecting the protector, hardening machine learning defenses ...
BlueHat Security Conference
 
PPTX
Sumo Logic Cert Jam - Security & Compliance
Sumo Logic
 
PPTX
Null meet Code Review
Naga Venkata Sunil Alamuri
 
PPTX
EmPOW: Integrating Attack Behavior Intelligence into Logstash Plugins
FaithWestdorp
 
PDF
Application Security in an Agile World - Agile Singapore 2016
Stefan Streichsbier
 
PPTX
Threat modelling(system + enterprise)
abhimanyubhogwan
 
PDF
ScotSecure West Summit 2024 - Glasgow 11th Sept
Ray Bugg
 
PDF
MITRE AttACK framework it is time you took notice_v1.0
Michael Gough
 
PPTX
Moving Security to the Left
Javier Godinez
 
2017 Q1 Arcticcon - Meet Up - Adventures in Adversarial Emulation
Scott Sutherland
 
MITRE ATTACKcon Power Hour - October
MITRE - ATT&CKcon
 
Build a complete security operations and compliance program using a graph dat...
Erkang Zheng
 
Protecting the Protector, Hardening Machine Learning Defenses Against Adversa...
Priyanka Aash
 
Security Certification: Security Analytics using Sumo Logic - Oct 2018
Sumo Logic
 
[Warsaw 26.06.2018] SDL Threat Modeling principles
OWASP
 
MITRE ATTACKcon Power Hour - January
MITRE - ATT&CKcon
 
TIC-TOC: Disrupt the Threat Management Conversation with Dominique Singer and...
SaraPia5
 
End-to-End Security Analytics with the Elastic Stack
Elasticsearch
 
How to Leverage Log Data for Effective Threat Detection
AlienVault
 
Scaling security in a cloud environment v0.5 (Sep 2017)
Dinis Cruz
 
BlueHat v18 || Protecting the protector, hardening machine learning defenses ...
BlueHat Security Conference
 
Sumo Logic Cert Jam - Security & Compliance
Sumo Logic
 
Null meet Code Review
Naga Venkata Sunil Alamuri
 
EmPOW: Integrating Attack Behavior Intelligence into Logstash Plugins
FaithWestdorp
 
Application Security in an Agile World - Agile Singapore 2016
Stefan Streichsbier
 
Threat modelling(system + enterprise)
abhimanyubhogwan
 
ScotSecure West Summit 2024 - Glasgow 11th Sept
Ray Bugg
 
MITRE AttACK framework it is time you took notice_v1.0
Michael Gough
 
Moving Security to the Left
Javier Godinez
 
Ad

More from MITRE ATT&CK (20)

PDF
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
MITRE ATT&CK
 
PDF
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
MITRE ATT&CK
 
PDF
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
MITRE ATT&CK
 
PDF
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
MITRE ATT&CK
 
PDF
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
MITRE ATT&CK
 
PDF
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
MITRE ATT&CK
 
PDF
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
MITRE ATT&CK
 
PDF
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
MITRE ATT&CK
 
PDF
Every Cloud Has a Purple Lining - Arun Seelagan
MITRE ATT&CK
 
PDF
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
MITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
MITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Lightning Talks - Various Speakers
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Enterprise - Casey Knerr
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Software - Jared Ondricek
MITRE ATT&CK
 
PDF
State of the ATT&CK 2024 - Adam Pennington
MITRE ATT&CK
 
PDF
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
MITRE ATT&CK
 
PDF
Updates from The Center for Threat Informed Defense - Jon Baker
MITRE ATT&CK
 
PDF
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
MITRE ATT&CK
 
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
MITRE ATT&CK
 
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
MITRE ATT&CK
 
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
MITRE ATT&CK
 
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
MITRE ATT&CK
 
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
MITRE ATT&CK
 
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
MITRE ATT&CK
 
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
MITRE ATT&CK
 
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
MITRE ATT&CK
 
Every Cloud Has a Purple Lining - Arun Seelagan
MITRE ATT&CK
 
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
MITRE ATT&CK
 
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
MITRE ATT&CK
 
ATT&CKcon 5.0 Lightning Talks - Various Speakers
MITRE ATT&CK
 
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
MITRE ATT&CK
 
MITRE ATT&CK Updates: Enterprise - Casey Knerr
MITRE ATT&CK
 
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
MITRE ATT&CK
 
MITRE ATT&CK Updates: Software - Jared Ondricek
MITRE ATT&CK
 
State of the ATT&CK 2024 - Adam Pennington
MITRE ATT&CK
 
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
MITRE ATT&CK
 
Updates from The Center for Threat Informed Defense - Jon Baker
MITRE ATT&CK
 
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
MITRE ATT&CK
 

Recently uploaded (20)

PPTX
Module 1 Introduction to Web Programming .pptx
kamleshkc191
 
PDF
Human Computer Interaction Miterm Lesson
JasperGarcia9
 
PDF
ment.tech-Siri Delay Opens AI Startup Opportunity in 2025.pdf
thomasnova26
 
PDF
Connector Corner: Transform Unstructured Documents with Agentic Automation
DianaGray10
 
PDF
Dell Pro Micro: Speed customer interactions, patient processing, and learning...
Principled Technologies
 
PDF
Altius execution marketplace concept.pdf
Wandor
 
PDF
MENA-ECEONOMIC-CONTEXT-VC MENA-ECEONOMIC
Mustafa Kuğu
 
PDF
Advancing precision in air quality forecasting through machine learning integ...
IAESIJAI
 
PPTX
SGT Report The Beast Plan and Cyberphysical Systems of Control
hopegirl587
 
PDF
Transform-Quality-Engineering-with-AI-A-60-Day-Blueprint-for-Digital-Success.pdf
Kalilur Rahman
 
PDF
The-Future-of-Automotive-Quality-is-Here-AI-Driven-Engineering.pdf
Kalilur Rahman
 
PDF
Auditboard EB SOX Playbook 2023 edition.
DROK2
 
PDF
Data Virtualization in Action: Scaling APIs and Apps with FME
Safe Software
 
PPTX
AI-driven Assurance Across Your End-to-end Network With ThousandEyes
ThousandEyes
 
PDF
Transform-Your-Factory-with-AI-Driven-Quality-Engineering.pdf
Kalilur Rahman
 
PDF
Lung cancer patients survival prediction using outlier detection and optimize...
IAESIJAI
 
PDF
Early detection and classification of bone marrow changes in lumbar vertebrae...
IAESIJAI
 
PDF
A symptom-driven medical diagnosis support model based on machine learning te...
IAESIJAI
 
PDF
SaaS reusability assessment using machine learning techniques
IAESIJAI
 
PDF
Co-training pseudo-labeling for text classification with support vector machi...
IAESIJAI
 
Module 1 Introduction to Web Programming .pptx
kamleshkc191
 
Human Computer Interaction Miterm Lesson
JasperGarcia9
 
ment.tech-Siri Delay Opens AI Startup Opportunity in 2025.pdf
thomasnova26
 
Connector Corner: Transform Unstructured Documents with Agentic Automation
DianaGray10
 
Dell Pro Micro: Speed customer interactions, patient processing, and learning...
Principled Technologies
 
Altius execution marketplace concept.pdf
Wandor
 
MENA-ECEONOMIC-CONTEXT-VC MENA-ECEONOMIC
Mustafa Kuğu
 
Advancing precision in air quality forecasting through machine learning integ...
IAESIJAI
 
SGT Report The Beast Plan and Cyberphysical Systems of Control
hopegirl587
 
Transform-Quality-Engineering-with-AI-A-60-Day-Blueprint-for-Digital-Success.pdf
Kalilur Rahman
 
The-Future-of-Automotive-Quality-is-Here-AI-Driven-Engineering.pdf
Kalilur Rahman
 
Auditboard EB SOX Playbook 2023 edition.
DROK2
 
Data Virtualization in Action: Scaling APIs and Apps with FME
Safe Software
 
AI-driven Assurance Across Your End-to-end Network With ThousandEyes
ThousandEyes
 
Transform-Your-Factory-with-AI-Driven-Quality-Engineering.pdf
Kalilur Rahman
 
Lung cancer patients survival prediction using outlier detection and optimize...
IAESIJAI
 
Early detection and classification of bone marrow changes in lumbar vertebrae...
IAESIJAI
 
A symptom-driven medical diagnosis support model based on machine learning te...
IAESIJAI
 
SaaS reusability assessment using machine learning techniques
IAESIJAI
 
Co-training pseudo-labeling for text classification with support vector machi...
IAESIJAI
 

ATT&CKing the Red/Blue Divide

  • 1. Attacking the Red vs Blue Divide MITRE ATT&CKcon 3.0 March 30, 2022
  • 2. Copyright © 2021 Threatology, Inc #whoami Fred Frey CTO/Co-founder - SnapAttack 20+ years of red team + threat hunt [email protected] @fryguy2600 Jonathan Mulholland AI Director - SnapAttack 15 years experience in data analysis and scientific research [email protected]
  • 3. Agenda Talk Topics • Our approach: red and blue • Threat & analytics library • What is measured, gets improved! • Curating analytics • Better ATT&CK coverage estimates • Analytic robustness measures • SnapAttack Community Release Goals and Motivations Support community threat research efforts by: • Combining multiple red and blue community efforts together • Measuring and identifying community detection gaps • Empower searching and filtering attacks/analytics in a purpose-built platform
  • 4. Community Threat Research Security Content Analytics Sentinel Use Cases Red Team Communities Blue Team Communities … wouldn't it be cool if we could combine and independently validate these efforts? Sigma
  • 5. Red ↔ Blue: Particle Collider Particle Collider Propels charged particles at high speeds that smash against other particles. By studying these collisions, physicists are able to probe the world of the infinitely small.
  • 6. Red ↔ Blue: Particle Collider Atomic Red T1059 -> T1218 -> T1047 -> T1003 -> T1105 -> T1055 -> <- T1059 <- T1218 <- T1047 <- T1003 <- T1105 <- T1055 Sigma Logs EDR, syslogs, application logs, PCAP / Zeek SnapAttack Propels malicious attacks at high speeds that smash against behavioral detection analytics. By studying these collisions, threat researchers are able to probe the world of the hackers.
  • 7. Empowering Threat Research What can we measure with red and blue data? False Positives – Throw out overly false positive analytics and/or improve filtering True Positives Validation – Ensure it detects what you expect it to MITRE ATT&CK Coverage – Detect across the board, validate community labels Analytic Similarities – Find duplicate analytics, pick the best 1 2 3 4
  • 9. Threat and Analytic Library Video of Attack Attack Description Analytic Hit Details Analytic Timeline Memorialize attacks – share with the community
  • 10. Threat and Analytic Library Validate "All the Things" CONFIDENTLY DEPLOY BLUE TEAM Creates analytics to detect RED TEAM Emulates / captures threat to validate Signature Metadata • Title / description / notes • MITRE ATT&CK mapping • Validation status • Confidence ranking • Exclusion filters • Link to true positive logs Threat Metadata • Title / description / notes • MITRE ATT&CK mapping • Security event logs • Threat intel report link • Labeled threats (ATT&CK + timestamp) ANALYTIC LIBRARY THREAT LIBRARY Undetected Attack Logs VALIDATED True Positive Untested Signatures
  • 11. FALSE POSITIVE (Noise) TRUE POSITIVE (Validated hit) FALSE NEGATIVE (Undetected hit) Label Data Validation Criteria Blue and red marker must match either: • The same event log, or • +/- 5 seconds with the same ATT&CK technique or process ID Attack timeline with overlayed detection hits
  • 13. Curating Analytics ATOMIC SESSIONS • 1,840 Sigma queries • 322 distinct ATT&CK tags Sigma Community Analytics • 847 Atomic Red scripts • 379 attacks emulated in our lab • 182 distinct ATT&CK tags Atomic Red Scripts • Techniques: 188 • Sub-techniques: 379 ATT&CK Techniques Finding Quality Community Detections ATOMIC SESSIONS SIGMA QUERIES
  • 14. Curating Analytics • Filter out noise • Identify the events of interest • This experiment is environment sensitive Our Particle Traces Collision! ATOMIC SESSIONS SIGMA QUERIES QUERY HIT
  • 15. False Positives Removed • Analytic must have 1 - 20 connections on the graph • Analytics that miss are discarded Noise Filters • Results can't be obtained manually • Analytic that miss form a red team backlog (need to create a true positive attack example) Notes ATOMIC SESSIONS SIGMA QUERIES QUERY HIT
  • 16. Reducing False Positives Example: Change Powershell Policies to an Unsecure Level • Hits every single Atomic Red session • Author's level and false positive entries are unreliable • Behavior is environment dependent, manual curation is impossible CommandLine: powershell.exe -ExecutionPolicy Bypass -File C:Program FilesAmazonEc2ConfigServiceScriptsDiscoverConsolePort.ps1 detection: option: CommandLine|contains: '-executionpolicy' level: CommandLine|contains: - 'Unrestricted' - 'bypass' - 'RemoteSigned' condition: option and level falsepositives: - Administrator script level: high Unanticipated query behavior False Positive Log Hit:
  • 17. CRITICAL HIGH MEDIUM LOW 0.0 0.2 0.4 0.6 0.8 1.0 QUALITY SCORE Criticality Level Can't Be Trusted! • Is not based on your data • Author expertise is unknown Sigma Author's Assessment Conclusion • Risk = Probability x Severity • Sigma level field does not include probability • Probability can be obtained from real data or estimated using community data DISTRIBUTION OF ANALYTIC QUALITY FOR EACH CRITICALITY LEVEL Quality Score • The fraction of hits by a Sigma query that are validated (1.0 means all hits from an analytic were validated) coin flip whether the analytic is reliable Criticality vs. Analytic Quality
  • 19. Analytic Validation • False positive reduction • Analytic must have a validated hit (true positive) Analytic Filters Winners! ATOMIC SESSIONS SIGMA QUERIES QUERY HIT Validation Criteria • Analytic hit and attack marker match the exact same event log, or • Analytic hit must be near (+/- 5 seconds) an attack marker and share a MITRE ATT&CK tag or process ID
  • 20. Validated Analytics Atomic Sessions Dump LSASS.exe Memory using ProcDump Dump LSASS.exe Memory using comsvcs.dll Dump LSASS.exe Memory using direct system calls and API unhooking Create Mini Dump of LSASS.exe using ProcDump Dump LSASS.exe Memory using Out-Minidump.ps1 Cred Dump Tools Dropped Files LSASS Memory Dump File Creation LSASS Memory Dumping Procdump Usage Suspicious Use of Procdump LSASS Memory Dump Suspicious Use of Procdump on LSASS Lsass Memory Dump via Comsvcs DLL Dumpert Process Dumper LSASS Process Memory Dump Files Dumpert Process Dumper Process Dump via Comsvcs DLL Credentials Dumping Tools Accessing LSASS Memory Generic Password Dumper Activity on LSASS Accessing WinAPI in PowerShell for Credentials Dumping Sigma Queries ATOMIC SESSIONS SIGMA QUERIES QUERY HIT T1003.001: OS Credential Dumping: LSASS Memory
  • 22. False Positives Filter Validation Filter Unfiltered Sigma Queries: 129 Atomic Sessions: 127 Sigma Queries: 221 Atomic Sessions: 214 Sigma Queries: 1840 Atomic Sessions: 379 SIGMA 322 ATT&CK TECHNIQUES 567 Realistic ATT&CK Coverage ATT&CK TECHNIQUES 567 SIGMA 130 ATT&CK TECHNIQUES 567 SIGMA 115 Query / Session Counts ATT&CK Technique Coverage
  • 24. Analytic Similarity • Nerds: Projection of the bipartite network onto a single mode using hyperbolic weighting • Everyone Else: Finding similar/duplicate analytics Analytic Similarity Applications of Similarity Calculation • Deduplication • Auto labeling • Defense-in-depth Use unvalidated data to calculate correlations Disjoint of sets of most correlated analytics Projection showing Sigma query connectivity based on similar Atomic Red hits Leveraging Graph Data
  • 25. Analytic Similarity Analytic Similarity • Nearly identical analytic • ATT&CK tag error Mavinject Inject DLL Into Running Process T1055.001 Process Injection: Dynamic-link Library Execution T1056.004 Inject Capture: Credential Hooking detection: selection: CommandLine|contains|all: - ' /INJECTRUNNING' - '.dll' OriginalFileName|contains: mavinject condition: selection Mavinject Process Injection T1055.001 Process Injection: Dynamic-link Library Execution T1218. Signed Binary Process Execution detection: selection: CommandLine|contains: ' /INJECTRUNNING ' condition: selection Example #1 – Result: Merge to improve
  • 26. Analytic Similarity Analytic Similarity Suspicious Rundll32 Script in CommandLine T1218.011 Signed Binary Proxy Execution: Rundll32 detection: selection_run: CommandLine|contains|all: - rundll32 - 'mshtml,RunHTMLApplication' selection_script: CommandLine|contains: - 'javascript:' - 'vbscript:' condition: all of selection_* logsource: category: process_creation product: windows Example #2 – Result: Keep Both for robustness • Similar analytic and same tag • Defense-in-depth • Process logs • Network logs • Auto-labeling potential Rundll32 Internet Connection T1218.011 Signed Binary Proxy Execution: Rundll32 detection: selection: Image|endswith: 'rundll32.exe' Initiated: 'true' filter: - DestinationIp|startswith: - '10.' - '192.168.' - '172.16.' ... filter_microsoft: DestinationIp|startswith: - '51.124.' condition: selection and not 1 of filter* logsource: category: network_connection product: windows
  • 27. Research Wrap-up CONFIDENTLY DEPLOY ANALYTIC LIBRARY THREAT LIBRARY Undetected Attack Logs VALIDATED True Positive Untested Signatures Collision Experiments Results • Curated set of validated analytics • Backlog of undetected Atomic Red sessions • Realistic MITRE ATT&CK coverage • Graph theory analytic similarity Released Today in SnapAttack Community Platform ATT&CK TECHNIQUES 567 SIGMA 115
  • 28. SnapAttack – Community Platform • Forever free and open to the community • Access to all community content (including all Sigma analytics and Atomic Red attacks mentioned today) • Request contributor beta access (general availability in the next ~3-4 months) • Analytic IDE for creating and testing detections • Capture and share your own attacks Register Today or Request Contributor Beta Access https://www.snapattack.com/community We are launching our community edition today