>> Hello, and welcome to ATT&CK Fundamentals.
My name is Jamie Williams and I will
be your host and instructor.
This course will serve as
the first and fundamental piece of
the MITRE ATT&CK defenders series,
where we will explore how ATT&CK and
a threatened form mindset can help
focus our efforts towards understanding,
and more importantly, improving how
our defenses fair against real-world cyber adversaries.
This course will be all about ATT&CK, specifically,
how we can use ATT&CK to model
the behaviors performed by adversaries as
well as how do we apply this knowledge to
the various defensive cybersecurity practices
and operations we perform every day.
This course is designed for anyone interested in
or already involved in threat modeling.
By the end of the course,
you'll have a better understanding of
the structure and philosophy
that continually shapes ATT&CK,
be able to identify
available ATT&CK resources and operational use cases and
have a better recognition of how ATT&CK
empowers defenders through understanding of threats.
This course is split into three modules.
The first of which focuses on understanding ATT&CK.
In Module 2, we will explore
the benefits of using ATT&CK.
Before, and finally, in Module 3,
lightly diving into the various ways we
can operationalize the knowledge captured in ATT&CK.
Welcome to Module 1.
This module is split into eight lessons which all
focus on the central theme of understanding ATT&CK.
Specifically, we will explore
what data goes into ATT&CK,
how that data is structured and formatted,
as well as how ATT&CK grows over time.
Without further ado, let's dive in.
Welcome to Module 1,
Lesson 1: introduction to attack.
In this lesson, we will explore
the background and motivation behind ATT&CK.
Begin to identify what
information is captured within ATT&CK,
and start to build a recognition and
appreciation for the structure of ATT&CK.
Cyber threats are out there,
whether in the form of malware or threat actors.
As defenders, the ability to
observe and adapt these threats is vital.
This process begins by asking tough questions, such as,
how will these adversaries target us,
and what will they do after
they get access to our networks?
This is where ATT&CK comes in.
ATT&CK is our knowledge base of
adversary behaviors based on real-world observations.
What I mean by this is that the inputs
to ATT&CK are publicly available.
Cyber Threat Intelligence describing campaigns,
actions, and behaviors performed
by real-world adversaries.
ATT&CK is also free,
open, and globally accessible, meaning that,
anyone can consume the information of ATT&CK as well
as contribute information back
to help us grow and expand the model.
A great way to start thinking
about the information capture in
ATT&CK is through David Bianco's Pyramid of Pain.
This model describes the hierarchy in various levels,
and types of indicators of compromise or
IOCs that we can use to describe adversaries.
In this case, every layer and level of
the model has a different value of the IOCs.
Particularly, related to how much pain it inflicts on
the adversaries as defenders are
targeting them at that level of abstraction.
As we can see, levels at
the bottom of the pyramid such as
hash values and IP addresses,
were prevalent to inflict
much pain back to the adversary,
and these are easy or even trivial values to change,
especially compared to those at
the top of the pyramid, such as TTP's.
This is where ATT&CK tends to focus its attention.
Actually, ATT&CK,
expand on the idea of TTPs,
and captures it within the model.
Particularly, the tactics,
techniques, sub techniques,
and procedures executed by real-world adversaries.
The rest of the lessons in this module,
we'll dive into this structure,
and I'll show you how
the TTPs are captured within attack.
Particularly, we'll cover matrices and platforms,
tactics, techniques and sub techniques,
metadata associated with these techniques and
some techniques such as mitigations,
data sources, and detection,
which are vital for defenders,
how techniques and sub techniques are
related to the group in software
that perform and/or execute these behaviors,
and finally, how ATT&CK grows and evolves over time.
By the end, you'll have
an appreciation for the structure of ATT&CK,
and how the various objects interrelate.
Also be able to apply them to
real-world use cases such as APT 28,
accessing credentials using Mimikatz
to dump LSASS memory.
With that, we reach our first knowledge check.
ATT&CK is primarily informed
by which of the following sources?
Please pause the video and take some time
to think about and select the correct answer.
In this case, the correct answer was A,
ATT&CK is primarily informed by what
has been seen in operational use
by the broader community.
With that, we've reached the end of Lesson 1.
In summary, ATT&CK was developed to
address the need to document and understand
adversary behaviors and is built on
publicly reported Cyber Threat Intelligence.
The ATT&CK model was designed to connect tactics,
techniques, and procedures to
the threat actors and malware that perform them.