>> Welcome to Module 1,
lesson 7 Groups and Software.
In this lesson, we will define and
explore what are ATT&CK groups and software,
identify the information provided by
ATT&CK about these groups and software,
and finally, building appreciation for
how these groups and software fit into the ATT&CK model.
As you recall from lesson 4,
ATT&CK techniques and sub-techniques
have a wealth of metadata.
In this lesson, we'll use the procedure examples of
section to pivot to groups and software.
As you remember, ATT&CK
breaks down the tactics, techniques,
and procedures of adversaries
and define these procedures as
specific implementations or ways that have
a series of executed techniques or sub techniques.
These specific examples are
populated on each page of our technique,
as well as on the page of groups and
software which we'll explore later in this lesson.
As you can see from the example below,
these procedure examples describe the groups or software,
specifically how they've executed
a specific technique or sub-technique.
While these procedures are
populated on a technique page,
we can also view these from
the perspective of a whole group or software.
ATT&CK defines groups as
related intrusion activity tracked by a common name.
Anyone who's read publicly
available intelligence knows that there's
various terms related to groups such as intrusion sets,
threat actors or campaigns
and ATT&CK rolls all these
together into what we call groups.
Groups are objects in the ATT&CK model
and are assigned a unique identifier.
As you can see from example below, each group has a name,
a short description, as well as
other various metadata such as aliases.
Defined software as the tools or
malware used by an adversary during intrusion.
Similar to groups, these software are objects in
the ATT&CK model and have their own
unique identifier as well.
ATT&CK software pages also have their own name,
a short description, and various
other metadata including aliases.
Here's an example of a group page, in this case,
we're looking at the group APT38.
From here this view, we can see
the short description but if we scroll down that page,
we can also see the techniques
and sub techniques mapped to APT38,
as well as the software used by this group based on
publicly available reporting already
mapped within the ATT&CK framework.
With that, we've reached
our knowledge check for lesson 7.
True or false; there are
potentially many procedures for a given technique.
Please pause the video and take a second to
think of the correct answer before proceeding.
In this case, the answer is true.
As we saw from the example from the technique,
there are potentially many procedures for how
each given technique can be
implemented by a specific group or software.
In summary, ATT&CK groups represent
the name clusters of intrusion activity,
whereas software represents the tools
or malwares used by these actors.
For both groups and software,
ATT&CK provides descriptions and aliases,
as well as what techniques and sub-techniques have been
mapped based on
publicly reported intelligence from these threats.
Finally, techniques are
mapped to groups and software via
procedure examples or the specific ways
that techniques have been performed by these adversaries.